Law Talks Episode: Beware of scammers

Robyn:  Good morning and welcome to another edition of 4CRB’s Law Talks. Today we have joining us from Attwood Marshall Lawyers, Legal Practice Director, Jeff Garrett. Thanks for joining us, Jeff. 

Jeff: Morning, Robyn. My pleasure.

Robyn: Well, today we’re going to be discussing a topic that’s impacting a lot of Australians. In the first five months of 2024, Australians have lost more than 92 million dollars to scams, according to ScamWatch.

It is a significant problem and one that needs greater awareness. For this reason, today we’re going to discuss this major issue, to help people better identify scams and to understand their rights if they have lost money to a scam.  Jeff, what are some of the biggest scams people need to be aware of? 

Jeff: Yes, I think it’s becoming so prevalent now, Robyn.

It’s a big problem. Everyone is probably aware of the fake business invoice scams, where, you know, they send you, an invoice and say, oh, our bank details have changed. So, the fraudsters are intercepting the invoice that’s being sent to you to pay and putting their own bank details on there.

And the customers thinking, oh, well, they’ve changed their bank account, you know, just go and pay it to the nominated account and it’s going to the fraudster.  It doesn’t stop there. I mean, you’ve seen concert ticket sale scams. There’s fraudulent investment scams, which have taken the savings of a lot of people, not just elderly people, you know, right across the board.

And then there’s the, probably the most pervasive is the phishing scam, so called, phishing with a P H. 

Robyn: So, Jeff, can you explain what a phishing scam is and give our listeners some examples? 

Jeff: Yeah, I think everyone’s probably had this tried upon them at some stage. It’s when you receive an email or a text or some form of electronic communication asking for you to reinsert your credentials, your password, or something like that, including your, you know, full name, date of birth, bank account details, and your NetBank password, for instance, or your NetBank code, whatever it is.

And the purpose of these so-called phishing scams is to get your personal information, so that they can then go and either take money out of your bank account, use your credit card, use your forms of ID to set up fake companies and, operate companies in your name. There’s a whole host of things that flow from, the phishing exercise.

Robyn: And there’s a lot, particularly, examples that come to my mind is the ATO scams. There’s also the unpaid toll scam, I seem to receive a lot of those text messages at 2am every morning when I wake up, there’s one where they are telling me I haven’t paid my toll. 

Jeff: Yeah, it’s crazy. The ATO scam is a good one. There are several versions of that going around, you know, particularly around tax time. You know, they ask you to put your tax file number and different things in there and even, involving the use of the MyGov app, and it’s terrible, because once they get into that and get those credentials from you, they pretty much do anything operating as you.

Robyn: Yeah, once they’ve got all your greatest hits. 

Jeff: Yeah, well, there’s others, you know, there’s the Booking. com scan, that was going around. There’s the toll one, which you get by way of text, and just on text, you know, there’s the delivery ones that are going around as well.  There’s a whole plethora of different electronic communications that you’re getting now that involve you, you know, there’s some mistake or, and even phone calls where people are ringing saying, oh, we’re from Telstra or they try and guess who you’re, you know, your internet provider is. And, you know, that’s how I was thinking, I was sort of half daydreaming one day and got a call like that. And it was only because we were with someone else, we were with another provider and I said, no, hang on, we’re not with X, you know, and of course they hung up straight away.

Robyn: Yeah, just on that, it can be extremely difficult to know what is a scam and what is a legitimate message. So how can people protect themselves? 

Jeff: Yeah, good question. I think you’ve just got to be hyper vigilant with anything that you receive. You’ve got to assume that it is a fake. And that’s tough sometimes because they’re getting more and more sophisticated with how they’re doing it these days.

And, you know, even to the point where, you know, they’re using AI to even imitate voices and, things like that. It’s really sophisticated. So, I think the first thing you need to do is never, and I mean never, enter your credentials, password, client number, license number, anything like that over the phone or by text or electronically on your computer or whatever.

Unless you can absolutely verify that what you’re doing is legitimate and it’s coming from a source. And these days, it’s really hard to detect sometimes. I mean, I’ve been contacted by our bank, you know, the law firm, we’ve got trust accounts and things like that. We bank with one of the big four banks and I thought I was getting scammed by one of the big four banks that we have our trust account with, and it wasn’t a scam.

It was responding to a self-registered complaint that the bank had done, you know, of its own volition. Yeah. It was a bit embarrassing because I gave the person trying to ring me short shrift and,  you know, deleted their emails and things like that. And they were trying to get on to me legitimately.

So, you’ve got to be careful, but then I think you’re better off being careful because if you enter those details, your whole identity could be stolen and used by the fraudsters.

Robyn: And I think one of the things they say too is any of the big banks or MyGov or the ATO will never send you a link to click on and that’s one of the other tell-tale signs is if you do receive a message or an email that says click on this link, don’t assume that it is a scam. And Jeff, just on that, do you think the banks have a bigger role to play here in protecting customers? 

Jeff: Absolutely. Yes, and I think that’s been floating around in, on social media, on government websites, there is mounting pressure on the banks to take responsibility for some of these things. And, you know, I think that there are times when they know or knew that there were certain scams happening and failed to take steps to prevent that and also failed to take steps to notify their customers “Hey, this is, we’ve experienced this happening with the bank.” And I think some of that is because they’re scared that if they do that, people are going to go, oh yeah, that happened to me, you guys knew about this, how long did you know about it, and it goes from there, they’re, petrified that they’re going to be held liable for that. But with both governments and banks in each other’s pockets, it’s difficult to expect them to come up with a solution for this. I think there’s a raft of things that you can do, apart from being hypervigilant, as I said before. But, you know, do the usual things that you’ve got to do, and they are painful things, like regularly change your password, you know, look for the tell-tale signs of these things with emails.

The email address is usually bogus. Yes. It’s usually, you know, some random email address. The language of the text of the email itself is usually some form of broken English. That’s right. Yes, you know, there’s typos in there and misspellings and grammatical errors and you know, I can hear people groaning and saying well, my grammar is terrible, I wouldn’t know. But you can tell by looking at it. So, I think there’s plenty of stuff there that you can do to stop this from happening. And just, you know, there’s plenty of websites around, there’s the ASIC website, there’s a particular scam security website, cyber security websites.

There’s plenty of them around that you can go on to have a look at, just be careful that they themselves are not, are not scamming websites, you know, so, there’s plenty of things you can do, it’s, I think though that you’ve just got to approach every email and electronic or a telephone call that you receive  with a really high level of scepticism.

Robyn: Yeah. So, Jeff, if someone has been caught out in a phishing scam, what should they do? 

Jeff: Well, I think the first thing to do is to immediately change your password so, you know, because they may not have done something. Notify your bank or your financial institution immediately, that this has happened. If you are working for someone, or you’re with a company, or you’re with an IT provider, let your IT provider, or your in-house IT people know immediately, you know, don’t muck around because every minute counts with what these people can do. And make sure that you report it and you know, if they do get you or get partially through there, as I said, there’s those websites where you can register these things, but they’ll usually involve your bank or a credit card or something like that and most of the, well, not most of the time, but sometimes you may be covered there, depending on what it is.

That’s why a lot of people use, you know, certain forms of payment like PayPal and things like that because you’re protected to some extent by those things, but usually the banks will say, well, you gave them your password.  It’s part of our terms and conditions that you are not to disclose that to any third party.

That’s how they got into your account and took the money. So therefore, it’s not our problem. 

Robyn: Is there any legal recourse if someone has lost significant money to a phishing scam? 

Jeff: There may be. That’s another thing you can certainly go and get some legal advice in relation to it. We’ve had plenty of those sorts of cases where we’ve put enough pressure on the bank or the financial institution involved or if it’s a big company, you know like Amazon or something like that, where we may be able to get a refund or whatever, but it depends on how much it is as to whether it’s commercially viable to go and engage a lawyer to do it. You know if you lose 2, 000 dollars, you might spend double that going to a lawyer and engaging them to sue a bank or a big company or something like that.

But there’s been some cases, a lot of cases, where people have lost their life savings, hundreds of thousands of dollars. So, any of those cases you know, I think that you should get legal advice and just see because sometimes there may be situations where the bank or company involved is on notice and has had experienced those types of scams against their customers before, and they didn’t tell anyone about it. They didn’t take steps to thwart the fraudsters, etc. So, you never know, there may be some recourse available to you.

Robyn: I guess the best defence is to protect yourself, as you said, initially treat every email or, uh, every communication, you know, with suspicion until you’re sure of what it is, and I mean, in this digital world, Jeff, it’s a problem that’s not going to go away.

Jeff: Absolutely correct, Robyn. The thing I left off the list there was to report it to the police, there may be some recourse there, but look, it’s a bit like you know,  things being stolen and whatever else. A lot of the times the police have so much of these things happening that there’s not a lot of recourse available to you there either.

Robyn: All right, Jeff, we’ll leave it there today. But, um, some great advice. And as I say, always err on the side of caution. Thanks for joining us today. 

Jeff: No problems, Robyn. My pleasure. Thank you.

Robyn: You’ve been listening to Law Talks here on 4CRB, which you can hear every Friday morning from nine o’clock.