Banks and telcos work together to block overseas scammers

Thursday, 23 November 2023

Sam Leggett, senior analyst, Threat & Incident Response at CERT NZ photographed at the Exposed exhibition showcasing real people who’ve been caught out by online scams.

Banks and telecommunications companies have nutted out a way of stopping overseas scammers camouflaging their phone numbers to pretend to be from local bank call centres.

But the move has left scam victims asking what took banks and telcos so long to act.

Bank and telco chief executives met earlier this month to find ways to stem scam losses following headlines that accused banks of not doing enough to protect customers, and indicate countrywide scam losses could be anywhere between $200 million and $2 billion each year.

Paul Brislen, chief executive of the Telecommunications Forum (TCF), said the industries had drawn up a to-do list of work on reducing scam losses for customers.

But they had also put into action a plan to stymie overseas scammers pretending to be from bank call centres.

Scammers had been able to mask their actual phone numbers, making it appear the call like was from a bank call centre.

“We have worked with banks to identify which of their phone numbers are served from a New Zealand call centre,” Brislen said.

“We know these numbers are on the domestic networks and so anyone calling in from outside New Zealand pretending to be from that phone number will be blocked at the international gateway.

The next step is to get government departments involved.

“The call won’t proceed and so customers are safe from fraudsters pretending to be from a bank or other service provider,” he said.

The next step was for telcos to talk with government departments like Waka Kotahi, which scammers also sometimes pretend to be from.

There were limits to the “blunt” tool, however, Brislen said.

It would not work for banks’ overseas call centres.

Borja Ares is a victim of the Citibank investment scam, and is calling for action from politicians. He’s not holding his breath.

Borja Ares, who lost money in an investment scam earlier this year, is one of a tight-knit group who have organised to put pressure on banks to better protect people from scammers.

The bad publicity has prompted banks to pledge to build up anti-scam systems, but victims said they were moving too slowly, and were simply trying to stem criticism.

“They are managing the PR disaster,” Ares said.

Banks had under-invested in protecting their customers from scams, knowing the public had no choice but to rely on their services, as everyone needed a bank account.

He said the government needed to launch an inquiry into how vulnerable people were to being scammed, and regulate minimum anti-scam standards, instead of leaving banks to self-regulate.

He did not hold out much hope of the incoming government taking action.

NZ Telecommunications Forum chief executive Paul Brislen says banks and telcos are working together to reduce scam losses for New Zealanders.

“We have been emailing politicians. Most of them don’t care at all,” he said.

Brislen said the banks intended to help set up a national anti-scam centre based on the successful Singapore scam centre.

This would, Brislen hoped, become a centre for anti-scam activity, bringing together the likes of banks and telcos to talk more often to work out more defence strategies to protect New Zealanders from overseas scammers.

Ben Lynch from Akahu says its developed a confirmation of payee system that banks could deploy. It’s already been tested by one bank, and others are planning to have a look.

“We really need a central, government-funded model to make this work,” Brislen said.

Individual banks have begun announcing the deployment of new anti-scam systems.

Westpac said it had been integrating the Biocatch “biometrics software” into its systems to spot things like when someone’s usual typing rhythms appear to have changed, which can indicate that a crook is posing as a customer. ANZ planned to follow suit early next year.

Banks have also pledged to start checking that payee account name and number match before allowing electronic payments to happen.

It is a weakness in bank payment systems being exploited by scammers, who con people into thinking they are transferring money to the likes of Citibank to invest in a high-interest term deposit, when they are in fact sending money to completely unrelated mule accounts.

The banks have given no timeframe for fixing the weakness, but the technology to solve the problem may already be at their fingertips.

Fintech company Akahu, which is partly-owned by Westpac, says it has developed a “confirmation of payee” system banks could deploy very quickly.