Our investigation

The bank’s transaction records showed all but one of the disputed transactions were made from Alicia’s computer. The transactions required knowledge of Alicia’s access number and password, and most logins also required her physical authentication card. The last of the eight transactions was made on Alicia’s phone, and required access to her mobile banking app.

The payments were made over several months and each was made within a day of substantial funds being credited to Alicia and her husband's business account. On each occasion, some of the funds were then transferred to Alicia’s personal account, and were then sent on to the international money transfer account. This indicated that the person making the payments knew when funds were credited into Alicia’s business account.

We considered the possibilities for how the transactions could have occurred, including whether the transactions were likely to have been made through remote compromise or other external interference. There was no evidence of remote access or malicious software. Alicia also said she had not received unusual or unsolicited contact at the time of, or after, the transfers began. On the evidence available, we therefore considered remote compromise was unlikely to be the explanation.

Given the extent of information and access required to make the disputed transactions, we found the most likely explanations were either that Alicia authorised the transactions or that she had failed to take reasonable steps to protect her banking, thereby allowing the transactions to occur. In either case, the bank did not have to reimburse her loss.

However, the bank took more than 15 weeks to notify Alicia of its decision on her fraud claim. We found the delay was unreasonable, but we considered the bank’s offer of $2,000 fairly recognised the stress and inconvenience it had caused her.

Outcome

We upheld part of Alicia’s complaint and recommended she accept the bank’s offer of $2,000, which she did.