Customer ignored warnings with codes, but bank lacked extra authentication step before adding new card to digital wallet

Categories:

Fraud & scams, Bank accounts,

Summary:

In July 2025, Lindsey complained about unauthorised transactions from her account totalling approximately $8,400. It turned out she had been caught up in a phishing scam. The bank said it would not reimburse her because it had sent warning messages accompanying the codes used to register its banking app on a new device, and she had ignored those warnings. Lindsey also complained about later transactions made after the scammer upgraded her EFTPOS card to a debit card and added it to the scammer’s digital wallet.

Published:

September 2026

Our investigation

In examining the bank’s warning messages and the steps used to register the banking app on a new device, we found Lindsey did not act with reasonable care when she used the codes because the bank’s messages gave clear warnings about their use.

We also examined how the scammer was able to change the EFTPOS card to a debit card and add it to their digital wallet. We raised concerns with the bank that the scammer had been able to do this without any separate multi-factor authentication step. The bank then offered to reimburse 50 per cent of Lindsey’s loss.