Our investigation

In examining the bank’s records on the password reset, the new device setup and the text messages sent to Erica, we found that the text messages told her to stop and check whether she was setting up the app on a new device. They also warned her that, if she was not setting up the app on a new device, it was likely she was being scammed. They suggested she change her password and call the bank immediately if she was not doing this. Erica acknowledged that she received the texts, but she did not act on them. We found she did not take reasonable steps to protect her banking, so the bank did not have to reimburse the loss.

We also looked at how the scammer was able to set up the app. The records showed the scammer had Erica’s access number, new password and the codes sent to her phone and email address. Erica said she might have clicked on a dubious delivery service link sent on a social media messaging platform, but she could not recall any subsequent phone call or remote access. On balance, we considered it most likely she had disclosed the details through the link, which was a way of phishing her credentials. The warnings sent with the codes made clear they were to be entered only in the app on the device being set up, and never on a website.

We also considered what the bank did after Erica and Hugo alerted it to the scam. The staff member first secured Erica and Hugo’s own accounts, then confirmed the circumstances and consulted the fraud team, before blocking the recipient account. The money had left the recipient account within six minutes of its arrival. We were satisfied the bank acted within a reasonable time to try to recover the funds.

Finally, we examined the bank’s handling of the fraud claim. The bank received Erica’s written account in February 2025 but did not communicate its decision until May 2025, nearly 15 weeks later. That delay was not reasonable. However, we considered the bank’s offer of $3,000 fairly recognised the stress and inconvenience caused by the delay.

Outcome

We upheld part of Erica’s complaint, and we recommended she accept the bank's offer of $3,000, which she did.a