Remote access scam victim failed to take reasonable care of his banking

Categories:

Fraud & scams, Bank accounts,

Summary:

In July 2026, a scammer got access to Steve’s mobile device and two unauthorised transactions were made from his account , one of $70,000 and another of $901. Steve had received a call from someone he believed was a representative of an internet services company who told him they needed access to his phone to fix technical problems and protect his bank accounts. Steve downloaded remote access software on his phone so the caller could access his device, and Steve then logged in to his internet banking at the caller's request using credentials he had saved to his internet browser.

Published:

September 2026

The bank offered to reimburse a quarter of his loss, that is, $17,493, as a goodwill gesture, but Steve rejected the offer, saying the bank should reimburse the full loss and should have detected and prevented the fraudulent activity.

Our investigation

The evidence showed the caller contacted Steve through WhatsApp using international phone numbers and asked him to install remote access software on his mobile device so they could secure his bank accounts. Steve then logged in to his internet banking while the caller had access to the device using his password that was saved to the browser. The caller subsequently asked Steve to cover the screen of his device on several occasions during the interaction.

The caller claimed to be from an internet services company but was interested only in the security of Steve’s bank accounts. We considered it highly unusual for an internet services company to be interested in Steve’s banking, the possibility of hackers gaining access to his banking, and requiring remote access to Steve’s bank account to make it secure. Also, Steve understood he was giving the caller access to his device and then logged in to his banking while that access remained active. In these circumstances, we considered a reasonable person would have become suspicious about whether the caller was genuine. In short, we considered Steve had failed to take reasonable care of his banking.

As for whether the bank should have detected the scam and intervened before processing the transactions, the evidence showed the instructions were made using Steve’s genuine credentials, from his own device, and were authenticated through codes sent to his mobile device. We considered there were nothing to suggest to the bank that Steve was being scammed.

We therefore advised Steve to reconsider accepting the bank's offer of $17,493.