NFC Card Payment Fraud: How Scammers Exploit Contactless Technology

Welcome to Scams, Hacks and Frauds, where True Crime stories about Scams and Hacks are our speciality.  This week, we see both combined as a man sees his bank account robbed when his card details are stolen.

Join us as we delve into the harrowing experience of Ian Williams, a pensioner who found himself at the mercy of a sophisticated scam that drained his bank account. Imagine waking up to discover that $1,338 has been stolen from your account, only to be told by your bank that you are responsible for the fraudulent transactions. This is the reality Ian faced when the National Australia Bank's fraud team dismissed his claims despite overwhelming evidence proving his innocence.

Join us as we follow Ian's relentless pursuit of justice against the bank, which initially offered a refund with strings attached, insisting he remain silent about the case. Undeterred, Ian took matters into his own hands, immersing himself in legal research and even filing a writ against the bank for a staggering $379 million in compensation. We discuss the shocking details of his battle, the bank's attempts to evade accountability, and the broader implications of such scams in our digital age.

Tune in to learn about the tactics used by scammers to obtain personal information, the importance of safeguarding your financial details, and practical tips to protect yourself from falling victim to similar frauds. Ian's story is not just about one man's fight; it serves as a crucial reminder of the vulnerabilities we all face in an increasingly digital world.

Discover the dangers of NFC contactless payment scams and how to recognize the warning signs. This episode covers true crime cases and highlights essential tips for detecting scams and protecting your credit cards from fraud. Stay informed and safe with actionable insights

We publish new content every other Monday. The  10 minutes our episodes may save your wallet, and help protect your family.

If you like shows like "The Perfect Scam" or "Darknet Diaries" then this show might be for you.  

On our website you’ll find more computer hacking, identity fraud, impersonation, consumer rights and Romance Scams.  To find these and to access our transcripts, visit us at www.scamshacksandfrauds.com.

The transcript and spoken audio are available under the Creative Commons, Share Alike, With Attributions license. For more information on this visit creativecommons.org.  

Transcript

Waking up to discover that money has been taken from your bank account is a nightmare.  Now imagine the nightmare you’d face when your bank tells you that you’re responsible despite you being nowhere near the place the money was taken, and having overwhelming evidence to prove you’re the victim of fraud.  This is no dream, it's a horrible reality for Ian Williams, a scam victim battling the National Australia Bank for it’s fraud team’s inaction and enablement of this scam.  This is the Podcast that keeps you safe from Scams, Hacks and Frauds.

The best way to keep up to date on our show is through your favourite podcast app.  Subscribe to us on Apple Podcasts, Amazon Music, Spotify or Youtube.

It's a cold spring morning in Bendigo, a fair-sized city of about 100 thousand people, about 150 kilometres (or 90 miles) north of Melbourne in Australia.  Ian Williams, now 73, a pensioner, is going through his normal routine in the bathroom.  As he takes a seat on the porcelain throne, he decides that this is the perfect time to check his banking app, to make sure there are no fradulent transactions on his account - a sensible move that we of course applaud - he discovers to his horror that $1338 has been taken from his account a few days ago.  He taps further into the app and checks the details. He phones the bank, as you should, and reports the transactions as fraud.

The Bank’s fraud team said it would investigate and called him back two hours later.  The Fraud team informed him that their data indicated the payments had been made with a Google wallet at a Supermarket in Melbourne during the middle of the night. As he was personally present and had used his thumbprint, there was no fraud to investigate.  Google Wallet is supposed to be secure, and thats why it needs your thumbprint to prove its you. The problem, of course, is that he wasn’t in Melbourne that night, and you definitely don’t travel to Melbourne just to go to the supermarket - Bendigo has plenty.  is map app tracks his movements, and it shows that he hasn’t left Bendigo.  Not only that, he has an app that monitors his sleep, and it shows definitively that he was at his home, in Bendigo, asleep.  None of this was making any sense.

Ian again did the right thing; he went to the police with all of this evidence and made a statement.  He completed a fraud pack and even had an officer sign a witness statement that he’d seen the evidence that Ian had collected.  Surely that should be the end of it, right? This should be the bit of the podcast where I encourage you to check out the website and sign off.

Well no, that would be a boring story.  The bank was completely unmoved.  The police, however, weren’t, they contacted the supermarket and obtained a copy of the CCTV.  It probably won’t surprise you to learn that the tapes showed definitively he was not there, and that it was two young men who’d managed to obtain copies of his credit card details somehow and bought a load of gift cards to cash out on the scam.  Surely, by now, the Bank had been moved to act against this fraud?  Right?

After involving the Australian Financial Complaints Authority, the Bank was willing to pay back the $1338 to make this go away, but there were strings attached.  The bank specifically wanted Ian not to discuss the case and to agree that the refund didn’t imply the bank accepted responsibility for the fraud, and they weren’t offering any compensation for the poor service.

Insulted by this offer, and still very unhappy about the way he’d been treated and accused of fraud himself, Ian said no.  Five months later, the bank attempted to put the scam behind them, increasing the amount to £ 1,500.  Ian again said no, holding out for a proper apology and acknowledgement of fault.  Ian, in Australian parlance, told the bank where to go.

Ian decided to launch a crusade against the bank in an attempt to change the way it handles fraud.  He sought legal advice, but found little appetite; legal experts were afraid to take on one of Australia’s biggest banks.  So he did it himself.  He immersed himself in case law and statutes, and prepared a 14-page writ. 

Now, if you are going to court, Judges expect that you’ve tried everything you can first; they can become pretty upset if you haven’t.  So he attended the Bank’s headquarters in Melbourne and told the bank that as he’d been hit for 5.5% of his annual income, they should pay him 5.5% of their annual profits as compensation for the lost amount to the fraud.  This came to  $AU379 Million.  He gave them 4 weeks to respond to his case.

They didn’t respond, so he took them to court.  We’d love to tell you that this was an amazing David and Goliath battle… But they didn’t even show up.  And Ian won a default judgment.  Justice? No, the National Australia Bank appealed to the Supreme Court of Victoria, claiming that they had not attended as they’d lost the paperwork and requested that the case be recalled.  The Supreme Court has agreed, and Ian will soon be battling this particular Dragon in court.

—

Now, the smart money is on this case not going much further.  Although the Bank’s Fraud team has clearly messed up, courts typically try to put people back in the position they were before the incident, so the idea that Ian will be getting 379 million is probably a non-starter. Still, it is a great way of grabbing headlines and highlighting just how badly this bank has treated this scam victim, and how widespread this type of fraud is.  

But how on earth did his details get into a Google Wallet on someone else's phone?  Surely this is some isolated freak event.  Well no.  Cybersecurity Expert Ford Merrill says you can buy phones from China loaded with stolen credit cards - and they sell them by the crate.  They don’t even bother to offer sell them one at a time, you have to buy a whole crate.

We don’t know how Ian’s details were taken, but Krebs on Security has been monitoring how these types of scams happen, so we have a pretty good idea.  Just a question before we go on, when was the last time you got a text message about a delivery?  For me, it was earlier today, but I’d be surprised if any of us could honestly say we haven’t had many of these messages this week… Buying online has just become so easy.  Have you ever received one about a problem with your delivery that has then gone on to ask for your card number either to verify your identity, pay some underpaid postage or a redelivery fee? Scammers use these messages to grab your card details, and then pop them into Google and Apple wallets under their control… And just in case you get cold feet, they don’t wait for you to hit submit or ok, they capture every keystroke on the site.  They might even then call you, reminding you of this message, to help convince you that they’re your bank’s fraud department - this has happened to my wife.

Now, if you’ve used one of these wallets, you’ll know that they ask you for a code to set up a card- the scammers follow up asking you to give them that code too, and thinking it's all legitimate and safe.  It could be days, weeks, or even months before you realise you’ve been a victim of a scam.

The best thing you can do is not click on any links in any text message.  If you want to check up on a delivery, go back to the website you ordered it from, and if there isn’t a direct link to the courier, get the delivery reference number from there, and then go to the courier’s website directly.  Never ever enter your card details simply because a link in a text message told you to.

 I've been Cee and this has been scams, hacks, and frauds. If you've got a minute, please leave a review on your favorite podcast app just to tell us how we're doing.

And remember to share your story. You can email us at CEE@scamshacksandfrauds.com. You can also find transcripts in all of our episodes at www.scamshacksandfrauds.com.