The telling sign that uncovered an online fraudster

ANZ fraud investigator Khaled can look at a screen of data and spot the one telling sign that a vulnerable person has been targeted by online fraudsters. 

Give him a couple of hours and he can peel that information back and connect a web of similar victims to one perpetrator. 

It is the kind of skill that has led to Khaled and his colleagues stopping a lot of fraudsters in their tracks, disrupting criminal networks, returning money to victims and leading to charges laid against the online thieves. 

While the role means Khaled is part accountant, sociologist and detective it also means he has to have a drive to get a result. And sometimes it means blocking out the white noise of a busy day in the office. 

No day was busier than July 19 last year when an errant cybersecurity upgrade caused a global IT outage affecting everything from airports to supermarkets to banks. 

“I was in the office, and I know I won't forget that day because that's the day when Microsoft went down.”

Khaled was more focussed on something interesting on a spreadsheet showing payments to ANZ bank accounts. 

He spotted payments made by a government department – intended for victims of assault – were all going to the accounts of one suspicious person. 

While the accounts were registered to a male, the payment descriptions referenced female names.  

“These mismatched payments were all going to accounts held by the same person.” 

He immediately alerted ANZ’s Inbound Fraud team who worked on the case with him.

“The accounts were held by a male - I cannot remember exactly how many credits went to him, it was ten credits or more that had been received into the accounts.” 

“And they were being addressed to female names. We had concerns when we noticed that.”  

“That prompted us to lock the account.” 

Khaled theorised that the scammers had somehow got the details of assault victims who were supposed to be receiving payments from the government department and had diverted them to their own account. 

“That very same day after I locked the accounts, some additional credits came in from the same department.” 

The urgency grew as he struggled to find the right person within the department to alert to the problem. 

Khaled and his colleagues at Inbound Fraud suspected ANZ wouldn’t be the only bank receiving credits.   

“This person would not only be doing it with ANZ, they would also be receiving credits into accounts at other banks - we needed to get onto this as soon as possible to prevent further activity.”

So, at 5pm, as people were leaving the office he tried his last resort. 

“We have a great relationship with the New South Wales Police. I contacted Detective Mark O’Reilly who I have worked with previously on other matters.” 

“He looked into it immediately, made sure he connected us with the right contacts at the government department and also, ensured the case was referred to the relevant police department”.

“It was because of Mark that this was escalated in a timely manner and the activity was disrupted.”

“The police and government department made further inquiries and uncovered accounts with other banks as well.” 

“This resulted in disrupting it as soon as possible before the loss increased”. 

The police investigation led to two people being arrested. 

“It's an important initiative by the government; they're providing support to genuine victims, and misusing this can be really harmful.” 

“Protecting the community, and the genuine victims, is crucial. Because if they didn't, it’s likely more money would have been lost to the fraudster.”. 

“It is through collaboration and working together that you get to see these results. It’s important to have that eco system in place.” 

Jeff Whalley is a Journalist with bluenotes