Protect you and your clients from cyber-crime: advice for financial advisers

Fraudsters need a set of information known as personal identification information to perpetrate identify fraud.

Sometimes, this happens in the real world — stealing bags or wallets can allow criminals to get access to licences and credit cards.

But theft of personal identification information more often happens online through internet scams like fraudulent emails and text messages pretending to be from a familiar organisation, fake banking and payment websites, or malicious software code that takes information from computers.

Increasingly, telemarketing is also playing a front-line role — cold calls purporting to be from a bank, the ATO or internet service providers.

“And social media — we’ve seen people creating fake social media profiles and then friending people in order to glean information,” says Misitano.

Misitano says all sorts of information can be stolen from names, addresses and dates of birth to mother's maiden names, birthplace details and even credit cards, Medicare cards and passports.

The end result? A fraudster assuming someone else’s identity and using it to commit a crime or steal money.

What use is personal data?

Compromising a person’s identification information is just the start for cyber criminals.

Once someone has access to an identity, they can use it for accessing and operating accounts, withdrawing money or making requests for early releases of superannuation.

They can also open new bank accounts which can be used to receive stolen money.

One of the most concerning types of cyber-crime is a remote access scam where vulnerable people are tricked into allowing a fraudster to remotely access their computer — often under the guise of fixing a problem. Once the fraudster has access to the computer, they can impersonate the user to operate online banking or send emailed instructions to advisers and banks.

“We see this a lot, unfortunately, in the older age group of our client base,” says Tidyman.

“Be aware that it may happen to your clients, which is quite distressing for them and also can be complex to work through.”

Anatomy of a scandal

Misitano recalls a recent multi-million dollar fraud that targeted superannuation and share trading accounts.

The perpetrators included a 21-year-old Melbourne woman who acted as the Australian face of the scam.

They used stolen identity information and single use telephone SIM cards to set up as many as 70 bank accounts in the names of the victims and then made withdrawals from the victims’ superannuation and share trading accounts. The scam netted more than $2.5 million into the fraudulent bank accounts, which was swiftly spent in Hong Kong on jewellery and other valuables that were then sold for cryptocurrency.

The role of financial advisers - what you can do

Misitano and Tidyman have developed some tips for financial advisers to protect themselves and their clients from scams:

• Look out for fake identity documents. Mismatched fonts, borders and lines, spelling errors and other irregularities can be a sign of a fake document. Another giveaway is in the photo — genuine Australian ID photos are always against a white background, with no glasses or face coverings.
• Ensure customer details are captured accurately and names, dates of birth and addresses are spelt correctly and match exactly the identification documents provided. This includes middle names — if middle names are on ID documents, they must be reflected in the customer identity information.
• Look out for red flags — when customers instruct you by email, check the email address the instruction is coming from and check beneficiary account details against your records.
• Double check requests to add new beneficiary accounts or change contact details. Misitano says she is seeing instances of fraudulent instructions sent from email addresses that are almost identical to a customer’s email, with just two characters in the address switched around.
• If you’re not 100% sure about an email instruction, confirm it directly with the client — and make sure that the person you are talking to is the owner of the account.
• Watch out for multiple changes to a customer profile in a short period of time.
• Talk to your clients about cyber security and keeping their own systems and devices protected.
• Keep your security programs up to date.
• Review the Australian Cyber Security Centre’s Resources for Business. The Resources for Business includes the Essential Eight, Information Security Manual, Small Business Cyber Security and other handy reference material including exercise in a box.

Best practice — and who to call if you need help

“Get into the habit of having robust, strict controls around what it is you do every day,” says Tidyman.

“Don't let that become lax. Make sure that you not only are running good security, but make sure it's up to date… it's incumbent upon you to update when you get that prompt.”

And if something goes wrong?

“Your first port of call in regard to any kind of suspicious activity for BT is through your distribution partner.

“The distribution team know to come to us — so go to them as your first port of call.

“And then if we can't fix it immediately, we may set up a call or we may want to have a talk to you or give you some advice and guidance.

“We stand absolutely ready to help you.

“We've got a strong team of deep subject matter experts covering everything from fraud to financial crime and privacy.”

1 ACCC, https://www.accc.gov.au/system/files/Targeting%20scams%202022.pdf

This document has been created by Westpac Financial Services Limited (ABN 20 000 241 127, AFSL 233716). It provides an overview or summary only and it should not be considered a comprehensive statement on any matter or relied upon as such. This information has been prepared without taking account of your objectives, financial situation or needs. Because of this, you should, before acting on this information, consider its appropriateness, having regard to your objectives, financial situation and needs. Projections given above are predicative in character. Whilst every effort has been taken to ensure that the assumptions on which the projections are based are reasonable, the projections may be based on incorrect assumptions or may not consider known or unknown risks and uncertainties. The results ultimately achieved may differ materially from these projections. This document may contain material provided by third parties derived from sources believed to be accurate at its issue date. While such material is published with necessary permission, Westpac Financial Services Limited does not accept any responsibility for the accuracy or completeness of or endorses any such material. Except where contrary to law, Westpac Financial Services Limited intends by this notice to exclude liability for this material. Information current as at 26 July 2023. © Westpac Financial Services Limited 2023.