‘How did this not trigger alarm bells?’ Spotlight on NAB’s failings in major fraud

In April last year, Australia’s second-largest bank National Australia Bank received regulatory manna from heaven.

After a five-year-long investigation into suspected systemic breaches of anti-money laundering laws by the financial crime regulator AUSTRAC, NAB was spared a major fine like its competitors Commonwealth Bank and Westpac which had respectively been fined $700 million and $1.3 billion for similar but more voluminous breaches.

Instead, AUSTRAC allowed NAB to enter into an enforceable agreement where it promised the regulator it would do better. “We have a plan to make our bank simpler for customers to use, while safeguarding against the criminal threat,” NAB chief executive Ross McEwan said at the time.

NAB’s easy AUSTRAC escape raised eyebrows in the banking industry given the reputational damage the bank suffered during the 2018 banking royal commission which heard evidence staff had falsified documents and a fraud ring had abused the bank’s introducer home loan program. NAB’s loose controls were also raised again during the prosecution of former bank consultant Helen Rosamond.

A little over a year after NAB and AUSTRAC entered into their agreement, NAB is again in hot water.

The bank is at the centre of allegations that international fraudsters were able to easily set up accounts at the bank using stolen identity documents to orchestrate a $25 million scam.

The allegations, made by lawyers for two large US companies in the Supreme Court of Victoria, cast doubt on whether the bank has reformed its ways and set up systems and controls to stop frauds and money laundering by crime gangs.

It has also given hope to other scam victims around Australia that they may have some recourse in recouping their losses if the US companies are successful in building a claim the bank was negligent and failed to follow its own rules when processing the transfers.

Australian banks, including NAB, generally don’t refund money lost to scammers by their customers. Instead, the banks spend money educating the public about scam awareness and see the losses as, ultimately, the responsibility of the victim.

“It’s a very interesting case,” says Consumer Action Law Centre policy officer Tom Abourizk, who this month attended a round table discussion on scams set up by Finance Minister Stephen Jones.

Loading

“It [scam losses] keeps falling to one individual at a time. Unless a big court case like this comes along, nothing changes and those people just keep wearing it. ”

Earlier this month, this masthead revealed NAB’s accounts had been used by international fraudsters who had hacked into the systems of Californian company Terra Global. By impersonating executives at Terra Global, the fraudsters were able to convince the group’s US-based investment partner Anew Climate – majority owned by a division of US giant TPG Capital – to send $US16.69 million dollars ($25 million) to an NAB account.

The fraudsters were able to set up the account at NAB in the name of a recently incorporated Australian company that listed a man from a suburb of Maitland, NSW, as its director and shareholder. The man, Michael, had no knowledge his ID had been used to orchestrate a major international fraud until contacted by this masthead. This masthead has chosen not to publish Michael’s surname or suburb.

The US Secret Service and the FBI are investigating the fraud, and the Australian Federal Police is assisting the investigation via its multi-agency taskforce into business email compromise cybercrime, known as Operation Dolos.

Police sources who could not be named for operational reasons said Michael was not suspected as having any involvement in the fraud. Michael said he has made a formal report with Australian authorities about his ID being compromised, but remains frustrated about why he has been dragged into the matter.

NAB’s failings in focus

An investigation by this masthead can reveal the fraudsters were able to open three bank accounts over three days in the name of the Australian company set up in Michael’s name (Terra Global Capital Pty Ltd) with limited checks by the bank about whether Michael was really in charge of the company and the accounts.

It can also be revealed that fraudsters were able to deposit the $25 million in one of the NAB accounts and then withdraw most of it ($23 million) on the same day over 30 online transfers without any stop being placed on the account. This was despite the type of account – a foreign exchange account – coming under special monitoring provision for offshore transactions.

NAB’s records of the accounts provided to the court so far appear to be limited. Its records include a form from the bank that was used to set up the account and to give authority to “Michael” to control the account. The form requires the signature of the customer and a staff member. It has neither signature. It is also undated.

Another NAB document, titled “Request to Open NAB Foreign Currency Account Onshore”, also includes incorrect information. The NAB phone number listed on the form sounded engaged when this masthead called it this week. The email address listed on the form spells Michael’s first name as “Micheal”. The form also states the account authority card form had been signed by the customer, despite the copy of the form produced by NAB not being signed.

Two mobile phone numbers were given as contacts for the accounts. One is listed with a prefix 03, for Victoria, as though it was a landline number, and Michael and the Australian company set up in his name being based in NSW. Both numbers are now disconnected. The documents claim the accounts had been verified using “SMS/Email”.

NAB has, so far, only provided lawyers for the US companies with a passport number that was filed with the account. At the time of writing, the bank appears to have not produced a certified photocopy of the passport, which it is required to hold under its own Certified ID Guide policy.

In response to a series of detailed questions, a spokesperson for the bank said: “As this matter remains before the court, we are unable to comment on this case.

“At NAB, we take our financial crime obligations very seriously. We have robust systems in place to ensure we’re meeting our customer identification and KYC [know your customer] obligations, and we continually invest in our ability to detect, deter and prevent financial crime.”

AUSTRAC’s concerns

NAB’s agreement with AUSTRAC focused on the bank’s know your customer – or KYC – controls. KYC is the centrepiece of banking regulation. It is the obligation for a bank to know who their customers are so they can ensure money launderers, drug traffickers and other criminals are not using banks or casinos to wash dirty money.

Loading

Since 2021, Australia’s anti-money-laundering laws explicitly prohibit banks and other groups from providing a “designated service”; for example, a foreign exchange bank account like the one used to transfer the defrauded funds, if customer identification procedures cannot be performed.

The enforceable undertaking agreement between the bank and AUSTRAC shows the regulator believed NAB’s systems were lacking and did not include adequate anti-money laundering and counterterrorism financing checks.

AUSTRAC’s concerns also focused on offshore transactions, similar to the ones made by the fraudsters first into the bank account from a US-based company with no business here and then out of the bank to Turkey and China on the same day.

The bank appears to have been taking the AUSTRAC agreement seriously. It told investors last year it would spend between $240 million and $360 million over three years to fulfil its undertaking to the regulator, including new IT systems and an external expert to review its progress.

A spokesman for AUSTRAC had determined it was appropriate to accept an enforceable undertaking from NAB rather than launch civil penalty provisions “considering the nature and volume of non-compliance”.

“Every decision is considered on its own merits and AUSTRAC stands by this decision.

“AUSTRAC does not comment on operational matters or provide information regarding suspicious matter reports,” the spokesman said.

Victim blaming

NAB has been keen to promote the good work it has done in raising customer awareness to ensure individuals safeguard themselves from becoming victims of scammers.

Consumer advocates such as Abourizk say the banks’ response can often take the form of “victim blaming”.

“There’s definitely an unwillingness for the banks to acknowledge their often central role in the scamming business model.

“They certainly don’t want to acknowledge that they have got a part to play in preventing this from happening.”

Loading

Abrouzik points to the new UK model where banks have agreed to pick up the tab for scammed customers.

“There’s a new announcement from one of the big four about the additional steps that they’re taking to prevent scams and to monitor transactions to identify risky transactions and no doubt that has an impact.

“At the same time, we keep seeing cases like this, and we think – how on earth did this not trigger alarm bells? How does a new account suddenly get $25 million transferred into it, and then it can be transferred out of the country so quickly?”

Lawyers for the US companies from Australian firm Gilbert + Tobin led are asking similar questions and are keen to press the bank on its systems and controls.

So far, the only formal action taken against NAB by the US companies has been to force the bank to freeze the bank account and hand over account information, but it is expected that the US groups will chase NAB for the money.

And if the US companies can prove NAB was loose in its controls, NAB could be on the hook for the full amount of the fraud and a new approach for how banks treat the victims of scams could emerge.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.