I received $1000 and was asked to send it back. How was this scam meant to work?

Question

Possible Australianism - netbank = a website + app by which an Aussie can do their banking, including transferring money to other people.

A while ago, I ended up with $1000 transferred into my account, which in the description looked like a netbank transfer, not like a cheque, cash deposit etc, and which looked like it had already cleared and landed in my account. Usually when something is still working through the bank's system it displays as 'pending', but did not in this case.

I received a phone call from someone, saying that they had accidentally typed in the wrong account number, and wanting me to send them the same amount of money back via netbank.

1. Surely bank account numbers have a checksum, which make it relatively difficult for a typo to result in a payment going to the wrong person?

2. What are likely sources of them being able to find my phone number to call me? Obviously, the bank either being hacked, or giving it out in response to a query from this person (but surely the bank is unlikely to tell me my own mobile number if I claim to have forgotten it?). Presumably either my phone, or the phone of someone I have sent money to/received money from could be compromised. Has anyone heard of any instances of this happening?

   I then went to my bank, explained the situation and said that I did want to refund the money through the officially sanctioned methodology. After the laughter died down, the bank told me to ask the person to fill out a form, then they would get me to fill out a form that would authorize undoing that exact payment.

   I rang up the person to tell them this, and over the course of about a week received an increasingly elaborate story about how that wasn't working, they needed the money immediately, there was a fee to fill out that form and they couldn't afford to pay it etc.

   After that, I never heard back from them again. I check my netbank for several weeks after, expecting the money to magically disappear, but it did not. This was probably a year ago, and I'm pretty vague with money so may not have noticed if it disappeared more recently.

3. How were they expecting to benefit? Were they hoping to get the transfer from me, and undo the transfer to me, to leave them $1k up? If so, how can an internet banking transfer be 'undone' once it has already shown as 'received'. Or was this to do with money laundering? The account they requested me to send money to was the same as the one that the money appeared to come from.

4. This was a scam, right?

Answer 1

This is a very trivial scam.

Flow is like this:

1. Send money to Mr. X (you, in this case).

2. Call Mr. X and ask for the money back, because mistake. Usually they ask for a wire transfer/cash/gift cards/prepaid cards or something else irreversible/untraceable.

3. Mr. X initiates transfer back to Scammer.

4. Accept the transfer from Mr. X

5. Dispute the original reversible transfer or otherwise cancel it through the netbank

6. Mr. X cannot dispute his transfer to the Scammer, since it was sent via an irreversible medium.

7. End up with twice the money, at the expense of Mr. X

In other countries this is usually done with forged checks, but transfers can work just as well. As long as the transfer can be retroactively canceled or reversed - the scam works.

---

You mentioned money laundering - this is definitely a possibility as well. They transfer dirty money to you from unidentified sources, and you send a "gift" to them with a clear paper trail.

When the audit comes - the only proof is that you actually sent them the gift, and no-one will believe your story. You'll have to explain why the Mr. Z who's now in jail sent you a $1K of his drug money.

However, in this case I think it is more likely a scam, and the scammer didn't really know what he was doing...

Answer 2

This is almost certainly a scam or a mistake. This is not good, spendable money: it is not yours to keep.

Very simple to handle. Tell the bank, in writing that you were not expecting to receive this money and are a bit surprised to receive it. Preferably in a way that creates a paper trail. And then stop talking. Why? Because you honestly don't know.

This puts you at arm's length to the money: disavowing it, but not refusing it. Wildest dreams: nobody wants it back ever.

As for the person bugging you for the cash, tell them nothing except work with their own bank. Then ignore them completely.

He probably hacked someone else, diverted their money into your account, and he's conning you into transferring it to a third location: him. Leaving you holding the bag when the reversals hit months later. He doesnt want you reversing; that would return the money to the rightful owner! He works this scam on dozens of people, and he wins if some cooperate.

Now here's the hard part. Wait.

This is not drama or gossip, you do not need to keep people updated. You are not a bank fraud officer who deals with the latest scams everyday, you don't know what the heck you are doing in this area of practice. (In fact, playing amateur sleuth will make you suspicious). There is nothing for you to do. That urge to "do something" is how scammers work on you.

And these things take time. Not everyone banks in real time on smartphone apps. Of course scammers target those who'd be slow to notice; this game is all about velocity.

Eventually (months), one of two things is likely to happen.

• The transfer is found to be fraudulent and the bank reverses it, and they slap you with penalties and/or the cops come knockin'. You refer them to the letter you sent, explaining your surprise at receiving it. That letter is your "get out of jail free" card.

• The other person works with their bank and claws back the money. One day it just disappears. (not that this is your problem, but they'd file a dispute with their bank, their bank talks to your bank, your bank finds your letter, oh, ok.)

If a year goes by and neither of these things happens, you're probably in the clear.

Don't get greedy and try to manipulate circumstances so you are more likely to keep the money. Scammers prey on this too. I think the above is your best shot.

Answer 3

Possible ways they could make money (or think they could):

• There may well be a timescale to undo the transaction, which you pushed them out of by playing hard to get. This would seem too risky from their point of view as they're out of pocket, so:
• They may have been caught trying it on with someone else; if they were locked up or their hardware taken for investigation they wouldn't be able to keep pushing, and the timeout I suggest could have happened.
• They may be incompetent and have screwed up so the money was really transferred by a quick method instead of pending via a slow and cancellable one.
• The source of the funds could be a compromised account, i.e. stolen money. They make a traceable transfer to you, you make a transfer to them, they're up, their main victim is down, you're blamed. This is effectively a form of money laundering. This would rely on different account numbers (or different sort codes here in the UK).

I would go back through your transaction history and see if it's disappeared. Even with an assumed-rubbish interface finding a reversal of the transaction should be easy as you know the amount. I wouldn't spend it for a very long time if it is still there, just in case my last bullet applies.

Given what they knew about you (phone number and account details) I'd be wary enough to keep an eye on all my accounts, possibly wary enough to consider credit monitoring in case they try to open other accounts with your details. Although of course plenty of people have legitimate reasons to have this information - if you've written a cheque the account details will be on it, and you might well be in the phone book or otherwise searchable.

Answer 4

There are three possibilities.

1. This is a scam, as others have pointed out, it works by you sending money, then them stopping the original transfer, meaning you sent them your money and not theirs. They make money cause a stop payment only costs $50 (or around there) but you sent $1,000. So they profit $950. You lose $1,000 and maybe some processing fees.

2. This is money hiding, or money laundering. They send you $1,000 in drug money, you send them $1,000 in "clean" money. You don't lose any money. But they gain a clear paper trail. With large sums of money (in the U.S. anything over $5k) you have to prove a paper trail. They just did. You gifted it to them. On your end, it looks like you just profited from illegal activity, which in the worst case ends in confiscation of ALL your assets and jail time. It might not come to that, but it could.

3. This was an honest mistake, by an idiot. It is possible to wire a complete stranger money. If you make a mistake on the wire transfer forms, and the account number exists, it will go through. Now what makes the sender an idiot is not the mistake. We all do that. It's the fact that banks have a built in system for handling these mistakes. Simply put, you can make a stop payment. It's around $50 (varies by bank and sometimes amount transferred), it's easy to do, and almost automatic. If you tell a bank rep that you made a mistake they will likely have you fill out a paper, and in many cases will "just take care of it". If "the idiot" didn't want to tell the bank of the mistake, or didn't ask for help, or didn't want to pay the fee. Then maybe they would contact the receiving party. But that's pretty dumb.

Resolution

The resolution in all cases is the same. Visit your local branch, or send in writing, an explanation:

"I found $1,000 in my bank account that I didn't put there, and got this email (see attached print out). Please advise."

They will "freeze" the $1,000 (or maybe the account but I have never seen that) while they investigate. You won't be able to spend it, they might even remove it pending the investigation. They will contact the bank that issued the transfer and attempt to sort things out. You shouldn't be charged anything. You also won't get to keep the money. Eventually the bank will send you a letter stating what happened with the investigation. And the money will vanish from your account.

Specific questions

I wanted to state the information above even though it doesn't address your concerns directly because it is important. To address your specific questions:

Question 1) Surely bank account numbers have a checksum, which make it relatively difficult for a typo to result in a payment going to the wrong person?

Nope, that's up to each bank. Usually the account numbers are not sequential, but there is no "checksum" either. Just like credit cards, there are rules, but once you know those rules you can generate fake ones all day long. In some cases, account numbers 5487-8954-7854 and 5487-8945-7854 are both valid. It happens.

Question 2) What are likely sources of them being able to find my phone number to call me?

Phone numbers are not private. Not even close. Phone books, Google, Websites, etc etc. if you think your phone number is in any way a secret then your totally misinformed.

Account numbers are not a secret either. Especially bank account numbers. You could totally just call a bank, and say "What is the name on account 12345?" and they would tell you. Checks have your name and account number on them, as do MANY documents from a bank. So anything from asking the bank, to finding a copy of a check or document in the trash are valid ways to make the link.

Question 3) How were they expecting to benefit?

See options 1 and 2 above. If is is really option 3, then your bank should have directed the money back. But if the person was so messed up as you say, the account may have been closed and "written off". When that happens a lot of weird stuff can happen. Essentially the bank is "taking a loss" of money and doesn't want the money back even if the account was closed with a negative balance. Usually though contract with debt collectors, they may have already been "paid" for that debt, and are not allowed to take the money back. These things happen, but it seems like a pretty odd set of things that need to line up for #3 to be valid.

About your Length of time

Usually these things resolve in less then 90 days. Usually far less. At the 90 day mark, it gets really hard to reverse a transaction. It's possible that it was a scam and so many people fell for it that the scammers just let you keep the money instead of "highlighting" their scam. The fact that your using a "net bank" means that your can't go in person, but you should get details in writing. State the transaction number (it should be in your account records) and ask them for a "letter of resolution" or some form of official document stating the outcome of their investigation. I suspect that no one every really investigated the issue and the rep you spoke to never did anything then ask you to ask them to fill out a stop payment.

You need a record of trying to sort this out. You don't want to up for some legal battle 10 years from now because someone found out that the money was part of a pool that was used to fund some terrorist group or some such. So get a paper trail, then go with what the bank says.

Answer 5

It could be money laundering.

so:

Answer 1: They didn't get your data wrong. They indeed sent you $1,000. How they obtained your banking data is another issue we won't address here.

Answer 2: Your PII(*) was most likely compromised. From what you report, it included at least your banking info and your phone number. Probably more, but goes out of the scope of this answer.

Answer 3: Money Laundering is done in small transactions, to avoid having the financial institution filing a Currency Transaction Report(**). So they send $1,000 to several marks. Possibly at the stage of layering, to smudge out the paper trail associated to the money.

Money laudering is a risky endeavour, and the criminals don't expect to have all the money they enter into the system come out clean on the other side. You really don't want to be associated with that cash, so the best is to report to your bank that you don't recognize that transaction and suspect illegal activity. In writing. Your financial institution knows how to proceed from there.

Answer 4: Yes, and one of the worst financial scams. From drug trafficking, to human slavery and terrorism, that money could be supporting any of these activities. I urge the reader to access the US Treasury's "National Money Laudering Risk Assessment" report for more information.

• _{(*) Personally Identifiable Information}
• _{(**) Almost all countries have such regulations in place. Examples for USA, Australia, Brazil}

Answer 6

This was most likely a scam, although I do know of cases where a transfer intended for one company ended up in the bank account of another company. I am not entirely sure what happened afterwards, but I think the receiving company was asked to return the transfer back to the originating account. Still, even if this was the case, they wouldn't have just abandoned $1k for a simple administration fee (if there was even any). It doesn't sound logical.

Answer 7

Most answers have concentrated on this being a scam, however, it is possible this is an innocent mistake.

Australian bank account numbers do not have redundant digits to be used to validate an account number; all of the numbers are data and uniquely identify a bank and branch (the BSB number) and an account (the Account number). Computer check digits are not part of bank account numbers because bank account numbers pre-date computers.

It is entirely possible that someone entering an incorrect number can, by chance, hit upon an existing account. As the bank clearance system in Australia is entirely automatic there is no cross-checking of account numbers with account names.

Internet banking in Australia is not a wire-transfer as is common in places like the USA (although these can be done): here you are effectively accessing your bank's "back office". Nor is it like the BPay service which is used primarily by B to C businesses as a way for their customers to pay their bills; when using this service the biller code will show you who you are paying and the customer number does have check digit validation.

I run a business in Australia and it has happened to us on several occasions than an employee or supplier has given us incorrect numbers. Usually, it is not a real account and after a week or so the money makes its way back to us with a message like NO ACCOUNT or A/C CLOSED.

Very occasionally, however, the wrong number hits a live account: when that happens the person who f*&ked up needs to contact their bank and try and get the transaction reversed. If there is money in the destination account this usually happens with little fuss, however, if the destination account has been closed or emptied things get problematic.

Of course, taking money that isn't yours is stealing even if it happens to be sitting in your bank account. However, unless the sum involved is significant the police are usually not interested in diverting their attention away from "serious" crimes like homicide, armed robbery and terrorism so the aggrieved party is usually on their own.

That said, this is probably a scam because they called you rather than your bank doing so. They cannot get your phone number from your account number: they have to know who you are and what your account number is. This is not as hard to do as it sounds since both your name and account number are prominently printed on your cheques and deposit books (possibly your phone number as well which saves them looking it up in the White Pages).

Answer 8

OK,

1. there is no way in hell that a stranger should have your contact details.

2. there is no way in hell that a stranger should be able to determine your name from that account number unless you are previously known to them. Have they explained to your satisfaction how any previous relationship was established?

3. It was correct to direct them back to their own bank or their branch manager if they bank with the CBA. There are procedures in place for this, and you are in the clear if the bank handles it.

4. Even there is a previous relationship, and you are in their address book, think long and hard about their "bona fides".

5. It may not have been a scam they may have had fat fingers and be genuinely out of pocket now. It is SOP that if you refuse to refund the money the banks will become less helpful. (EDIT - you have consented to retrun the money).

EDIT - IF you had not consented...

6. You might be sued, prosecuted. Especially if it was bank money, rightly or wrongly there have been prosecutions of late of people who have been provided credit in error and have availed themselves of it.

Disclosure: I am a former CBA employee and a 20 year veteran of NetBank, and these are my own opinions.

Answer 9

Answers to your questions:

(1) Do bank account numbers have a checksum. NO.

(2) Is it plausible that they found out your number after sending you the money by "accident". NO. There is no way to find out who possesses a particular bank account just by the number. Also, how they even know they made a mistake? They targeted you and knew who you were and your bank account number before the "money" was sent.

(3 and 4) Is this a scam? YES. They never paid you any money. They forged a check for a large amount and deposited it in an account. Then divided it up, wiring pieces to multiple people, all of whom they investigated beforehand. Since it is a bank to bank transfer it clears. Once the forgery is discovered, all the transfers will be unwound. If you had sent them money, you would have lost that money.

Other things to note:

• There is zero chance of a wire transfer going to the wrong person because the sender has to list the name and address on the account as well as the number.

• You basically did the right thing which is to notify your bank that you received an unauthorized transfer into your account. Never accept money into your account from someone you don't know. If money "appears" in your account tell the bank it is an error and probably proceeds from a forgery and they will take care of it.

Answer 10

The initial story sounds normal. Happens every day. Checksums cannot prevent this, since it is a typo by the sender. The sender typed in a wrong account number. That account number happened to exist (so the sender wouldn't get any immediate error message), your account.

But, that innocent story can also be used as part of a money laundering plan. Namely, to give the money a legitimate source. Also can be used in a scheme to frame you for something.

The question of how the person got your phone number raises suspicion. The bluffs to avoid the normal paperwork, and then disappearing, make it incriminating. No doubt. Take this to the police.

The question arises: even if the plan (whatever it was) failed, why didn't he do the paperwork and get the money back? The answer is that that would leave a trail to possibly be picked up in a future investigation.

Answer 11

I've skimmed through the answers given and I'd like do add another possible scenario.

I've recently heard about this exact thing happening to someone only the money originally was a loan taken in the receivers name.

1) Scumbag finds out personal data – including social number, bank account and phone – of Innocent Victim.

2) Scumbag takes out a loan in the name of Innocent Victim. The money are sent to IV's account.

3) Scumbag calls IV saying 'Oh, I've made a mistake, blah, blah, yada, yada. Could you please send the money back to me? My bank account is...'

4) Innocent Victim, being the good guy that he/she is, of course want to help out and send the money to Scumbag.

5) Scumbag makes a cash withdrawal and is no longer anywhere to be found and Innocent Victim is left with a loan but no money.

Answer 12

I would have asked for the intended recipient's account number and pursue sending the money there. If it's the same as yours (except for one digit) that would be a good sign. But even here, the crook could send money to dozens of different accounts, all off by one digit, just to make it look authentic. I'm going with scam just to be safe.

As for the checksum, it's used on paper checks (next to the last digit) but not necessarily the actual account. Credit card accounts use an algorithm, but online tools create as many legitimate character strings as you want. I used to work at a credit union, and when the time was just right, I opened account number 860000 (actual account number except for the second digit). All their account numbers were sequential, so the oldest account number was 000001.

Sadly, many important systems are set up to meet the simple needs of the masses, and are easy to beat if you really want to. Check out If you dare hackers to hack you, they'll hack you good.