Scammers have stolen about $375,000 intended to fund the aged care costs of a 102 year old woman, the money being the proceeds from the sale of her Ferndale home.
The woman's grand-daughter, who has enduring power of attorney, was organising the transfer of the funds from the home sale to the aged care home through a settlement agent when she became the victim of a payment redirection or 'man in the middle' scam.
The scammers intercepted email communications between the grand-daughter and the aged care facility and sent a bogus email on 14 January 2021 purporting to be the nursing home advising of a change of bank account details for the transfer. The grand-daughter sent these bank account details along with instructions to the settlement agent.
When settlement on the Ferndale property occurred on 29 January 2021, the proceeds of $374,251 were transferred to the scammers' bank account in Sydney. The grand-daughter also sent a top-up payment of $749 which was later retrieved, but so far not the larger amount. NSW and WA Police are investigating.
The 102 year old woman was being cared for by her family until September 2020 when she moved into the aged care home, but the scam loss has put the funding of her ongoing care into doubt.
In 2020, 39 people reported total losses of about $753,000 to payment redirection scams in WA. So far this year 16 victims have already lost $450,000.
Commissioner for Consumer Protection Lanie Chopping is concerned at the increasing cases of redirection scams, many of which are targeting large property transactions.
"These scams involve the hacking into someone's email account or computer system but it can be difficult to determine exactly where the hack has occurred," Ms Chopping said.
"The hackers may have successfully guessed the password or installed spyware or malware on computers or laptops after recipients open attachments or click on links in scam emails.
"Choosing a difficult to guess password and changing them often can reduce the risk of being hacked, and not opening attachments or links in suspicious emails is essential in keeping computers secured. Businesses should train their staff to be scam aware.
"We suspect another exposure may be the use of unsecured WiFi connections either at home or in public places which may provide scammers with a window of opportunity to break in. Especially with many people working from home at the moment, they need to ensure that a secured network is being used and they have up to date virus protection software.
"Businesses need to regularly review their cyber security as well as office practices and procedures to minimise the risk of them or their clients being susceptible to hacking scams and any attempts are detected quickly before transfers are made and money is lost."
Other recent reports of payment redirection scams targeting WA consumers include:
- November 2020: A woman purchasing a new motor vehicle online paid a fake invoice amounting to $74,000 that she believed came from the car seller.
- December 2020: A Thornlie couple who were first home buyers lost $133,000 while purchasing a Piara Waters home after scammers cloned the email address of the settlement agent. Dream of home ownership shattered after $133,000 scam theft
- January 2021: A home buyer lost a $5,000 deposit when scammers cloned the real estate agent's email address, requesting the money be paid into a different bank account.
- January 2021: A car seller lost $5,000 when scammers hacked into his email account and sent a fake message to the car yard with different bank account details for transferring proceeds from a trade-in.
- February 2021: Scammers intercepted a $20,000 deposit to a real estate agent for a commercial property in Burswood, but the buyer got the money back from his bank.
- March 2021: A property buyer lost $10,000 when scammers impersonated the settlement agent's email and re-directed the money transfer, being a deposit for the purchase of a home in Kardinya.
Tips to protect against payment redirection scams:
- Verify the sender of emails requesting payments or changing bank account details by checking that the email address is genuine;
- Call the sender to confirm the authenticity of the request and the account details, using previously known contact numbers or independently find out with an internet search or go to their website for contact information;
