THE CONVERSATION
Disclaimer: This asset – including all text, audio and imagery – is provided by The Conversation. Reuters Connect has not verified or endorsed the material, which is being made available to professional media customers to facilitate the free flow of global news and information.
By Jongkil Jay Jeong, Senior Fellow, School of Computing and Information System, The University of Melbourne, Ashish Nanda, Research Fellow, Deakin Cyber Research and Innovation Centre, Deakin University, and Peter Thomas, Director, Centre for Future Skills and Workforce Transformation, RMIT University
It starts with a call from someone claiming to be your bank. They know your name. They know your bank. They even know your credit card number. There’s been “unusual activity” on your account, they say – and they just sent you a one-time passcode to verify your identity so they can assist.
You read out the code and feel reassured. Moments later, your funds are gone and the bank refuses reimbursement, citing a breach of terms because you voluntarily shared your passcode.
This is not a niche or isolated scam. It’s part of a growing pattern we’re seeing across Australia and beyond: cyber criminals are merging digital and real-world tactics in ways that make these frauds more convincing, harder to stop, and far more damaging.
It starts with stolen data
These scams don’t begin with a phishing email or fake app. They begin with data – your data – stolen in one of countless breaches, such as the latest Qantas incident that exposed the details of up to 5.7 million customers.
Sometimes the personal data has been sold through third-party data brokers. Names, phone numbers, emails, even card details are routinely leaked and traded online.
Once they have this information, scammers get to work. The phone call mimics a real interaction with a bank, perhaps with a spoofed caller ID. Victims are pressured in urgent language to “verify” their identity, often by reading out a one-time passcode that, unbeknownst to them, is authorizing a transaction using their own card details.
We refer to this as a “convergence scam” – where online data leaks, psychological manipulation and weak enforcement come together. It’s a sophisticated hybrid of digital theft and physical-world exploitation, and it’s on the rise.
Devastating and personal
These scams are deeply personal and can be financially devastating. But what makes them even more alarming is the system-wide failure surrounding them.
For starters, many credit card fraud insurance policies contain clauses that exclude coverage when the customer “voluntarily” provides account credentials – including one-time passcodes – even if they did so under duress or deception.
One victim we spoke to lost nearly A$6,000 after a scammer posing as their bank prompted them to read out a passcode over the phone. The transaction was verified using that code, and the bank later refused to reimburse the loss.
In a formal response, the bank stated that by voluntarily sharing the one-time passcode, the customer had breached the e-payments code, even though they were manipulated into doing so. As a result, the customer was held liable and ineligible for a chargeback.
Law enforcement may not help
Even when the criminals leave a physical trail, follow-up is rare. Law enforcement rarely investigates. In the cases we’ve seen, reports are acknowledged but not pursued. Officers don’t explicitly say the case is too small or not worth the effort, but their inaction suggests it, especially given how resource-intensive most cyber-crime investigations tend to be.
In many instances, particularly when the total loss isn’t deemed significant, victims are simply told to follow up with their bank, based on the assumption they’ll be reimbursed.
In one case we reviewed, stolen card details were used in-store at major Australian retailers such as Woolworths and Coles – indicating that a cloned card had been physically used. These purchases could, in theory, be tracked back to in-store CCTV footage. But no investigation was launched.
This reluctance to act, even when the evidence is tangible, sends a dangerous message: that scammers can operate with near-impunity.
Meanwhile, banks and regulators are slow to update verification systems. One-time passcodes are still widely used, even though scammers now exploit them routinely. There’s little recourse for victims, and minimal accountability for data brokers whose records fuel these scams.
What can we do to protect ourselves?
For individuals, the first line of defense is simple but vital:
- never share a one-time passcode or security code over the phone, even if the caller seems legitimate
- if in doubt, hang up and call the bank directly using the number on your card
- be cautious about where and how you share your personal information, especially online through websites or social media. Only disclose what personally identifiable information you have to.
The true answer is systemic change
Banks and other institutions need to put into place stronger identity verification systems that don’t rely solely on SMS codes. We need greater transparency and regulation of data brokers.
Crucially, we also need active enforcement of cyber-enabled fraud, especially when there’s physical evidence, such as in-store purchases and CCTV footage.
Banks should also reassess their policies and procedures on how they communicate with customers. If scam calls closely mimic real ones, it’s time to change the script. More proactive education, clearer warnings, and redesigned verification processes can all help prevent harm.
The real danger of these convergence scams isn’t just financial loss. It’s the erosion of trust: in our banks, in our security systems, and in the institutions meant to protect us. – Reuters
Julia Andrea Abad, executive director of the FEU Public Policy Center, moderated a dynamic panel discussion with Mariana Zobel de Ayala of Ayala Land, Robina Gokongwei-Pe of Robinsons Retail, Col. Francel Margareth Padilla of the Armed Forces of the Philippines, and Political Science Professor Dr. Jean Franco of UP Diliman. Together, they explored the lived realities of women in leadership, the role of mentorship, and how institutions can evolve to foster greater diversity at the top.
A key moment in the forum was the research presentation delivered by Patricia Thea Basilio, data analyst at the FEU Public Policy Center. Drawing from their 2024 College Experience Survey, Basilio shared findings on gender attitudes among Filipino college students. The study revealed that sexist views remain prevalent among young people, especially males, and are often linked to higher interest in leadership roles. These raise important concerns for the country’s future leadership landscape.
Representing FEU’s senior leadership at the event was Gianna Montinola, consultant for external affairs, who introduced keynote speaker Mariana Zobel de Ayala. Ms. Montinola’s involvement highlighted FEU’s broader institutional advocacy for diversity, equity, and inclusion across sectors.
Bringing the lone academic research voice to the table, FEU contributed a unique perspective that blended empirical insights with practical recommendations for cultivating inclusive leadership in a changing world. The event closed with a call to continue building networks that support women not only in reaching leadership roles, but in thriving within them.
