A few fake emails were sent, then tens of thousands of dollars vanished.
That was Meng Wong's experience of falling victim to a scam on the rise in Australia; false billing.
Following his client sending $80,000 to a scammer, Mr Wong wants change and more security from Australia's banks.
"I love this country, I’ve lived here for 30 years, but our banking system is a joke," Mr Wong told 7.30.
"How can scammers so easily trick our banks and steal tens of thousands of dollars?"
Mr Wong is an inbound tour operator who organises holidays for overseas clients.
He remembers the frantic moments when his client realised they had sent the funds to a scammer instead of his travel company.
"I sent them the final itinerary ... and I asked them to make the final payment," Mr Wong said.
"As the group was about to come, I looked at the [invoice] again and I saw that they had sent it to a different bank and a different bank account number."
Mr Wong and his client had unknowingly been emailing the scammer, who had created fake emails to impersonate them both by changing just a few characters.
Fake invoice, fake name, no questions
The scammer sent an invoice to the client but changed the bank and account number of Mr Wong's company to one from Suncorp.
They kept Mr Wong's business account name on the invoice to make it appear legitimate, and the payment went through.
No account exists at Suncorp with that account name, and Mr Wong does not have an account with that bank.
"Money can actually go into a bank account whereby the account name and the account number absolutely do not match," Mr Wong said.
"The system basically allows the money to go in, and the money to go out unabated and without any questions asked."
Suncorp Bank declined an interview with 7.30, but in a statement said it restricted accounts when notified of any fraudulent activity.
"Unfortunately, in some cases, funds are transferred out of the Suncorp Bank account prior to concerns being reported to us," a spokesperson said.
Correspondence from National Australia Bank to Mr Wong's company, which has been sighted by 7.30, said because the money had been transferred to a Suncorp account it could not do anything.
They added it was unlikely the Australian Financial Complaints Authority could either, while apologising for what NAB called an "inconvenience".
Mr Wong has been left with no way of getting his money back, and he fears the scammers may strike again at any time.
Change is coming
Australia's banks, including Suncorp, have made a commitment to implement a suite of measures to combat cyber criminals in a Scam-Safe Accord.
One of the measures is to cross-check account names, which has had positive results in other countries.
In a statement, the Australian Banking Association said the Scam-Safe Accord "sets an even higher standard of protection by banks to shield consumers from scammers".
"Implementing an industry-wide confirmation of payee system requires a significant build and investment. Australia will be one of the first countries in the world to roll this out," the statement read.
The accord measures are expected to roll out across 2024 and 2025.
The Australian Competition and Consumer Commission (ACCC) says the voluntary measures will help combat fraudsters, but things need to go one step further.
Deputy chair Catriona Lowe said there needed to be anti-scam regulation enforced across industries — including banks, telecommunications companies and online platforms — to hold them accountable.
"There is a really important role to play for mandatory enforceable codes," Ms Lowe told 7.30.
"The codes should set a high bar for the initiatives that industry needs to be putting in place, and where that high bar is not met … we think there is a case for consumers to be compensated."
Independent fraud analyst Brett Warfield said cross-checking bank account names had worked overseas.
"The Dutch have done it, they did it back in 2017, and by implementing that they had a reduction of 81 per cent of fraud and scams," he said.
"The UK did it in 2020 and they had a 35 per cent reduction the following year in fraud and scams, so it works."
Not such a hotspot
Mr Warfield said falling into a scammer's sights could begin with something as simple as connecting to public wi-fi, where cyber criminals could spy on your activity and get a hold of your email and passwords.
"Don't do any personal banking, don't do any banking on behalf of your organisation — be very careful about what you access when you're at that wi-fi hotspot," he said.
The amount of money Australians reportedly lost to scams declined last year, according to the ACCC's latest Targeting Scams report. However, losses to false billing scams in particular are still growing.
In one example of a false billing scam provided by the ACCC, a couple sent more than $800,000 to a scammer while trying to pay for their new home.
The victims had received an email from their lawyer's address prompting them to transfer the money, but the bank details belonged to the scammer, who had intercepted the emails.
Ms Lowe said that was not a surprise and Australians needed to be on high alert when it came to larger transactions.
"Scammers like to maximise their return on investment, so we do see them targeting high-value transactions," she said.
"That's things like real estate purchase, solicitor transactions, but increasingly more recently, travel and motor vehicle, and other high-value purchases."
Watch 7.30, Mondays to Thursdays 7:30pm on ABC iview and ABC TV