A man accused of setting up a sham company used to steal $1.7 million from Australian scam victims has admitted deleting crucial messages and accused police of lying about messages they found on his phone.  

The stunning testimony was given by Hassan Mehdi during days of tense cross-examination in a civil lawsuit in the NSW Supreme Court.  

Mr Mehdi maintains his innocence but was pressed on whether he'd changed his story after the ABC broadcast new information, and whether he'd intentionally deleted messages, backdated documentation or withheld evidence of a bank account.  

He's a Melbourne-based Pakistani man who founded a business called Supercheap Security in 2021 and later created a bank account with NAB.

Scam victims, including Victorian woman Jo O'Brien, were collectively tricked into paying almost $1.7 million into the account.

They believed it was for a fixed-term investment and that they were paying it into a bank account in their own name, not Supercheap Security's — a company they had never heard of.

Instead, their money was shifted offshore and stolen.  

'I trusted my friend'

The victims are suing Mr Mehdi alleging Supercheap Security was a sham company and he either knew about the fraud or showed a wilful blindness to it.

The lawsuit alleges he played a vital role as a participant or as a director of the company even though he may not have known everything about how the scheme worked or all of the people involved.

He's accused of authorising fraudulent bank transfers or failing to stop them.  

"Mr Mehdi was the one who authorised all these transactions or he was only not that person because he chose not to be that person," legal counsel for the victims, Matthew Kalyk, told the court.  

Mr Mehdi was an unreliable witness who either lied or whose many inconsistencies meant his testimony couldn't be believed, according to Mr Kalyk.

Mr Mehdi, who represented himself, strongly denied the allegations.  

He blamed his former friend, Muhammad Ali Waheed, who took over the company.

The pair were close, having spent years living and working together.  

He said he believed Mr Waheed when he said he wanted a company to import products, do cryptocurrency and forex trading.  

Speaking through an Urdu interpreter, Mr Mehdi said, "I did trust my friend and I transferred the thing to him".

Mr Mehdi told the Judge, "If you don't trust me then you can punish me, what else can be done?"

He said he would declare bankruptcy if the court found he was liable to repay the victims.

The ABC interviewed his friend Mr Waheed in March.  

He wore a makeshift disguise and claimed to be living in the Middle East.

Mr Waheed admitted breaking the law and being paid to allow the stolen money to be laundered through Supercheap Security's account.

However, he denied knowing about the elaborate scam at the time.

In a follow up story in May, the ABC published text message exchanges between a victim and Mr Waheed where he bragged about being out of reach.

"Wherever I am, I am safe with no charges against me," he texted.

In a written court submission, Mr Mehdi reacted to those messages and fresh allegations Mr Waheed had recently visited Australia before returning to Dubai:  

"Mr Waheed is ridiculing the law enforcement authorities and courts of Australia for taking no action against him."  

'Bro can we use that NAB account?'

Under cross-examination Mr Mehdi, was pushed about whether he had changed his story regarding the company bank account.  

His application for the NAB business account was made in April 2022 and he told the bank it was for his security business, resulting in monthly transactions of up to $250,000 to Asia and the Middle East.

There was no mention of his friend Mr Waheed and their plans to change ownership or the type of business.

The court also heard that in an affidavit from last year Mr Mehdi made no mention of creating the bank account for Mr Waheed.  

On the stand he was asked if WhatsApp messages published by the ABC had resulted in him altering his story.

The messages allegedly between Mr Waheed and another man, Usman, begin in April 2022.  

They discuss the application for the company's bank account, photos of an NAB branch and login and password details.

Messages sent by Usman to Mr Waheed in early May, show him constantly pushing for fast access:

"Bro can we use that NAB account."

"For tomorrow"

"If we need otp (one time passcode) Your guy will give us?"

Mr Mehdi was pressed about what the messages meant.

"You knew from the time that you read that article that it was clear that this message... was the login details you forwarded on to Mr Ali Waheed, correct?" Mr Kalyk asked.  

"Yes," Mr Mehdi answered in English.    

"It could now be proven you actually applied for this bank account in collaboration with Mr Ali Waheed?"

"Yes, I've been saying this from the very start," Mr Mehdi responded.  

"He asked me to get the account."

Mr Mehdi then conceded it was the first time he'd admitted it.  

He then said he was keeping Mr Waheed informed about how the application was progressing and passed on all the details to him.

"No," Mr Mehdi responded.  

Arrested and charged

In November 2022, Mr Medhi was arrested by Victoria Police when attempting to leave the country and charged with eight counts of obtaining property by deception.  

The police questioned Mr Mehdi about multiple text messages they claim to have found on his phone, allegedly sent by NAB as confirmation of account transactions.  

Victoria Police later withdrew all charges against him on advice from the Commonwealth Director of Public Prosecutions and the Victorian Government Solicitor's Office.

But under cross examination, Mr Mehdi denied ever receiving them and demanded to see them.  

"Can you show me those?" Mr Mehdi asked.

"Well, where are they, Mr Mehdi?" Mr Kalyk said.  

"I don't know, you show me, police saw that, yeah? You show me," Mr Mehdi responded. 

"You say the police are lying are you when they say we also located multiple text messages from the bank saying a couple of transactions have been made from your account?" Mr Kalyk questioned.  

"Yeah," Mr Mehdi responded.  

"You say they're lying?" Mr Kalyk said.  

He then pulled out his mobile phone to show the court the only bank text messages he claimed to have received.  

Crucial messages deleted

After 33 days behind bars Mr Mehdi was released from custody.

When he was set free he deleted WhatsApp messages between him and Mr Waheed.  

When pushed about whether he had destroyed evidence of his involvement, Mr Mehdi denied that.  

He said he didn't understand the difference between criminal and civil proceedings and if he'd kept the messages they would have helped his case.  

Mr Mehdi told the court he received an email from NAB questioning an outgoing suspicious transaction for $94,000.

Mr Mehdi said he questioned Mr Waheed about it and he was told to ignore it.  

He said he then emailed the bank telling them to stop it but did not mention Mr Waheed's involvement.

Thousands of dollars sent to Pakistan

Mr Mehdi was also probed in detail about his own financial records, including for another company he owned.

He denied the substantial money flows were anything but legitimate, including him receiving cash deposits.  

One transaction showed Mr Waheed had paid him $800 describing it as a gift.

Mr Waheed also paid $4,000 towards Mr Mehdi's legal fees.

He also admitted to sending thousands of dollars for Mr Waheed to Pakistan via a foreign exchange broker before the fraud occurred.  

He denied their financial links were evidence of the pair working together or that he was paid to participate in the fraud.  

Mr Mehdi also admitted he hadn't provided all bank records. 

Failing to act on suspicions

Mr Medhi denied Supercheap Security was a sham company and said he created it to sell home security products online but only sold two or three items.

He said his plans changed after his mother died which meant he couldn't focus and agreed to hand over the business.

Facebook messages showed Mr Mehdi telling Mr Waheed the company would cost him $15,000 to $20,000 but he handed over Supercheap Security for free.  

However, the plaintiffs argued Mr Mehdi's explanation didn't make sense because he was well enough to run his other security business and there was nothing stopping his friend from registering his own company and bank account.

Mr Mehdi admitted there was no legitimate reason Mr Waheed had wanted a company and bank account in another person's name other than for fraud but said he didn't know that at the time.

He was accused by Mr Kalyk of deliberately failing to ask questions of Mr Waheed after seeing obvious signs of fraud because he didn't want to know the answer.

"No wrong," Mr Mehdi said.  

According to Mr Mehdi's version of events, his friend took over Supercheap Security in May 2022 — just before the bank account was used by scammers, therefore absolving him of involvement.

But the plaintiff's argued that was contradicted by Mr Mehdi's hand-written resignation from the company which was lodged with the corporate regulator, ASIC, three months later and after he was notified of the lawsuit over the stolen funds.

In response, Mr Mehdi said the paperwork was late because Mr Waheed had failed to lodge it.  

The plaintiffs also pointed to Mr Mehdi having booked a one-way trip to Pakistan just before the fraud began — but he said that was to maintain flexibility over his return date.  

They argued because Mr Waheed lives overseas, the company never effectively changed hands and Mr Mehdi should be forced to pay.  

The judge has reserved his decision on the case.