NZ Bank-Impersonation Caller-ID Spoofing Scam: $30,000 Banking Ombudsman Case

What happened

A New Zealand bank customer received a phone call from a man claiming to work for her bank's fraud team, who said he had identified unusual transactions on her account. The call displayed a caller ID matching the bank's genuine, published phone number; the number had been spoofed. He told her she would receive codes to suspend her internet banking and cancel the suspicious payments, and instructed her to read the codes back to him; she complied because the number appeared legitimate. She grew suspicious only when he then said she needed to move her money to a "safe account," at which point she hung up and called the bank directly, learning it had been a scam. By then the scammer had already executed a $30,000 transaction on her credit card account (used to purchase goods at an Auckland merchant, picked up roughly 15 minutes before the customer called the merchant) and had attempted a second, large payment that the bank's fraud-detection system blocked. The bank initially refused full reimbursement, arguing she had breached its terms of service by sharing the codes, and offered only half the loss. The Banking Ombudsman Scheme (case note 87834, published December 2024) found she had acted reasonably and recommended full reimbursement plus compensation for handling delays. RNZ reported the decision on 12 January 2025.

How it worked

The scammer called the bank customer using a spoofed caller ID that displayed the bank's genuine published phone number, so it matched the number on the bank's own website when she checked it. He claimed to be a bank fraud-team staff member who had spotted unusual transactions, and said he would suspend her internet banking and cancel the suspicious payments, actions for which she would receive verification codes that she needed to read back to him. The codes were, in reality, one-time authorization/2FA codes; reading them out let the scammer approve fraudulent actions on her account. He "skilfully mimicked" genuine bank call-centre procedure throughout. She only became suspicious when he then told her she needed to move her money into a "safe account" (a safe-account scam warning sign), at which point she hung up and called the bank directly, discovering the fraud. By then the scammer had already used the credit card account to make a $30,000 purchase at an Auckland merchant and had attempted a second, large payment that the bank's automated fraud detection blocked.

The lure and the tell

The lure: a call that displayed the bank's real, publicly listed phone number (via caller-ID spoofing), combined with a script that closely mirrored genuine bank fraud-team language: flagging "unusual transactions" and framing the codes as necessary to suspend banking and cancel payments, which was "sufficiently close to their true purpose to trick a reasonable person" per the Ombudsman. The tell: the pivot to asking her to move money into a "safe account," a request no legitimate bank fraud team makes, which triggered her suspicion and prompted her to hang up and call the bank independently.

Outcome

The scammer completed a $30,000 unauthorized transaction on the victim's credit card account (used to buy goods at an Auckland merchant, collected roughly 15 minutes before she called the merchant) and attempted a second, large payment that the bank's security system blocked. The victim reported the fraud immediately, but the merchant would not return funds since the goods were already released. The bank initially denied full reimbursement, citing a terms-of-service clause against sharing verification codes, and offered only 50% ($15,000). The customer escalated to the Banking Ombudsman Scheme (case note 87834, published December 2024), which found she had acted reasonably: noting the number was convincingly spoofed, the scam script closely mimicked real bank procedure, the bank's own SMS codes carried no anti-sharing warning, and the bank itself had separately asked her husband to read out a 2FA code, undermining its own rule. The Ombudsman also faulted the bank's fraud-response handling. It recommended reimbursement of NZD 30,000 along with NZD 1,000 already offered for delays. The case note does not say these amounts were paid. Banking Ombudsman Nicola Sladden described it as a sophisticated bank impersonation case and noted bank-impersonation scams made up almost a quarter of all fraud/scam cases the Scheme received that financial year. RNZ reported the recommendation on January 12, 2025.

Why it matters

The Ombudsman found that this customer acted reasonably in the circumstances, including the convincingly spoofed caller ID, the code messages' lack of warnings, and the bank's own practice of asking her husband to read a code aloud. This is a case-specific reimbursement recommendation, not a court ruling or a universal promise of compensation.

Current Ombudsman guidance distinguishes unauthorized payments from payments made with a customer's knowledge and consent. Additional Code commitments for eligible authorized payments began on November 30, 2025; they do not by themselves invalidate this earlier unauthorized-payment analysis. Callback/TOAD terminology in the existing taxonomy remains subject to review: the malicious call was incoming, while the customer's later genuine callback exposed the fraud.

Defenses

Defensive lessons from the Ombudsman's recommendation include: (1) SMS/OTP messages that explicitly warn customers never to share the code, since the bank's messages carried no such warning; (2) consistency in bank practice, since staff themselves had asked the customer's husband to read out a 2FA code during account setup, undermining the "never share codes" T&C the bank tried to enforce against the victim; (3) faster, more coordinated fraud-report handling, since the Ombudsman found the bank's own delays may have let the loss happen; (4) broader telecom/bank work (flagged in CERT NZ's Q2 2022 report) to block caller-ID spoofing of bank numbers. For consumers, the case underscores that a matching caller ID is not proof of authenticity when numbers can be spoofed, and that a legitimate-sounding request to read out a "cancellation" or "suspension" code is functionally identical to handing over the code that authorizes a fraudulent transaction.