BNZ follows Aussie parent NAB and says it will no longer include hyperlinks in texts after high-profile frauds hit media

BNZ says it will stop using links in text messages sent to customers, after a spate of text scams targeting its customers.

Faked text messages purportedly from banks, or organisations like Waka Kotahi containing hyperlinks, are being used by criminals to induce people to give up their private information or log into their bank accounts, before money is taken.

Chief executive of the NZ Telecommunications Forum, Paul Brislen, has warned text messages should not be used for account verification or to send links as they are training customers “to do the wrong thing” and opening them up to criminal exploitation.

National Australia Bank, BNZ parent, announced it would stop using links in texts on June 7.

BNZ told Interest.co.nz a project was underway to stop using links in text messages sent to its customers in New Zealand.

The bank said in an emailed statement that it sent about 15 million texts to its customers each year, with the majority “system generated, typically triggered by specific customer activities, for example when a customer goes into overdraft”.

The bank said it was important to note it had never asked customers for their passwords, nor sent customers emails or text messages with a link asking them to log in.

Banks’ approach to fraud protection has been under a spotlight, with commentators claiming NZ is falling behind in protecting customers from increasingly sophisticated scams by failing to introduce new measures such as matching names and account numbers. The Banking Ombudsman chair Miriam Dean KC has called on all organisations involved in fraud protection to up their game, and suggested setting up a specialist anti-scam group similar to one running now in Singapore.

The toll of financial scams is rising; with the latest crime victim survey showing fraud and deception crimes are now the most common crime in the country, and reports that about 16 people had lost six-figures to scams in the first quarter of the year.

BNZ has been attached to a number of high-profile cases to hit the media where customers have been tricked into logging into their accounts from a faked text message.

The bank said it had a dedicated fraud protection team working 24-hours-a-day, 365-days-a-year to protect its customers. 

“We invest heavily in fraud protection technology and are always looking for new and innovative ways to combat scams. For example, we’ve been working with New Zealand’s three largest telcos to stop scammers based overseas from spoofing our 0800 number. To date, through this work we’ve been able to reduce the cases of BNZ’s number being spoofed by 50%.” 

The Department of Internal Affairs (DIA) annual report for 2021/22 showed it received more than 944,000 reports of email and text scam messages.

Complaints about text and email scams also rose year-on-year, with DIA receiving more than 1000 complaints in its 2021/22 annual report, compared with 394 for 2020/21.

DIA offers a text-scam reporting service, where people can forward a scam text to 7726. Mobile network operators get updates on scams reported through the 7726 text number as part of their scam-mitigation, and can then investigate and block mobile text numbers.