When Palmerston North man John (name changed) got his retirement lump payment after three decades of service in the NZ Defence Force, he used some of the money to pay off the mortgage on his family home.
"But I still had some leftover, just sitting in the bank earning next-to-no interest," he said.
John started hunting online for higher-return opportunities.
He thought he'd found one when he landed on what he thought was the website of Starlink - the company that is putting thousands of satellites into orbit to create a global broadband network.
It said Starlink was having an initial public offering (IPO).
With his search history now wiped, John is not sure what site he was drawn to. Starlink's actual site makes no mention of any plans for a public listing. The satellite outfit is a division of the privately-held SpaceX, owned by Elon Musk.
The maverick billionaire did float one of his other companies, Tesla, but has so far made no mention of publically listing SpaceX, or spinning off its Starlink arm, let alone filing for an IPO.
But that hasn't stopped companies buy Google search ads around terms related to a Starlink (or SpaceX IPO) and encouraging people to register their details.
But as John was later to discover, this is scam territory.
But that was still to come. In May, he landed on what he thought was the official site for a company called Eurostone, based in Switzerland, which was offering US$10,000 blocks of shares in a (of course non-existent) Starlink IPO.
John registered his interest, and received a phone call from what he say was a very articulate, assured-sounding Eurostone rep. They did not do a hard-sell, but did offer to send more information - which was very professional looking.
After looking up Eurostone, and finding search results that seemed kosher on a (genuine) financial advisory site in Belgium, he filled in forms, supplying copies of a utility bill and his passport for ID, then transferred funds from his Westpac NZ account to an account at the Commonwealth Bank of Australia nominated by "Eurostone", which said it had opened an office across the Tasman.
That was on May 26. A few days later, he was emailed a number of share certificates, but most were in other people's names.
John finally smelt a rat. He looked on the regulatory website again, but this time discovered that while there was a real company called Eurostone, formed in 1972, it was liquidated in 2017. The scammers ad co-opted its name, the better to gain a semblance of respectability in online searches.
Reversal of fortune?
John said he contacted the police, plus his bank, no later than June 2, but neither Westpac nor CBA (ASB's parent) was able to reverse the transaction.
The police were able to put John onto IDCare - a non-profit set up to provide free support the victims of identity theft across Australia and New Zealand. It MD is former Australian Crime Commission executive director David Lacey and its NZ office, opened last year, is headed by Neil Hallet - who held various operations, investigations and intelligence roles with the NZ Police before joining IDCare.
IDCare helped John take the key step of freezing his credit record - making it a lot harder for the scammers to use his personal details for further fraud. He also cancelled his passport.
Initial indications from Westpac and CBA are that the transaction cannot be reversed, but both say investigations continue.
Other scams along the same lines have seen money sent to a legitimate bank account, which a dupe or "money mule" is paid a small amount to set up. The mule then withdraws the money in cash via multiple ATM transactions, or wires it onto another account. offshore (detail have yet to emerge if this was the case with John's funds). While the mule can be easy to identify, they are at the bottom of the fraud foodchain, with little or no knowledge of what's above them.
Asked if the account that received John's money fit this profile, a CBA spokesperson said: "We responded to an initial request from Westpac NZ and have since been in contact to provide a further update. As this is a third-party bank account, for privacy reasons we are unable to disclose any further information."
While he's hoping the banks involved will step up, John is also kicking himself for being taken in.
"I have been deployed overseas to countries like East Timor, Afghanistan and Iraq, multiple times, so I should have known better. But these were different types of threats," he said.
"The money I used was the last of my superannuation, from leaving the military, and I intended it to be a long-term investment for my retirement. Boy was I wrong, and I still feel like a fool."
If you do want to buy shares online, work through a broker you know and trust.
And if you do get caught out, contact your bank as soon as possible to ask for a refund. While John's case is still a work in progress - with the banks involved definitely not raising his hopes - positive outcomes do happen. In February, a West Auckland couple recouped $21,000 they had transferred from their Westpac account to a fraudster's Kiwibank account (read more about that, and under-resourcing in the cyberfraud fight and the tangle of agencies involved here).
Westpac and CBA respond
A spokesman for Westpac said, "Westpac NZ takes all forms of financial crime very seriously, and we work closely with customers who have become involved in fraud and scams to help recover their money wherever possible.
"Mr .... authorised a payment to a third party on May 26, and contacted us eight days later with suspicions the third party was a scammer. We immediately contacted the alleged scammer's bank, and worked with them to try to reverse the payment, but we were advised on 30 June that the funds were unrecoverable. We notified Mr .... of the outcome the same day.
"Investment scams can be very hard to spot. We encourage customers to do thorough due diligence on any organisation before investing, and to contact their bank immediately if they believe they may be involved in a scam. The sooner we're made aware, the better chance we have of recovering the money."
A spokesman for CBA said, "The security of our customers' banking details remains a top priority for the Commonwealth Bank and we invest in state-of the-art fraud prevention and detection technology to detect unusual activity. We also work closely with law enforcement agencies and other banks to share information and mitigate threats to the Australian community.
"We are always very concerned when we are made of aware of scams affecting customers and despite the commitment and best efforts of regulators, law enforcement agencies and the banking industry, such scams sadly still occur and customers are tricked into sending money to scammers.
"Scams are an industry-wide issue and we undertake our absolute best endeavours to attempt to recover any money that has been sent to these scammers as soon as we are made aware of the payment. Customers should notify us immediately if they think they have been scammed."
CBA's tips for avoiding the type of scam that John fell victim to include:
Be suspicious of apps or websites:
• asking you to pay money in exchange for endorsing their company through "orders"
• claiming to increase your return on investment as a factor of the number of other people you introduce to an "investment" scheme
• sending you initial returns/money and then asking you to invest higher sums of money.
The bank also advises:
• Do your detailed due diligence before investing in any entity, and especially less known companies.
• Consult a trusted family member or friend as a sounding board before authorising a higher value "investment".
• Trust your gut before authorising a payment to invest – if the returns/investment scheme seem too good to be true, they probably are.
Where to get help if you've been scammed
• NZ Cert - www.cert.govt.nz
• IDCare - idcare.org
• Netsafe - netsafe.org.nz
• NZ Police -police.govt.nz/advice-services/cybercrime-and-internet