The money had left the account. On the website, it appeared to have arrived exactly where it belonged.
That is the detail that stands out in the allegations recounted in Solomon v Bendigo & Adelaide Bank Limited. Jean Solomon, 97, had entrusted her banking affairs to her son Nicholas. After researching term deposits, he dealt with people impersonating HSBC. On 16 April 2024, $6.2 million was transferred from Bendigo Bank to a Commonwealth Bank account.
The false banking website was then updated to show the money credited to the supposed term deposit. The scam was discovered on 30 April. About $500 was recovered.
The judgment, dated 22 October 2026, addresses document disclosure in Mrs Solomon's compensation claim. It presents that chronology as pleaded allegations, not findings after a trial. The court ordered answers about bank policies and further amendments, standing the disclosure application over to 12 November. It did not determine negligence or liability.
Banking Day's 27 October report and Banking Daily's 29 October coverage brought the case to wider attention. Beyond the unresolved legal dispute, it illustrates a use of fraudulent websites that deserves closer scrutiny: providing apparent reassurance after payment.
The screen could confirm whatever its operator wanted
A website showing an investment can feel like evidence that the transaction worked. There is a familiar sequence: complete the paperwork, transfer the funds, see the account updated. The final screen appears to close the loop.
But if the supposed investment provider controls that screen, its confirmation is another claim from the same source. It is no more independent than an email saying the money has arrived.
A criminal does not need to break into a bank to create this experience. A separate website can imitate its design and display invented records. A customer login, reference number, transaction history or changing balance can all be programmed without connecting to a genuine banking system. These are illustrative capabilities, not additional features established about the website in this case. The account described in the judgment does not establish that HSBC's infrastructure, or the family's devices and passwords, were compromised.
A real telephone number copied into the footer adds no proof of ownership. Nor does a link to a genuine financial document. ASIC's warning about imitation MoneySmart pages describes fraudulent sites using links to real pages to strengthen their appearance. A convincing email signature can perform the same supporting role.
The pieces look consistent because someone has made them consistent. That is different from several independent sources confirming the same thing.
Read the address before trusting the page
The browser's address deserves more attention than the logo beneath it. Obtain the institution's official website address through an established banking relationship or another independently verified source, then compare it with the address you have been given. Sponsored search results are not authoritative: MoneySmart describes fake comparison sites and advertising among the ways scammers find investors.
Suppose a fictional bank uses harbourbank.example. An address such as harbourbank.example.investment-desk.example belongs under investment-desk.example, not the bank's domain. The bank's name appears on the left as a subdomain, which the owner of the latter domain can create. Likewise, harbourbank-deposits.example is a different domain. These deliberately fictional addresses use the reserved .example ending.
Added words, hyphens, lookalike spelling or a changed ending warrant checking against the official address. Avoid a simple “last two words” rule: Australian addresses such as those ending in .com.au have a different structure. The task is to identify the registered domain and confirm its connection to the institution, rather than spot a familiar name somewhere in the address.
HTTPS answers a narrower question. It encrypts the connection to the site identified by the certificate; it does not establish that the operator is a bank. Chrome replaced its traditional padlock with a site-controls icon partly because people mistook connection security for trustworthiness.
Certificate details can add context. DigiCert explains the validation process and its three validation levels: Domain Validation (DV) checks control of the domain, without verifying an organisation's legal identity. Organisation Validation (OV) adds checks of that identity. Extended Validation (EV) involves more extensive checks of the organisation and the authority behind the request. These levels concern identity verification, not encryption strength: DV, OV and EV certificates can provide equivalent encryption; EV does not inherently make the encrypted connection stronger.
Where verified organisation details are present, compare them with the institution you expect. An unexplained mismatch warrants investigation, although a banking group's legal entity may differ from its public brand. A DV certificate normally supplies no verified organisation name, and not every legitimate banking site uses OV or EV. An absent name does not establish fraud; a genuine name does not authorise a particular investment offer. Certificate inspection provides an additional clue, not a final verdict.
Take the offer outside its own circle
For a proposed term deposit, the decisive enquiry concerns the offer, representative and destination of the money together.
Imagine receiving a proposal apparently from a major bank. Instead of calling the number in the document, reach the institution through an established banking contact, a previously trusted app or independently verified official details. Ask whether that specific offer exists, whether the named representative is authorised, and whether those payment instructions belong to the arrangement.
This gives the real institution an opportunity to contradict the proposal. Calling a number on the questionable website may only give the same operation another opportunity to confirm it.
ASIC's professional registers help establish financial-services licensing and authorisation. However, someone can copy a genuine licence number just as easily as a logo. MoneySmart's verification guidance addresses that impersonation risk. Finding the real business on a register is a starting point; the remaining work connects it to the person and transaction in front of you.
Give someone responsibility for the connection
In a family managing substantial assets, an accountant may review documents, a solicitor may arrange formal authority, a relative may choose an investment and an assistant may prepare payment. The amount of money does not make the family inherently more susceptible. It makes an unexamined assumption between those people potentially expensive.
A second approval helps when someone checks the recipient independently. Two people reading the same convincing proposal can inherit the same mistake. Agree who confirms the instructions through the institution and who approves payment, within the relevant authority arrangements.
Ask the paying bank what recipient checks are available for that payment method. A matching account name alone does not establish entitlement to receive money for the proposed investment. Changed instructions should trigger fresh verification. If the destination cannot be confirmed, pause the transfer.
Solway Web Consulting's private-client IT and cybersecurity support covers devices, email, accounts, recovery planning and documentation that can support these communication arrangements. Investment suitability and approval remain matters for the client and appropriately qualified advisers. Secure accounts, multifactor authentication and antivirus software cannot authenticate an offer displayed on someone else's website.
If payment has already occurred, Scamwatch advises contacting your bank immediately. Recovery is uncertain; subsequent promises to retrieve the money can themselves be scams.
The apparent confirmation after a transfer is an especially difficult moment to question the story. The screen looks like the end of the transaction. Its value depends on establishing, before payment, who is entitled to put that information there.
Tags: security, private-client, australia