Staying safe: we use secure messages, not e-mail

Scammers impersonate banks because it works. The single most useful thing we can tell you is how we actually communicate, so that anything else stands out: Charity Bank Australia does not send account details by e-mail, and no one at this bank will ever ask you for your passphrase, your one-time code or your device authentication.

Every conversation about your account happens in secure messages inside online banking. You sign in the way you always do and the message is there. We may send a plain notification saying a message is waiting, but that notification will never contain account numbers, balances, or a link that asks you to sign in — and we will never phone to ask you to move money to a safe account, because no such thing exists.

Before a payment leaves your account, Confirmation of Payee tells you the account name registered against the BSB and account number you entered. If the name does not match the organisation you believe you are paying, stop. A mismatch on an invoice is the most common sign that someone has intercepted the e-mail it came in.

New payees are held for sixty minutes before the first payment to them can be made. It is a deliberate piece of friction. Almost every scam that succeeds depends on pressure and speed, and an hour is long enough for the urgency to look like what it is — time to call the supplier back on a number you already had, not the one in the message.

If you think you have been targeted, report it to us in a secure message and report the scam to Scamwatch, which is run by the National Anti-Scam Centre. If money has already gone, tell us immediately: the sooner we know, the better the chance of recalling the payment.

For organisations, the same discipline applies internally. Two people approving every payment, bank details verified by voice with a known contact rather than by e-mail, and a standing rule that a change of bank details is always confirmed before it is acted on, will stop most of what comes at you.