Pay ID Scams

Have you received a seemingly random deposit into your bank account?
Well there’s yet another scam around this to watch out for.

PayID is a simple way to receive payments in Australia. Instead of sharing your BSB and account number, you can use something easier to remember, like your phone number, email address, or ABN, as your PayID. This makes it faster and easier for people to pay you.

The scenario typically starts with you receiving an amount of money typically $10 or greater, typically $50 or $100 and some form of notification detailing the sender.

At this point the scammer already has your account login information including your password!... but they can’t get any money as they cannot receive the 2FA that will be on your phone. Incidentally, if you see a 2FA message that you didn’t initiate it could be someone in your account!
​

​How the Scam Exploits PayID:

1. Scammer Obtains Your PayID: When the scammer logs into your compromised online banking, they can easily find your linked PayID (if you have one). This is often your phone number, which they likely already have if they're contacting you via text or call.
2. "Accidental" Transfer to Your PayID: The scammer initiates the small transfer using your PayID as the recipient identifier. This makes the transfer appear even more legitimate, as it's going to your known contact information.
3. Returning the Money via PayID: When you agree to send the money back, the scammer provides their own PayID (or a bank account number linked to their PayID). Because you're sending money to a PayID, the transaction is often processed instantly, adding to the sense of urgency the scammer creates.
4. PayID Becomes a Trusted Payee: Critically, by authorizing the return transfer to the scammer's PayID, you are essentially adding their PayID (and therefore their linked bank account) to your list of trusted payees. This bypasses 2FA for future transfers to that PayID.

Why PayID Makes This Scam Easier for Scammers:

• Simplicity and Speed: PayID makes it incredibly easy to send and receive money instantly, which works in the scammer's favor.
• Perceived Legitimacy: Because PayID is often linked to familiar information like a phone number, it can make the "accidental" transfer seem more believable.
• Direct Link to Bank Account: PayID is directly linked to a bank account, so once the scammer's PayID is authorized, they have direct access to transfer funds.

Protecting Yourself with PayID:

• Be extremely cautious of unexpected payments: If you receive money from someone you don't know, even a small amount, be very suspicious.
• Never send money back directly to someone who claims to have accidentally sent it to you: Always contact your bank directly to verify the situation and handle the return of funds.
• Regularly review your PayID settings and linked accounts: Make sure your PayID is secure and that you recognize all linked accounts.
• Enable transaction notifications: Set up notifications for all transactions, including small ones, so you can quickly identify any suspicious activity.

By understanding how PayID can be exploited in this type of scam, you can take steps to protect yourself and avoid becoming a victim.

Ep283

Image sourced by MITE Radio as a screenshot - feel free to share!