Commonwealth Bank reports itself to police over possible $1 billion mortgage fraud scheme

Commonwealth Bank has reported itself to police over $1 billion worth of possible mortgage fraud, claiming there’s been a spike in dodgy applications with some documents believed to be made with artificial intelligence.

If proven, it will be the largest fraud case against one of Australia’s major banks.

WATCH THE VIDEO ABOVE: Commonwealth Bank reports major mortgage fraud scheme.

Cybersecurity expert Luke Irwin says hacking groups have been using data stolen from previous major breaches to create fake identities and fraudulent loan applications.

“The hacking groups would have collected and collated the data that’s come out of the other previous data breaches that we’ve had over the last few years, being Optus, Medibank, Latitude, Qantas, and all the others of that sort of size and scale,” Irwin, from Aegis Cybersecurity, said.

“They’ll then use that, run it through various AI tools to create a document, be it a pay slip, rates notice, a bank notice, to make it look exactly like the real thing.”

The cybersecurity expert says the stolen data includes names, addresses, phone numbers and dates of birth - all the information necessary to create convincing fake identities.

This isn’t the first time a major Australian bank has been targeted. NAB was allegedly defrauded by a syndicate last year for $150 million.

Irwin says the incidents point to wider issues with lending processes and risk management within the banking sector.

“There is a constant pressure in these organisations to shorten the time between action and decision,” he said.

“Every time there’s that pressure, the cybersecurity governance processes around that tend to get shortened or clipped or pruned because it’s slowing the business down.”

He says banks need to implement stronger verification processes, including contacting employers directly to confirm payslips are genuine and verifying that applicants are who they claim to be.

“The problem is that these attacks and these fraudulent documents these hackers are creating are picture perfect,” Irwin warned.

“You need to actually go and check with their employer to make sure they are who they say they are and what they’re being paid is what they claim.”

Irwin emphasised that while banks are increasingly using artificial intelligence within their businesses, criminals are unfortunately doing the same, making early detection and staff training crucial in staying ahead of fraud.