Gumtree scams: is it safe to give out your bank account details?
Updated June 6, 2018
Is it OK to give out BSB and bank account number for a deposit?
I asked myself this very question when I had listed some furniture for sale on Gumtree.
You would think my answer would have been a resounding "yes!"
After all, I've given my bank details to just about everyone and anyone who wanted money from me or owed me money and I've had no problems whatsoever.
But when I was asked for my bank account details by a potential buyer, I hesitated.
There's a reason Gumtree prefers all transactions to take place locally and in person - there are shady characters online.
Within half an hour of posting my son's bed I got a message from "Anita" asking if it was still available and, if so, could I contact her via email.
Warning bells rang immediately. Not only was this buyer quick to respond but she didn't even discuss the price, even though I said it was negotiable.
It was as if an alert had gone out that a new victim was online. Out of curiosity I emailed her. The rest played out like a typical scam.
She worked on an oil rig (New Zealand Oil & Gas) and was presently offshore so was unable to answer any phone calls.
A courier was to pick up the bed and she would deposit the cash into my bank account.
A quick search on her "employer's" website revealed this scam warning: "New Zealand Oil & Gas does not directly employ staff on offshore platforms. Do not trust online traders who ask you to transfer money because they are offshore."
Clearly, Anita wasn't interested in my son's bed. After a few more web searches, it appeared Anita's story was doing the rounds.
Eventually she would have said that she was having trouble with the courier, and could I spot her the pick-up fees?
She would pay for the bed and the fees once the courier confirmed the pick-up.
Whatever the ending that waited for me, the thought of giving her my bank account details concerned me.
Which leads me back to the question, is it safe to give out your bank account numbers? And is the New Payments Platform (NPP) making it safer for us to receive money?
"Giving your BSB and account number to a third-party to receive or send funds is generally safe, but you should only give out banking details to organisations or people who you know have a genuine need to know this information," says Peter Marshall, Mozo's product data manager.
Technically, if somebody has your account details, they could set up a direct debit and have their insurance or gym membership paid courtesy of your bank account.
Of course, this is fraud and how long it would go on for depends on how often you check your account. I suspect that after one or two withdrawals you would have picked it up but it is a possibility.
Some businesses are more cautious and verify that the nominated direct debit account is yours by asking for some kind of proof but whenever I've registered a direct debit no checks were involved.
"While unauthorised direct debits from accounts can and do occur, the possibility is relatively small given banks in Australia are generally required to verify signatures. Australian banks also have sophisticated fraud protection systems in place to catch suspicious transactions," says Marshall.
ING Direct says it is safe to give out your details but it recommends you monitor your account for unauthorised transactions.
According to ING's David Breen, "In the unlikely event that an unauthorised transaction takes place on an ING Direct account, the customer will not be liable for the unauthorised transaction, provided they have complied with the terms and conditions of the account."
Commonwealth Bank says that providing account details to a third party to receive or debit funds occurs daily and while this is OK it does advise that "any personal information, including banking details, should only be given if there is genuine need for a third party to know the details, ie, to receive funds or to set up a regular direct debit".
So what about the NPP?
"With the NPP comes PayID, which allows you to use your phone number or email address rather than a BSB or account number as a simpler form of identification when sending or receiving payments," says Mozo's Marshall.
"However, like your BSB and account number, your PayID can only be used to receive funds - it can never be used to take money from your account.
"Registering for a PayID is done within your usual mobile or internet banking and requires you to go through a number of identification and verification steps.
"So unless you forfeit your details to someone else, it will be difficult for them to create a PayID linked to their account using your personal details."
The platform also has a payee confirmation step, where you'll be shown the name of the person linked to the PayID you're about to pay. This is designed to reduce the risk of mistaken payments.
"Many Australian banks are working to ensure payments using NPP will be protected by their own fraud and security initiatives," says Marshall. "In fact, they had to prove that they were capable of detecting fraud in real time before gaining access to the NPP infrastructure.
"However, the onus is on consumers to keep a watchful eye out for scams and never give away their login passwords to anyone - even if the person is claiming to be from your bank."
So what, if any, are the risks? Some time ago, then Top Gear presenter Jeremy Clarkson revealed his bank details in a newspaper column to prove that nobody could use them to withdraw money from his accounts.
He was wrong. Someone set up a monthly direct debit from his bank account to a charity.
Apparently, this charity didn't require a signature to set up a direct debit but it would be a little harder to do it in Australia as signatures are generally required.
Putting this aside, though, unauthorised direct debits from accounts can and do occur.
If you're still concerned about giving out details, Mozo suggests opening an extra account (with no monthly fees) and keeping it separate from your main account.
By the way, I sold the bed to a lovely gentleman in Victoria. We did it the old-fashioned way - he sent me a cheque.
Ironically, it was he who suggested I could be a scammer. True. I could have banked his cheque and not delivered the bed but by this stage he knew who I was and figured I was good for my money.