Australian mum and son discovered identity fraud after letters from bank arrived in the mail
Exclusive: If the letters didn't arrive in the mail, Anna* may have never known her identity had been stolen.
She was not a customer with Great Southern Bank, so she was surprised to find a brand new debit card in her name sitting in the letterbox.
"My son and I received ones on the same day," Anna, who wanted to remain anonymous, told Nine.com.au.
READ MORE: 'She didn't abandon her family': $1m reward in baffling case of missing teacher
Anna received a bank card and bank statement in the mail from Great Southern Bank. Supplied
Do you have a story? Contact reporter April Glover at april.glover@nine.com.au
"We both got a letter from this Great Southern Bank with Visa cards in them both."
All up, three fraudulent bank accounts had been created – one in Anna's name and two in her son's name.
They were mystified.
Fortunately, there was a paper trail.
Statements had also arrived through snail mail, one of which indicated that $200 had been transferred into an Everyday Edge account.
"That's the scary part. How far could it go?"
Ten days later, it was transferred to another account with UBank that appeared to be in her name.
"But it was under my name with a 'Mrs'," Anna said.
"I have never been a Mrs. In my life, there is not a piece of identification that exists with Mrs."
Meanwhile, her son's two accounts were an Everyday Edge account and a Home Saver Account.
Small amounts of money totalling just $10.60 had been transferred in and out of the everyday account.
Wary of scams and fraudsters, the Perth woman acted quickly to clear things up with Great Southern Bank.
EXCLUSIVE: Residents of seaside Victorian town braced for Macca's battle
The accounts were created using scanned passports which may have been stolen in a Gmail hack. Supplied
READ MORE: Neil wants pokies machines to play 'losing sounds'. Here's why
She filed a police report and then called up the bank and asked why she had received the bank statements despite not being a customer with them.
Anna said the bank representative told her the accounts had been created using a scan of their passports.
"The only form of ID that was provided to open the account was the passport photo," she said.
"That's the part that shocked me the most.
"With photos, not physical IDs, the thieves were able to open three bank accounts."
Flabbergasted that accounts were created so easily, Anna contacted the Australian Financial Complaints Authority (AFCA) to lodge a complaint.
While trying to obtain answers from the bank, Anna said she was told that "enough ID was used to open an account".
She was also unable to confirm if the account was opened via telephone, online or in person, or if it was someone interstate.
Following the ACFA complaint, Great Southern Bank closed the fraudulent accounts by August 28, 2025.
A letter sent to Anna confirming the closure of Anna's account stated it was created using an Australian passport.
Anna said opening a bank account should have required multiple forms of ID and stronger verification.
She is concerned that her and her son's lives could have been ruined by identity thieves if the letters had never arrived in the mail.
"That's the scary part. How far could it go?" she asked.
A letter sent to Anna confirming the bank account in her name was opened using a passport. Supplied
READ MORE: Matthew was slugged $2640 in 'confusing' water bill bungle
Great Southern Bank told Nine.com.au that the use of a passport ID to open an account is in-line with the rest of Australia's banking industry.
"We sympathise with the affected individual and her son. Our bank maintains rigorous anti-fraud measures, which are continuously reviewed and enhanced," a spokesperson said.
"Over the past 12 months, we have seen a significant reduction in scam activity as a result of our ongoing efforts."
Identity stolen in Gmail breach
The question of how Anna and her son's passport scans came to be in the hands of cyber criminals remains a mystery.
But she has her suspicions.
Anna believes her Gmail was hacked after a mass data breach saw 183 million passwords stolen in June last year.
Scans of her and her son's passports and IDs had been sitting in her Google Photos after needing them for various applications over the years.
"Where else would they have gotten our passports?" she said.
"I did a security test and it said my password had been compromised."
Google said it uses the "world's most secure cloud infrastructures" to protect the information on Google Photos.
But in the case of a data breach, this sensitive information can be easily accessible to thieves who have the right password.
Digital passport scans retail for an average of $32 on the dark web.
*Not her real name.
NEVER MISS A STORY: Get your breaking news and exclusive stories first by following us across all platforms.
- Download the 9NEWS App here via Apple and Google Play
- Make 9News your preferred source on Google by ticking this box here
- Sign up to our breaking newsletter here
Share a tip-off, video or photo with us
