{"id":515916,"date":"2026-03-03T11:59:08","date_gmt":"2026-03-03T11:59:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/515916\/"},"modified":"2026-03-03T11:59:08","modified_gmt":"2026-03-03T11:59:08","slug":"ai-heist-cba-calls-police-over-1b-loan-fraud-information-age","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/515916\/","title":{"rendered":"AI heist: CBA calls police over $1b loan fraud | Information Age"},"content":{"rendered":"<p>The Commonwealth Bank of Australia (CBA) has alerted authorities to a possible fraud racket that obtained approximately $1 billion in illegitimate home loans, including through the use of artificial intelligence.<\/p>\n<p>In what could be the largest fraud case against Australia\u2019s biggest bank, CBA is reviewing how many suspicious loans were fraudulently obtained.<\/p>\n<p>The bank reported itself to police and the corporate watchdog after two whistleblowers last year lodged complaints via CBA\u2019s fraud-reporting platform \u2018<a href=\"https:\/\/www.commbank.com.au\/about-us\/opportunity-initiatives\/policies-and-practices\/speaking-up.html\" rel=\"nofollow noopener\" target=\"_blank\">SpeakUp<\/a>\u2019, as reported by the <a href=\"https:\/\/www.afr.com\/companies\/financial-services\/cba-probes-1b-in-suspected-fraudulent-home-loans-calls-in-police-20260223-p5o4mc\" rel=\"nofollow noopener\" target=\"_blank\">Australian Financial Review<\/a> (AFR).<\/p>\n<p>These complaints accused a mortgage broker and a lender in CBA\u2019s private banking division of forging income statements.<\/p>\n<p>One of the whistleblowers reportedly suggested the pair \u201cengaged in document forgery in order to secure home lending approvals\u201d.<\/p>\n<p>Neither the bank or authorities have publicly disclosed how AI may have been used in the suspected fraud racket.<\/p>\n<p>Following an internal review of its compliance practices, CBA called in authorities to determine which loans involved shell companies or were based on fraudulent documents and suspicious deposits.<\/p>\n<p>A spokesperson for NSW Police told Information Age the State Crime Command\u2019s Financial Crimes Squad intends to \u201cmeet representatives from the CBA\u201d sometime this week.<\/p>\n<p>The Australian Securities and Investments Commission (ASIC) declined to comment.<\/p>\n<p>NAB fraud spurs CBA to action<\/p>\n<p>Though CBA was reviewing its loan book as early as July last year, it intensified efforts after news of an alleged $150 million fraud against National Australia Bank (NAB).<\/p>\n<p>Members of the syndicate \u2013 including lenders, brokers and realtors \u2013 allegedly used insider knowledge to acquire loans for luxury properties and other purposes.<\/p>\n<p>The operation, dubbed the Penthouse Syndicate, was allegedly headed by former CBA and NAB banker Andrew Hu.<\/p>\n<p>Though CBA\u2019s first whistleblower reportedly reached out in February 2025, the AFR reported that NSW Police were informed of issues within CBA\u2019s loan book sometime between October and November.<\/p>\n<p>The bank has since updated its loan referral program \u2013 which historically offered commissions to real estate agents and other partners in exchange for customer leads \u2013 to no longer accept referrals from clients who have not already held a loan with the bank for at least six months.<\/p>\n<p>Westpac, ANZ report fraud to police<\/p>\n<p>Though CBA\u2019s latest loan scandal has not been publicly linked to the Penthouse Syndicate, an investigation of the syndicate has reportedly expanded to include the other remaining big banks Westpac and ANZ.<\/p>\n<p>As of Friday, the two banks were reportedly confirmed to have contacted NSW Police over possible <a href=\"https:\/\/www.afr.com\/companies\/financial-services\/big-four-banks-find-themselves-embroiled-in-loan-fraud-probe-20260226-p5o5r8\" rel=\"nofollow noopener\" target=\"_blank\">loan-related fraud<\/a>.<\/p>\n<p>Since the initial $150 million fraud was allegedly identified at NAB, sources have told the AFR that suspected fraud loans linked to Penthouse Syndicate investigations were expected to exceed $300 million.<\/p>\n<p>ANZ, NAB and Westpac were contacted for comment, but did not respond prior to publication.<\/p>\n<p>New tech, same playbook<\/p>\n<p>Speaking with Information Age, Jamieson O&#8217;Reilly, white hat hacker and founder of information security company Dvuln, said although CBA\u2019s case could likely mark \u201cthe first at this scale where AI-generated documentation appears to have been a primary mechanism\u201d, the potential use of AI wasn\u2019t what stood out.<\/p>\n<p>O\u2019Reilly explained that through his former connections with people who had experience hacking banks and ATMs, he found banks were often exposed thanks to insiders.<\/p>\n<p>\u201cThat was over 15 years ago \u2013 the tools have changed beyond recognition, and the AI being used to generate fake documents today would have been science fiction back then,\u201d O\u2019Reilly said.<\/p>\n<p>\u201cBut the playbook \u2013 and reliance on someone inside with just enough knowledge and just enough deniability \u2013 I don\u2019t think that part has changed at all.<\/p>\n<p>\u201cTechnology doesn&#8217;t defeat institutional trust, it just makes exploiting it faster and harder to trace.\u201d<\/p>\n<p>Indeed, O\u2019Reilly estimated CBA\u2019s potential fraud showed signs of a \u201cwell-oiled local criminal syndicate with strong internal connections\u201d.<\/p>\n<p>\u201cI think, just like with past exploits such as the Penthouse Syndicate, people who know the system and the people inside it may have built an operation disciplined enough to sustain this kind of exposure without tripping early detection.\u201d<\/p>\n<p>He emphasised that investigations are ongoing and the full attack surface of the potential fraud is not known, but there are a number of proven methods banks can take to spot potential AI-generated document fraud \u2013 including linguistic and pattern analysis.<\/p>\n<p>\u201cSentence structure uniformity, statistical regularities in word choice, formatting consistency that&#8217;s slightly too clean \u2013 AI output has fingerprints even when metadata isn\u2019t available,\u201d he said.<\/p>\n<p>\u201cWhat I&#8217;d be doing at a bank&#8217;s scale is running that kind of analysis across a data lake of customer-submitted documents, and looking for hotspots and concentrations of likely AI-generated content across the broker and referral channel.\u201d<\/p>\n<p>CBA did not respond to requests for comment, though Information Age understands the bank expects to recover a significant portion of the suspected fraud.<\/p>\n<p>Financial regulator weighs in on AI fraud<\/p>\n<p>Brendan Thomas, chief executive for financial crimes regulator AUSTRAC, told Information Age \u201cthe rise of AI creates both risks and opportunities\u201d.<\/p>\n<p>\u201cWhile businesses can use it to strengthen their anti-money laundering programs, particularly as part of their transaction monitoring programs, criminals are also using AI to facilitate fraud and scams,\u201d he said.<\/p>\n<p>Thomas urged regulated businesses to regularly review their systems &#8220;to make sure they are robust and create a hostile environment for criminal activity, so they can ward off existing, new and emerging threats.&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"The Commonwealth Bank of Australia (CBA) has alerted authorities to a possible fraud racket that obtained approximately $1&hellip;\n","protected":false},"author":2,"featured_media":515917,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[256,254,255,64,63,105],"class_list":["post-515916","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/515916","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=515916"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/515916\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/515917"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=515916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=515916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=515916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}