When being scam-smart backfires: $6.40 coffee that changed everything

Picture this: you're standing in your local café, card in hand, ready to pay for your morning flat white. But when you tap to pay, that dreaded word flashes up on the terminal - 'DECLINED.' Your account's been blocked, and suddenly you're fumbling for cash while a queue builds behind you.

This embarrassing scenario happened to Melbourne content creator Chloe Ferrari, and it's becoming surprisingly common across Australia. The culprit? Being too good at spotting scams.

The scam awareness paradox

Australians lost $2 billion to scams in 2024, down 25.9 per cent from the previous year, which shows our collective wariness is paying off.

Text message scams alone generated almost 58,000 reports in the first half of 2024, making it perfectly reasonable to view any unexpected message from your bank with deep suspicion.

But here's the catch—banks genuinely do need to contact customers about updating their details. It's not a nice-to-have; it's required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, known as 'Know Your Customer' or KYC requirements.

Ferrari, who's been an ANZ customer since she was 13, ignored multiple text messages asking her to confirm her details through internet banking.

'I was getting multiple text messages from ANZ saying if you don't click this link and confirm your details, then all withdrawals from your account are gonna be blocked,' she explained in her viral social media post.

When the promised restriction date arrived, her card was indeed declined for a $6.40 coffee purchase. 'Yeah, my account is fully blocked. It actually was ANZ, they did just wanna confirm my details. But anyways it was ANZ, my fault.'

Why banks need your information (and why now)

KYC procedures help banks collect and verify customer identity, making them aware of unusual or suspicious activity and reducing the risk of money laundering or terrorism financing. But the requirements are expanding rapidly.

Changes kicking in at the start of the 2025/2026 financial year will require legal service providers, among others, to conduct KYC checks.

This broader regulatory push means more businesses than ever need to verify customer information.

The consequences of ignoring these requests are real. Commonwealth Bank warns that customers who don't confirm details may not be able to open new products and may have access to digital banking and accounts restricted, with at least 30 days notice given.

The good news: Banks are fighting back smarter

While scam losses remain significant, there's encouraging progress. Commonwealth Bank reported a 76 per cent drop in customer scam losses since peak and invested over $900 million in FY25 to protect customers.

CommBank's anti-scam initiatives saw customer scam losses halve compared to the previous financial year, with NameCheck technology preventing scam payments worth more than an estimated $40 million.

Banks are rolling out sophisticated new tools to help customers distinguish legitimate communications from scams.

CommBank has unveiled a Gen AI scam detection tool that lets customers test suspicious text messages, while other banks are implementing similar verification technologies.

How to tell the difference: Legitimate vs scam messages

The challenge is real—scammers have become exceptionally good at impersonating banks. Phishing scams, where criminals impersonate government agencies or financial institutions, saw losses jump from $4.6 million to $13.7 million in early 2025.

Legitimate bank messages typically direct you to log into your normal internet banking or app, where you'll see a notification about updating details.

Banks like CommBank show notifications directly in NetBank or their app, and once you've confirmed your details, access is restored immediately.

What to do if you're unsure

The golden rule remains simple: when in doubt, don't click any links in the message. Instead, independently log into your internet banking or call your bank using the number on your card or their official website.

If you're unsure if contact is legitimate, hang up or delete the message. Contact the organisation using details you have found yourself.

This approach protects you whether the message is legitimate or a scam.

The bigger picture: Why this matters for seniors

While older Australians aged 65 and over reported the highest total scam losses at $33.1 million, the irony is that this demographic's healthy scepticism of digital communications may actually be causing legitimate banking issues.

Remote access scams often deliberately target older Australians, making wariness entirely appropriate.

But legitimate KYC requests affect all age groups equally, creating a perfect storm where the most cautious customers may find themselves locked out of their accounts.

The solution isn't to become less cautious about scams—scammers remain sophisticated and highly motivated criminals, requiring continued vigilance. Instead, it's about developing better verification habits that protect against both scams and legitimate service disruptions.

Ferrari's experience, shared widely on social media, struck a chord because it highlighted this new reality of banking. Her quick resolution—simply calling ANZ and confirming her details—shows that while the initial inconvenience was real, fixing the issue was straightforward.