Auckland Resident Recovers $19,300 After Sophisticated SIM Swapping Fraud

Auckland resident Jade Wang lost $19,300 from his ANZ bank account following a sophisticated SIM swapping attack on April 24, 2026. The incident, which saw fraudsters hijack his mobile phone number to bypass security protocols, has highlighted significant vulnerabilities in traditional identity verification methods used by telecommunications providers and financial institutions. While the funds were eventually recovered, the case serves as a stark reminder of the evolving tactics employed by cybercriminals targeting New Zealanders.

The fraud began when scammers successfully initiated an unauthorised SIM swap on Jade Wang's mobile account. He was a customer of Kogan Mobile, a provider that operates using the One NZ network infrastructure. By taking control of the victim's mobile number, the attackers were able to intercept sensitive communication intended for the legitimate account holder. This control is a critical component of SIM swapping, as it allows perpetrators to receive the short-message service (SMS) codes often used for two-factor authentication and identity verification.

On the afternoon of April 24, 2026, the sequence of events unfolded rapidly. One NZ sent an automated text message alert to the victim's handset, notifying him that a SIM swap request had been received. Recognising the activity as unauthorised, the resident immediately attempted to contact the telecommunications provider to halt the process. However, the call was disconnected before he could speak with a representative. He did not receive a return call, and by approximately 5 PM, his mobile phone lost all service as the scammers successfully transferred his number to a SIM card in their possession.

Financial Impact and Bank Intervention

With control of the mobile number established, the fraudsters moved to target his financial assets. They accessed the ANZ internet banking platform and initiated a password reset. Because the bank's security system sent the necessary verification code to the hijacked mobile number, the scammers were able to bypass the standard login requirements. Once inside the account, they performed two separate transactions that resulted in the theft of $19,300. A third attempted payment, which would have brought the total loss closer to the $20,000 mark, was flagged by the bank's internal fraud detection systems.

Upon identifying suspicious activity, ANZ suspended the victim's internet banking access to prevent further unauthorised withdrawals. The bank then began an investigation into the fraudulent transactions. Following these efforts, ANZ successfully recovered the full amount of $19,300 and returned the funds to the victim on May 6, 2026. The recovery of the stolen money concludes a stressful period for the Auckland resident, but the incident has prompted a wider discussion regarding the security responsibilities of service providers.

Industry Response and Security Measures

In response to the breach, One NZ has implemented a mandatory 15-minute delay on all SIM swap requests. This window is designed to provide customers with a critical period of advance warning, allowing them to contact the provider and stop unauthorised activity before the transfer is completed. The organisation has also confirmed that it has informed the Office of the Privacy Commissioner about the incident, reflecting the serious nature of the personal data compromise involved in SIM swapping.