- [Upbeat Music]

- I'm Sanjay and I'm a qualified electrician. I've been in the trade since I was 17, and five years now running my own business. I work mainly in the South East suburbs of Brisbane. So it's probably about eight months ago, I got an email inquiry for a quote on some renovations for a house in Springwood. The guy, Eric, was working on an oil rig off the coast of WA, and said straight up, he could only be contacted via email due to no phones on the rig. Seemed like a legit reason to me. He had bought a new house and was planning to move over in a few weeks and wanted to start arranging to reno the place before he had arrived. He was happy to go ahead and even paid a $500 deposit on the same day. The first thing that came up was some problem with his removal company. They were bringing his stuff over from Perth, but didn't have a card machine, and Eric said he's been having some issues transferring from his account. So he asked if I could purchase a removalist fee and just send it to them via bank transfer which I thought was strange. But you know, it seemed harmless. Anyway, it didn't take long for him to ask for more favours. The real estate agent needed back pay for rent. The removalist charged the wrong fee, please pay them some more. The carpet guy needed to be paid... I was just processing the payment and sending the money to the account that he provided. I didn't think there was anything dodgy going on. I was just getting annoyed. I even said to him, "Mate, I'm not your secretary." He was so thankful for my help and even offered to pay $500 extra for the hassle, which was nice. There was always a card number, expiry date and CVV. And when it all came out and I looked at it more closely I realised they were all different card numbers which might have been telling if I had just taken notice. About three weeks after meeting Eric, I got a call from my bank. They had 10 reports of me using stolen cards. I was like, "Whoa, no way, I would never accept a stolen card." But it looks like I did. All of Eric's payments were made on stolen cards since the cards were stolen and I didn't have the cards when I was processing them through the machine. The lady Pam from the bank said I needed to give all the money back to the people who own the cards. It's called a chargeback. In the end, I had to pay back $17,420 'cause I had sent all of the money back to the other banks, and they tried to get that back from me as well, but it had already been withdrawn. I went to the cops, but there wasn't anything they could do. They said it looked like a sophisticated crime gang and they probably weren't based in Queensland let alone Australia. It was a huge kick in the guts and a lot of work to make up $17,000. The thing I don't get is why they targeted me. I'm just a small, tiny business. I don't even know why they would pick me. Anyway, I never heard from Eric and wish I had never opened his email. I just never thought that something like this would happen to me.

- Unfortunately, Sanjay's story is one we hear all too often. Every day in Australia criminals are targeting business to steal credentials and money. So it pays to make sure that you have the right defences in place. A few tips NAB recommends: Don't let anyone take control of your EFTPOS terminal. Do not accept payments on someone else's behalf or for a service you don't offer. Always refund to the card used to make the payment. Consider using fraud detection software if you accept online payments. Do you and your team know how to spot the red flags? To help make your business a hard target for criminals visit nab.com.au/security for more information.