It was a cool, grey spring morning in 2022 when Ian Williams woke up and discovered two transactions on his account he did not make.
“I was sitting on the toilet and checking through my bank account, as you do,” he said.
One was for $515, the other was $823. They had been made a few days earlier at a Coles supermarket in Bundoora, about 150 kilometres from his regional Victorian home in Bendigo.
He called the bank and was told to wait while staff investigated.
Two hours later, he said, a customer service representative from uBank, a subsidiary of National Australia Bank (NAB), called him back and said, according to the bank’s payment data, the transactions had been made using Williams’s Google Pay account.
“They said that I was guilty, I was responsible. I was personally at Coles to do the transactions with my phone and my thumbprint.”
That was an accusation he would never let go.
Two and half years later, Williams was outside the Supreme Court in Melbourne.
He’d just learnt he could be in line to win more than $300 million in his case against the bank over the fraud.
After months of scrolling through codes, acts, and case law to represent himself in the most David and Goliath of cases, the bank hadn’t shown up at court, and a judge had found in his favour.
Ian Williams takes the train to Melbourne from Bendigo to take up his fight with the bank. (ABC News: Rachel Clayton)
All that had to be decided was how much money he’d get for his trouble.
Then, just as the scales were starting to tip his way, the bank’s legal team came storming in.
‘I just won’t wear being called a liar’
When NAB told Williams he was responsible for the missing $1,338 on that cool spring morning back in 2022, he wasted little time trying to prove them wrong.
His maps app showed he never left Bendigo, his sleep app indicated he was asleep close to the time the transactions went through. He had call and text logs to prove a friend of his was headed over for a cuppa that morning.
When that wasn’t enough, he visited his local police station, filled out a fraud pack, made a statement, and had an officer sign off that he had witnessed the map data was from Williams’s phone.
He sent his police statement to the bank, believing it would finally clear up any misunderstanding.
Ian Williams knows what he is risking by taking on one of Australia’s biggest banks. (ABC News: Rachel Clayton)
When that didn’t work, he went to the Australian Financial Complaints Authority (AFCA).
By now, the police had viewed and collected the CCTV from the supermarket.
Williams wasn’t provided a copy of the tape, but he was given a description in an email from police.
“It looks like two young males who look nothing like you have somehow been able to create copies of your (and likely others) credit card details on phone handsets to buy gift cards,” the email read.
The evidence showed Williams wasn’t the one using his phone to make those transactions at a supermarket 150km away from his home.
National Australia Bank operates U-Bank, the digital-only bank Ian Williams joined the same year his card was compromised. (ABC News: Rachel Clayton)
Then, came the answer most scam victims desperately hope for.
The bank would return the $1,338, in full.
But, there was a catch.
He would need to sign a non-disclosure agreement and, crucially, agree that the payment did not mean the bank was taking responsibility for the missing funds.
Williams was ropeable.
“I could use a lot more expletives, I can tell you. It’s offensive, absolutely offensive … nowhere near good enough,”
Williams said.
“Now they can pay me some compensation. I want a letter of apology and a letter of acknowledgement that they’re at fault, not me.”
He told the bank the reason for his refusal. Five months later, they made him another offer: how about $1,500 as a “full and final settlement”?
Williams would have to agree not to take legal action. The offer would expire in two weeks.
Again, he said no.
“It’s the principle of the thing. I just won’t wear being called a liar.
“I had to fight for myself all my life and this sort of injustice, where common people are being trampled … it’s just getting worse and worse.
“I’m a stubborn old turd, and I will not give up.”
The legal case that nobody would take on
At 73 years old, Williams was no stranger to new and unfamiliar environments.
He ran away from home at 15, he said, hitchhiking his way around the country, sleeping in the hollows of trees, under bridges, and squatting in abandoned terraced houses.
“A 12-by-eight piece of black plastic is the best thing I’ve ever had,” he said.
Ian WIlliams on his motorcycle, near his home in Bendigo. (ABC News: Rachel Clayton)
The decades of his life were filled with a diverse range of jobs: stunt man, actor, prawn trawler fisherman. He ran his own business in security investigating stock shrinkage, bought a television tower in rural Victoria for $1, which he still owns. He learnt how to fly planes, play the acoustic guitar, and two years ago walked for 18 days straight as part of the Long Walk from Melbourne to Canberra.
One of his biggest motivations to take on a corporate giant was to donate any money he won to Indigenous health charities.
And so, for the past year, filled with the drive of a man who flourishes in the face of something new, Williams began most nights, about 8pm, scrolling through dozens of legal databases and dry legislation.
He read the stories of those who’ve lost hundreds, thousands, tens of thousands of dollars to fraud and scams, and wrote and rewrote an argument to take to court, often huddled into his corner desk until the sun came up.
“I might not go to bed until eight or nine o’clock the next morning,” he said.
He visited legal aid, the law institute, and universities, had meetings with civil lawyers who said they might be able to take on his case pro bono, but who, in the end, gave him advice about where to secure a personal loan to pay their fees.
“Nobody would take it on. Maybe because it’s a bank and they’re too big to fight?” he said.
So, about 18 months after the bank’s final offer, on a mild summer day in December 2024, Williams caught the train down to Melbourne with his friend Richard Sugden, to the headquarters of NAB.
There, armed with a stack of papers, he sat down with a woman from the bank called Sarah and took her through his 14-page writ that outlined he was seeking $379 million in exemplary damages.
Ian Williams has spent an enormous amount of time studying Australian banks’ obligations, as he represents himself in court. (ABC News: Rachel Clayton)
Williams had calculated that $1,338 was about 5.5 per cent of his annual pension.
And $379.05 million was 5.5 per cent of NAB’s 2022 profit after tax.
“Things need to be proportionate,” he said.
In those documents, Williams claimed the bank:
- Failed to secure his banking credentials and transaction data
- Failed to use its fraud detection protocols, which he said would have flagged the two transactions as fraudulent.
- Breached its duty to “protect customers from unauthorised transactions”
- Failed to comply with the ASIC ePayments Code by not conducting a fair and transparent investigation or reasons for its decision to not pay Williams back.
Williams claimed the reason he was suing for the vast amount of $380 million was because he believed NAB’s demonstrated “a systemic abuse of power”, knowledge of his vulnerability, “and deliberate disregard for fair dealing”.
The bank had about four weeks to respond.
If Ian Williams didn’t do it, who did?
Williams didn’t spend much time wondering how his Google Pay card got onto someone else’s phone.
He assumed he’d been hacked, and that the bank should have caught it.
But on the other side of the world, Dutch cyber expert Eward Driehuis, was digging into the conundrum: how could a digital wallet be used in two places at once? Why were stolen digital cards suddenly turning up in supermarkets across Europe?
Do you know more about ghost tapping?
- Contact backgroundbriefing@abc.net.au
- Or, send an encrypted email from a Protonmail account to backgroundbriefing@protonmail.com
- Send us documents anonymously through SecureDrop
Since 2017, Driehuis, supported by a team of 70, has worked with law enforcement and banks across the globe, helping them with digital scams.
Last year, he got a call from a bank concerned its customers “seemed to teleport”.
It didn’t take long for Driehuis and his team to figure out that criminals had created an enterprise out of stealing card details, adding a stack of them to digital wallets on burner phones.
He said he saw photographs from authorities in Europe showing mobile phones side-by-side in a warehouse with the screens open to the phone wallet.
“[It] was truly impressive. Each wallet [was] holding multiple stolen cards, ready to sell. And all those phones had stickers on them with Chinese handwriting.”
Authorities in Europe found mobile phones in a warehouse displaying stolen card details in the phones’ open wallet apps. (Supplied)
Here’s how Driehuis says it works:
The victim puts their credit card details into a scam site, thinking they’re making a purchase.
For more stories like this follow the podcast
They are then asked for their phone number so they can be sent a text with a one-time password to confirm the purchase.
But the scammer has actually registered those card details to be added to a phone’s digital wallet, and that one-time password text message is from Google or Apple, asking the victim to authorise the new registration.
It could be stopped if victims read the entire text message, but these days, few do, Driehuis said.
“Some operating systems, including iOS, which is all the Apple phones, they just automatically read those codes and use them. Some phones don’t even show those codes.”
He dubbed the fraud scam “ghost tapping” and gave a presentation on it earlier this year in Melbourne to Australia’s biggest banks.
Williams did receive text messages a few days before the fraudulent transaction went through, with a passcode for him to confirm he wanted to add his card to a new Google Pay account.
But he said he doesn’t remember receiving the texts.
Ian Williams received a text to activate a new Google Pay wallet on October 27, two days before the fraudulent transactions. (ABC News)
It’s unclear how the scammer who added his card to a digital wallet managed to get that code.
He said even if he did unwittingly give the scammer authorisation to add his card, he still believes the bank should have picked up that something wasn’t right.
It’s now in the hands of a judge to decide if he’s right.
How Trump’s DOGE thwarted accountability
Ghost tapping is a problem that was on the cusp of being addressed by the United States when, late last year, the consumer watchdog agency the Consumer Financial Protection Bureau (CFPB), started to take control of Google Pay to find out how big of a problem fraud, scams and a lack of security was at the company.
The CFPB could do this under its “supervisory authority” powers, allowing it to examine the company’s transaction data, complaint responses and its anti-fraud systems.
The department had received hundreds of complaints about money being taken via Google Wallet accounts, in circumstances very similar to Williams’s.
But there was considerable pushback, including Google making an application to sue the CFPB.
Donald Trump and Elon Musk during a press conference about the work of DOGE in May this year. (Reuters: Nathan Howard)
But the death knell was President Donald Trump’s Department of Government Efficiency (DOGE), which reversed the supervisory authority and significantly defunded the CFPB.
Erin Witte, a consumer protection lawyer and policymaker at the Consumer Federation of America, said the tech company was effectively given a “free pass”.
She said what happened to Williams was an example of something the CFPB could have monitored.
“How often did this happen? How often did Google ignore this … location discrepancy?”
Williams risks bankruptcy for his day in court
While investigators in Europe were looking at warehouses full of burner phones and the US was busy defunding consumer protection, Williams was preparing for court.
On a mild morning in May, he slid on a black jacket he bought from a second-hand store the week before, checked his tie, zipped a bulging red folder of documents into a small suitcase and waited for his friend to take him to the train station.
They arrived outside the Supreme Court a little before 1pm.
Ian Williams outside the Supreme Court in Melbourne. (ABC News: Rachel Clayton)
NAB had made an application for the default judgement that found in Williams’s favour to be set aside.
The bank said it missed its deadline because it lost the paperwork served by Williams. It argued the default judgement had been “snapped on”; a legal term meaning Williams applied for it too quickly.
It meant Williams and the bank would go head-to-head, in the flesh, for the first time.
The hearing took a few hours, and ultimately, the bank succeeded in having the judgement reversed.
“Now it goes back to where I was originally going to be, taking them to court and fighting it all the way through the court, and trying to make that as public and as embarrassing for the bank as I can,” Williams said.
Losing the case could mean he’ll be ordered to pay the bank’s costs, which Williams said could bankrupt him.
But he was glad the bank had shown up.
“My whole thing with running this through the courts is to make it very, very public.”
Ian Williams reads legal documents ahead of his day in court. (ABC News: Rachel Clayton )
Later that afternoon, sitting on the train back to Bendigo, Williams talked about the case with Sugden and was overheard by other passengers.
“I met three people who had been scammed or had fraudulent activity on their accounts. One was $10,000, and they didn’t fight it. They just thought it was too hard.”
Williams said his fight is not about a payout (though he admits it would be nice to buy a house), but about making an example out of a corporate behemoth that he believes won’t admit it got it wrong.
“I’m the first [scam victim] that I can find that’s actually thought it’s worth doing this because people were just getting ripped off all the time, every single day.”
In a statement, NAB said it took “its commitment to scam prevention extremely seriously” and had made multiple attempts to help Williams.
“[We] are disappointed that the matter has progressed to the Supreme Court. As this issue is now subject to legal proceedings, we are unable to provide further comment,” NAB said.
NAB has applied to have the matter struck off, with a hearing scheduled for later in the year.
Loading…
Ian Williams says he has spoken to the bank multiple times, trying to get to the bottom of why they believed he was responsible for the transactions. (ABC News: Rachel Clayton)