Case study · Service design · Commonwealth Bank
CommBank's scam checks: designing the right friction into the payment journey
In short
Most journey work tries to remove steps. CommBank's response to scams did the opposite: it added checks at the exact moments a customer is most exposed, such as paying someone new or taking a call that claims to be the bank. The bank reports that customer scam losses fell by about half in FY24 and by 76% from their 1H23 peak by August 2025. The lesson is that good friction is placed, explained and fast.
Who this is for: CX leads, product owners, fraud and risk teams, and operations managers in banks, insurers, utilities, telcos and any organisation that takes payments or calls its customers.
The problem: the riskiest moments looked like the easiest ones
Scams rarely break into a bank. They persuade a customer to do something the bank's journey is designed to make easy: send money, share a code, trust a caller. James Roberts, General Manager of Group Fraud at CommBank, put it plainly in the bank's August 2024 release: "Most scams originate outside of the regulated banking system".
That is the journey problem in one line. The bank does not control the text message, the social media ad or the phone call. It only controls a handful of moments inside its own channels, and in a scam those moments are the last chance to stop the loss.
The same release cited the ACCC National Anti-Scam Centre's finding that the highest reported scam losses in 2023 involved contact by phone call, social media or email. In other words, the damage starts in channels nobody in the bank's journey map owns.
What CommBank changed in the journey
Across 2023 to 2025 the bank added a series of checks, each attached to a specific moment rather than spread across the whole experience. Based on the bank's own releases and trade press coverage, the main ones were:
- NameCheck, at the moment of paying someone: before a payment goes, it shows whether the name and account details the customer entered appear to match. CommBank later extended it to other organisations that process payments.
- CallerCheck, at the moment of an inbound phone call: it lets a customer confirm whether a call really is from CommBank, aimed at bank impersonation scams.
- CustomerCheck, at the branch counter: it lets staff verify a customer's identity in person.
- Scam Indicator, before the conversation: developed with Quantium Telstra, it uses algorithms to identify potential scam calls for customers who bank with CBA and use Telstra.
- In-app approval for some online card payments: from August 2025, certain online card transactions need real-time approval in the CommBank app instead of an SMS one-time passcode.
- Scam Checker, when a customer is unsure: a free generative AI tool in the Truyu app where people upload a screenshot of a suspicious text and get an instant analysis.
Why the placement matters more than the tools
Read as a journey, the pattern is clear. Each check sits at a moment of commitment: money leaving, trust being given to a caller, identity being confirmed. None of them adds a step to checking a balance or browsing transactions.
That is the difference between friction that protects and friction that just annoys. A customer paying a regular biller does not need a warning. A customer paying a new account for the first time, possibly while someone is on the phone telling them what to type, does.
The move from SMS codes to in-app approval shows the same thinking. Roberts explained it in August 2025: "We are able to give clearer guidance and warnings in the app than in a text message." A text message is a channel scammers can imitate. The app is a channel the bank controls, so the warning arrives where the customer can trust it.
In our experience, this is the question most journey maps never ask: at which steps should the journey slow down on purpose? Teams map pain points and remove them. Fewer teams mark the moments where a pause would protect the customer, and design that pause so it feels like care rather than suspicion.
What was reported as the result
CommBank has published a run of figures. In October 2023 it said NameCheck had prevented more than 10,000 scam payments worth over $38 million, and reduced mistaken payments by more than $100 million, between March and September 2023.
In August 2024 it reported that customer scam losses for FY24 had halved compared with the previous financial year. It said NameCheck prevented an estimated $40 million in scam payments and stopped over $370 million in mistaken payments in the year to June 2024, and was being used around 4 million times a month by May to June 2024. CallerCheck was used 3.8 million times and CustomerCheck 3.7 million times between July 2023 and June 2024.
In August 2025, as reported by Australian Broker News, the bank said customer scam losses had dropped 76% since their peak in 1H23, and that it had invested more than $900 million in FY25 to combat fraud, scams, financial crime and cyber threats.
Two cautions. These are the bank's own figures, and we have not seen an independent evaluation that separates the effect of each tool from wider changes, such as industry blocking of scam numbers and growing public awareness. And the mistaken payments figure is a reminder that the same check did two jobs: it caught honest typos as well as scams.
The part that is easy to miss: the loop behind the journey
Not every change was customer facing. CommBank was the first bank to integrate into an anti-scam intelligence loop shared across banks, telcos and big tech, and it reported submitting more than 1,500 entries of scam phone numbers and URLs for blocking and takedown between April and June 2024.
This is the backstage half of a service blueprint. The customer only sees the warning or the confirmation screen. What makes that warning accurate is data flowing between organisations that each own a different part of the scam journey. CEO Matt Comyn said in 2023 that "Bringing the strength of different players together provides us with a better chance of stopping the scammers".
For most organisations the equivalent is less dramatic but just as real: the complaint that reveals a broken process, the call centre note that never reaches the product team, the partner whose step in the journey nobody watches.
Lessons for other organisations
You do not need to be a bank to use this. Any organisation that takes payments, changes account details or calls its customers has moments where a customer can be misled by someone else, or can simply make a mistake.
- Map the moments of commitment separately from the moments of convenience. Speed up the second group; protect the first.
- Put the check where the customer is about to act, not in a terms page or an email they read later.
- Deliver warnings in a channel you control and the customer trusts. A text that looks like yours can be faked.
- Give customers a way to verify you. If you call or text people, they should have a simple way to confirm it really is you.
- Measure what the friction prevents, not only what it costs. Count stopped payments, avoided errors and complaints, alongside drop-off.
Sources
- Anti-scam measures cut scam losses for CommBank customers in half, Commonwealth Bank of Australia
- CBA extends scam disruption technologies, Commonwealth Bank of Australia
- CBA scam losses drop 76% as AI tool and in-app verification roll out, Australian Broker News