The CBA case, first raised through the bank’s whistleblower platform in February 2025, involves multiple loans allegedly supported by forged income documents, fabricated tax returns, shell-company structures, and AI-generated payslips and financial statements, according to the Gallagher report.
Treat every unsolicited “urgent” communication from a bank or government agency as a potential “Vishing” or “Smishing” attack, regardless of how official the branding or phone number appears.