The Campaign Against Foreign Control of Aotearoa (CAFCA) is calling for urgent, independent regulation of New Zealand’s Direct Debit system after more than $19,000 was fraudulently withdrawn from its Westpac bank account under industry‑approved processes.
The unauthorised transactions, originating from multiple large third‑party organisations including 2degrees, Orcon, Mercury, Watercare and the IRD, occurred without CAFCA’s knowledge or approval.
The issue only came to light after Inland Revenue contacted CAFCA when a $15,000 direct debit failed. CAFCA has since lodged formal complaints with Westpac, the Banking Ombudsman and New Zealand Police. While the funds were eventually returned (the third parties not revealing their fraudulent customers – noting privacy concerns) and the Police file closed, complaints with Westpac and the Banking Ombudsman remain unresolved.
CAFCA’s investigation has identified fundamental verification weaknesses in what the banking industry refers to as the Preferred Initiator Direct Debit model. Under this framework, banks delegate responsibility for verifying account authority to third‑party organisations such as utility companies when direct debits are established, often over the phone. In practice, these organisations typically rely on unverified customer‑supplied information and do not confirm that the customer providing the bank account number to direct debit is entitled to operate that nominated bank account.
Critically, when banks receive direct debit instructions from these third parties, they do not independently verify that the account holder has authorised the transaction. This Direct Debit model is highly automated and places the burden entirely on bank customers to detect and dispute fraud after funds have already been withdrawn. In CAFCA’s case, neither the account’s unique name nor its dual‑signatory requirement prevented Westpac from processing the direct debits.
CAFCA spokesperson James Ayers said the incident highlights a serious breach of trust:
“This represents a clear abdication of banks’ fiduciary duty to their customers. The Direct Debit framework is overseen by Payments NZ, a company owned by the banks themselves—effectively allowing the industry to regulate its own risk. That is an unacceptable conflict of interest – akin to a skulk of foxes guarding the hen house,”
Ayers added:
“At the core of any bank–customer relationship is the understanding that customers’ money is protected by effective systems that prevent unauthorised withdrawals. Instead, the current framework has created a third‑party transaction loophole with multiple points of failure that can be readily exploited by fraudsters. All New Zealanders would be alarmed to learn these loopholes exist. It is ironic that this fraud has happened to CAFCA, an organisation well known for criticising the transnational exploitation of Aotearoa, including the foreign-owned major banks”
CAFCA is urging all bank customers to scrutinise their accounts carefully and to request written confirmation from their bank that no third‑party Direct Debit can be established without their explicit approval.
Ayers said the model reflects a broader pattern of cost‑cutting across the banking sector:
“From branch closures to opposition to proposed cash‑access obligations, the Preferred Initiator Direct Debit model is another example of banks prioritising efficiency and profit over customer service and in this case, account protection. Verification has been subcontracted, oversight reduced, and customers left to fix failures that were not of their making.”
“The banking industry earns approximately $10 billion in pre‑tax profits each year from a population of just five million. New Zealanders are entitled to expect far stronger safeguards in return.”
CAFCA is calling for:
- Mandatory bank‑level verification of all Direct Debit transactions sourced from third party organisations
- Independent oversight of the banking industry framework operated by PaymentsNZ
- Commensurate penalties paid by the banks to customers when unauthorised third party direct debits are loaded against a customer account.
CAFCA has correspondence from Westpac confirming the operation of the Preferred Initiator Direct Debit system as described above. CAFCA also holds additional supporting documentation.