ATO tax return data could help to alleviate mortgage fraud risk
As the country’s big four banks scramble to get ahead of the problem, there are solutions that can be implemented to greatly lower the risk of home loan fraud
Joyce MoullakisAssociate editor
Mar 1, 2026
The financial services sector, police and policymakers should come together as soon as practicable to address the heightened threat of mortgage fraud in the nation’s $2.4 trillion home loan market.
The threat has certainly never been more real. And although the problem might at first seem difficult to combat, there are solutions that can be implemented to drastically reduce the risk of home loan fraud.
The big four banks are on the hook for more than $300 million at the latest count, as the home loan fraud unravels. David Rowe
Commonwealth Bank is grappling with potential fraud of $1 billion within its home lending portfolio, and that figure is unlikely to include an exposure to a criminal group dubbed The Penthouse Syndicate. (The $1 billion in loans are secured by property, so the bank is not facing losses of that magnitude, but its systems and processes have been found wanting).
The Penthouse Syndicate has entangled all the big banks in fraud, after the group circumvented their credit policies to acquire home and business loans, including for luxury property. ANZ, CBA, Westpac and National Australia Bank are on the hook for more than $300 million at the latest count.
The loan fraud issue is exacerbated by the use of artificial intelligence to create fake documents, and the other concerns include the use of shell companies, draft or false tax returns and large deposits from offshore jurisdictions.
FinTech Australia’s chief executive, Rehan D’Almeida, believes that if tax returns can be accessed directly by lenders and mortgage brokers through the Australian Taxation Office, it would stamp out some of the home loan fraud being perpetrated.
“The current situation … is where you download the statements and particular documents and upload it. That leads to so many opportunities for fraud, and with AI coming into the conversion as well, it just becomes easier to create inaccurate, fake documents,” he says.
Underwhelming take-up of the data right
If his suggestion is introduced, it would require the individual to give the ATO consent to make the source information available, as part of the Consumer Data Right. This right allows consumers to safely share the data that banks, other lenders and energy companies hold about them.
It has not extended to ATO data so far, and overall take-up of the data right, as it stands, has been underwhelming. A banker, who spoke on the condition of anonymity, said the inability to verify an individual’s notice of assessment with the ATO was an issue for the industry. It used to be allowed, but was stopped as concerns, including around privacy, came into play.
Several banks want the data right to include information from government agencies. In a submission to the Productivity Commission last year, CBA advocated for change, including expanding the data right to government datasets. In Westpac’s submission, it said that including ATO data made sense, but it focused on the inclusion of the data, making the lending process more efficient and increasing the take-up of the Consumer Data Right.
Either way, the $1 billion in potential mortgage fraud at CBA raises serious questions about the bank’s home loan systems and processes, and its ability to verify documents and information provided by applicants or brokers.
And every bank in Australia is now on notice to ensure that staff, and credit and compliance teams, are aware of risks and the potential for fraudulent and AI-generated documents to be submitted.
“We have unfortunately seen examples of phoenix-ing, lazy compliance practices and brokers cutting corners.”— Finsure chief executive Simon Bednar
For CBA, the vulnerabilities of those systems and processes will be the subject of close attention from the NSW Police, financial crimes regulator AUSTRAC and the prudential and corporate regulators.
Remember, it wasn’t that long ago that deficiencies across CBA’s intelligent deposit machines led to them being exploited by criminals and terrorists, who were stuffing large sums of money through them.
At one stage, deposits going through those so-called intelligent ATMs amounted to $1.7 billion a month. And in 2015, a customer entangled in the scandal deposited $670,420 in just one day.
CBA chief executive Matt Comyn was head of the retail bank during that tumultuous era, making him acutely aware that criminals seek to exploit any vulnerability within banks’ systems and processes.
CBA’s issues with that channel and other failures around its transaction reporting led to it paying a $700 million penalty in 2018.
The bank is reviewing loans across its own lending channels, including bankers and branches, but also focusing on mortgage brokers and loan referral partners such as real estate agents and accountants.
Interestingly, before the CBA revelations, mortgage broking group Finsure had already moved to raise entry standards for brokers joining its network.
Trade publication The Adviser covered the change last week, and Finsure chief executive Simon Bednar warned of increased levels of misconduct within the industry.
“We have unfortunately seen examples of phoenix-ing, lazy compliance practices and brokers cutting corners. It is a minority, but it is a pattern we cannot ignore,” he said at the time.
Kudos to Finsure for seeking to raise standards within the mortgage broking industry. Protections were put in place following the Hayne royal commission, when regulators introduced new rules for mortgage brokers, including a duty to act in the best interests of customers. As the industry works through its issues, lenders and policymakers should urgently act to close any gaps that allow criminals to fraudulently obtain home loans.
Make AFR.com your preferred news source on Google
Joyce Moullakis is an associate editor writing across company news, policy issues, investment banking, private equity and financial services. Connect with Joyce on Twitter. Email Joyce at joyce.moullakis@nine.com.au
