Bank worker avoids jail after stealing customer data and defrauding fintech paypal. Says he was motivated by people in his online gaming community and that he was bored.

What happened?
Former Commonwealth Bank worker Curtis McNulty who admitted to accessing and photographing names, emails, dates of birth, contact numbers, addresses and driver’s licence details of nearly 500 bank customers, and then lodging applications for financial products for six customers and defrauding fintech PayPal avoids a jail sentence.  

McNulty avoided jail on Tuesday for stealing more than $53,000 from PayPal from October 2020 to August 2022, mainly by using fraudulent refunds for items such as $3000 sneakers.

McNulty made 16 PayPal accounts held in names of other people using Commonwealth Bank data, then defrauded the payment company using two methods.

How did the fraud operate?

• First, he bought goods, pretended to return them with a fake tracking ID, and later sold them online.
• Second, he transferred funds between Paypal accounts and withdrew them. He disputed the transaction with PayPal as “unauthorised” and was refunded as compensation.

McNulty also created bank customer profiles using identification information from non-customers which he bought via Telegram chats.  Readers might recall that just a few days ago (Saturday 24 August 2024) Pavel Durov, the Russian-born billionaire and founder of the Telegram messaging app, was arrested on landing in Paris.

McNulty's phone contained detailed notes describing how to carry out the fake refunds.  Australian Federal Police discovered debit and credit cards in four Commonwealth Bank customer’s names, two laptops and six mobile phones.  And on his devices police found information from customers’ drivers licences, credit and debit cards, Medicare cards, passports and utility bills.

McNulty pleaded guilty to dishonestly obtaining or dealing in personal financial information, accessing data by a carriage service with intent to commit a serious offence, dishonestly obtaining financial advantage by deception, and possessing identification information.

Why did he do it?

• The Judge  accepted earlier evidence given by McNulty that McNulty was somewhat motivated by people in his online gaming community, whom he met in the height of COVID and had pressured him to open fake accounts.
• McNulty was also partly motivated by helping his debt-ridden ex-partner, as well as simply “out of his own greed”.
• McNulty lacked impulse control due to his ADHD diagnosis, had people-pleasing tendencies and struggled with social awareness, with his mental health slightly reducing his moral culpability.

What was the penalty?
The Judge noted that the impact of identity fraud was serious.
​

• McNulty had no prior criminal record and showed good prospects of rehabilitation
• sentenced to a supervised intensive correction order of two years and four months for three Commonwealth offences.
• Received a separate 16-month intensive correction order for the NSW offence, beginning on December 22, 2025 and expiring on April 26, 2027.
• McNulty must do 500 hours of community service, pay a $7000 fine, continue mental health treatment and abstain from alcohol and illegal drugs.

Sources: 
https://www.brisbanetimes.com.au/national/nsw/bored-cba-staffer-stole-details-of-hundreds-of-customers-to-feed-fraud-20240827-p5k5lw.html

https://www.smh.com.au/national/nsw/bored-cba-staffer-stole-details-of-hundreds-of-customers-to-feed-fraud-20240827-p5k5lw.html