Gayle Arnott had a major health scare during the pandemic.
A brain bleed and a stroke saw her spend three months in hospital in mid-2020.
So when the 65-year-old, from the regional town of Peterborough in South Australia, went to get a blood test in April this year she knew how important it was to stay on top of the results.
A few days after the blood test, Gayle got a text message on her phone, telling her she had a voicemail from her doctor and asking her to click on a link to hear it.
It was to be the start of a lengthy ordeal for Gayle and her husband James, who had no idea they were about to become victims of a messaging scam.
"My wife thought she had better listen to the voicemail, because it might be something serious," James said.
"It came as a bit of a shock, her health scare. She died three times on me while she was in hospital.
"So whenever something medical comes up, we treat it as urgent."
When Gayle clicked on the link in the voicemail, initially nothing happened, James said.
But the next day, Gayle started getting lots of phone calls.
"They were strange phone calls, with people saying, 'Oh, you rang me? What did you want?'" James said.
"Then she was getting messages with all sorts of superlatives in them.
"That's when we realised it must have been from tapping on that link."
A day later, Gayle was doing some banking and noticed the balance on a home improvement loan the couple had taken out with Commonwealth Bank was down from $18,000 to around $11,000.
Two withdrawals – totalling $7000 – had been made on the loan account.
"We rang the bank straight away and told them and they blocked the account," James said.
After investigating the incident, the Commonwealth Bank told the couple last month it would not be refunding their money.
While the Commonwealth Bank offers a "100 per cent security guarantee from unauthorised transactions on personal and business accounts" it comes with the proviso that customers take the necessary steps to stay safe online.
Where customers have been found to contribute to a financial loss, such as by clicking on links, the guarantee does not apply.
After protesting the bank's decisions, James said they were told the bank would give them a 25 per cent refund on the amount taken as a "gesture of goodwill".
James said he and his wife had been left devastated by the decision, which meant they would no longer be able to complete their plans to build a shed and patio in their backyard.
"The Commonwealth Bank has a written guarantee to get your money back if you are hacked and they are reneging on that," James said.
"The bank is trying to say we gave the scammer's permission (to access our account) by tapping on the link. That is their loophole.
"But we didn't give permission, we thought it was a voicemail from the doctor."
A CBA spokesperson told 9news.com.au: "We are always very concerned when we are made aware of frauds and scams affecting customers and the wider community.
"Despite the commitment and best efforts of regulators, law enforcement agencies and the banking industry, such frauds and scams sadly still occur.
"We review frauds, scams and complaints on a case-by-case basis however it is widely recognised that scams are becoming increasingly sophisticated.
"Customers need to remain vigilant, protect their banking details and be smart about who they send money to."
Global police operation stops 'Flubot' scams
Gayle and James appear to have fallen victim to a classic Flubot scam.
Flubot was named after a malicious software that was being used to infect the phones of Android users who tapped on links included in text messages.
The Flubot scam first started targeting large numbers of victims in last August.
The Australian Competition and Consumer Commission (ACCC) received 14,466 reports of Flubot text messages in the first five months of this year.
But an international police operation involving 11 countries, including Australia, was launched last month and appears to have been successful in taking down the Flubot threat.
Dutch police were able to render Flubot inactive in May by taking over the malware's infrastructure, Europol said in a statement.
A spokesperson for the ACCC said the police operation appears to have stopped Flubot scams both in Australia and overseas.
The types of messages sent out are constantly evolving as scammers think up new ways to entice people to click on their links, an ACCC spokesperson told 9news.com.au.
Contact reporter Emily McPherson at email@example.com.