OFX Breach Exposes Verification Flaws
The firm confirmed unauthorized parties bypassed call center identity checks using stolen customer data on September 28.
Updated on Oct. 16, 2026 in Cybersecurity
Live Poll
Do you trust financial firms to adequately protect your personal information from data breaches?
Foreign exchange firm OFX confirmed a data breach on September 28 where attackers accessed customer information to impersonate a client. The company states that the incident, which is still under investigation, did not involve access to its underlying client platform database or payment-capable data.
Why it matters
The breach highlights the persistent vulnerability of call center verification processes to social engineering attacks using stolen personal data. While the firm reports that sensitive financial records were not compromised, the event underscores the risks inherent in relying on static knowledge-based authentication.
The incident involved the unauthorized acquisition of names, dates of birth, and secret question answers, allowing attackers to pass call center identity checks. OFX reports that no payment-capable data or identity document copies were accessed, and the core client database remained secure.
The players
OFX
An international foreign exchange firm that provides global money transfer services through its digital platform and call centers.
Office of the New Zealand Privacy Commissioner
The regulatory authority responsible for overseeing privacy standards and receiving breach notifications within New Zealand.
The details
The breach occurred when attackers leveraged stolen personal data to authenticate as a client via the company's call center. This form of social engineering bypasses digital security barriers by manipulating the human verification layer rather than the technical infrastructure. OFX maintains that this isolated access did not reach the central database, limiting the scope to specific pieces of client info.
Timeline
September 28: The data breach occurred.
October 2: OFX first publicly disclosed the breach in an ASX filing.
October 15: OFX detailed the information accessed in an ASX filing and customer email.
The Tech Race
The incident marks a departure from traditional platform-level cyberattacks toward the targeting of human-centric verification workflows. It places pressure on financial service providers to accelerate the adoption of biometric or device-based authentication to replace static secret questions.
Customers of financial services should treat secret questions as compromised and move to update recovery methods if possible. The firm has not released a timeline for when the investigation will be finalized, leaving clients to monitor account activity for signs of unauthorized use.
The takeaway
The event serves as a reminder to limit the personal data used in static verification processes whenever alternatives are available. Users should monitor account logs for any unrecognized transactions while awaiting the final report from the ongoing investigation.
Further reading
For broader analysis on how organizations are securing client authentication, visit the Cybersecurity section.
Source note: This article includes information reported by NZ Herald.
Live Poll
Do you trust financial firms to adequately protect your personal information from data breaches?
