Natasha and her family had no idea that a simple suitcase mix-up during a stopover in Indonesia would lead to heartache and a loss of $28,000. Their dream holiday ended on a sour note, and now they’re warning fellow Australians about a scam they encountered in this popular vacation spot.

The ordeal began when the family of five touched down in Jakarta for a brief three-night stay last October. In the hustle of travel, they mistakenly picked up a black Samsonite suitcase that wasn’t theirs.

Upon reaching their accommodation at The Ritz-Carlton, they discovered the error—the suitcase was a different size than expected. They promptly handed it over to the hotel staff, hoping to rectify the mix-up.

Fortunately, they could track their actual suitcase.

“The missing suitcase was meant for my two sons, ages 15 and 12, who were celebrating their birthdays during our trip. It contained their birthday gifts,” Natasha shared with news.com.au.

“This missing suitcase was for my two sons aged 15 and 12 who celebrated their birthdays while overseas and it contained their birthday presents,” Natasha told news.com.au.

Apple AirTags in the suitcase revealed it was still at the airport and she believed the hotel would assist in having it returned.

But when Natasha, who did not want her surname shared, woke up the next day, she was surprised.

The suitcase had traveled more than 2,000 kilometers on a flight and was now at Sam Ratulangi International Airport, which is close to the capital city of North Sulawesi.

The mom-of-three googled the airport and asked The Ritz-Carlton for help.

Natasha was told that the suitcase could be returned for a small fee.

She was then sent a payment link from the person at the airport via the hotel’s WhatsApp messaging account.

But when she put in the details of her Qantas Titanium credit card, the link did not work.

Money drained in just 30 minutes

Natasha said The Ritz-Carlton talked to the person on the phone delivering further instructions and even contacted the hotel’s IT department.

“I tried the card four times, and then I just thought, this is very strange,” she recounted.

“So then I tried my Bendigo Bank account and I got a text message saying fraud has been attempted on your card and your card is temporarily blocked. That’s when I opened up my Qantas Titanium app and the $28,000 was gone in four transactions in the space of about 30 minutes.”

Scammers had stolen $6,330 in the first transaction and $7,832 in the second.

The third transaction took a whopping $12,333 and the fourth stole $2,146. Natasha’s credit card was also slugged with international transaction fees that topped almost $860.

Natasha said the experience was “very traumatic.”

“I just felt sick to my stomach and thought I’ve been scammed and that has gone forever. I’ll never get that back,” she revealed.

“Then I went to the hotel (and said) ‘Why did you send me an unsecured payment link’? They just didn’t really say anything and didn’t know what to do.”

‘Shock’ as pending transactions couldn’t be stopped

Natasha was “appalled” by Qantas Money’s response as the transactions were still pending when she called to alert them to the fraud.

“I immediately called Qantas Titanium and told them to stop the transactions and they informed me that they couldn’t because they had gone to a cash app called Tokopedia. Qantas was mostly concerned about replacing the card,” she said.

“I was very shocked and disappointed with the poor security. The annual card fee is $1,200 – what am I paying for?

“Also, every time I receive an email from Qantas – frequent flyer or health insurance – to my inbox I feel anxious and sick to my stomach.”

Natasha lodged a complaint with Qantas Money over the four transactions, but less than three weeks later the company told her it did not accept liability, in correspondence seen by news.com.au.

Its review found that the transactions were processed using the MasterCard Secure service, meaning a six-digit security code is sent to a registered mobile phone number and used to verify identity, Qantas Money said.

“At the time of the transaction you have disputed, the code was provided to satisfy this additional layer of security. As such we do not accept liability, and we’re unable to progress your claim,” it said.

A Qantas spokesman said modern scams are highly sophisticated, often using deceptive tactics to target customers during vulnerable moments.

“As the card issuer and underwriter for Qantas Money, NAB is responsible for all banking and security matters, including transaction monitoring, fraud protection, and account servicing,” they said.

“Qantas Frequent Flyer is responsible for the distribution of Titanium credit cards to customers and the delivery of loyalty features like lounge access and point offers.”

Couple being slugged over $550 in interest each month by NAB

Natasha is now locked in a dispute with NAB, which issues the card on behalf of the airline.

“The card has a limit of $40,000. I’d spent $10,000 on it on my trip in Europe, so they drained it,” she said.

“I’m challenging the bank and I’ve also made a complaint with the Australian Financial Complaints Authority (AFCA) to get some answers as to why such a large amount of money was available to be scammed off the card in such a quick succession of time.”

A mediation with AFCA is set for March with Natasha already knocking back a goodwill offer of $3,000.

The couple are also being slugged with interest as they currently wait to see what happens with AFCA. However, the debt would take three years to pay off if they were forced into it, she said.

“I am being charged interest of $568.94 per month and a late fee of $30.00 per month,” she said.

“My husband and I are trying to save a deposit to buy a family home, and it will have to wait until this debt has been sorted.”

NAB executive of investigations Chris Sheehan said scams are a scourge on society and criminals deliberately use sophisticated and deceptive tactics to exploit people in vulnerable moments.

“One‑time passwords are a key security measure used to confirm that a payment is being authorized by the customer, and we strongly advise customers not to share them,” he said.

“Once a customer authorizes a payment – particularly when it’s sent overseas – recovery becomes extremely difficult. In these circumstances, funds are often moved quickly beyond reach, leaving limited or no opportunity for recovery.”

More costs and a surprise airline tag

Natasha’s husband also lodged a formal report with Indonesian police, but hasn’t heard any updates. Three weeks after being scammed, the family had to fork out another $1,500 to get the suitcase returned to Melbourne.

“It had a Garuda Airline baggage tag on it. I didn’t fly with Garuda, I flew with Etihad. Obviously this scam begins in the airport. Scouts are looking for lost luggage that get sent to the location with the fraudulent phone number. I was scammed by three of the big trusted brands — Google, The Ritz-Carlton and Qantas Titanium,” Natasha said.

A Google spokesman said the tech company does not tolerate misleading activity and is constantly monitoring and evolving its platforms to combat fraud and create a safe environment for users and businesses.

“We are looking into the specific matter you have raised with us and will take appropriate action in line with our policies,” they added.

No resolution with major hotel group

Meanwhile, Natasha’s husband has also tried to negotiate with The Ritz-Carlton in an email he sent in November last year.

He said the hotel had even involved its IT department, which told his wife to put her credit card details in again after three failed attempts.

“Again, the secure link provided by your hotel failed to process the payment,” he wrote. “At this point, (the hotel) told my wife to immediately delete the secure payment link at the urgent advice of your hotel’s IT department.”

He added that the hotel chain, which is operated by the Marriott Group, has a policy to create a “secure payment link” and then send it to the guest, so that credit card details can be entered safely.

“The result is that, due to your staff not following company processes, my family has had stolen an incredible sum of money, and … experienced a high level of emotional and obviously financial distress,” he added.

He proposed compensation of four million Marriott points and being upgraded to premium elite status for three years, but his request was rejected by the hotel group.

A spokesman from the Ritz-Carlton Jakarta said they were aware of this incident and had been in direct contact with the guest, providing “full support, including assistance with the local authorities”.

“This matter is currently under investigation with relevant authorities, and we remain committed to supporting our guest and co-operating with the investigation,” they said.

Tearfully, Natasha said the experience has been devastating for the family.

“It’s hard to talk about … I haven’t really told many people because I’m so ashamed about what happened. But I would really like it to be out there so it doesn’t happen to another family or person. A lot of Australians go to Bali and Indonesia all the time,” she said.

“I don’t want to go back to that part of the world or even just being in a fancy hotel. It gives me a little bit of anxiety.”