“Cops were over,stay safe,” he wrote.
Curtis McNulty (left) defrauded PayPal out of more than $53,000.Kate Geraghty
“They didn’t have a warrant,just asked questions. They were funny,asked if I knew what this shit was… the PayPal crap.”
McNulty had been using stolen customer information to defraud PayPal for more than a year,and continued for several months after police spoke to him.
McNulty avoided jail on Tuesday for stealing more than $53,000 from PayPal from October 2020 to August 2022,mainly by using fraudulent refunds for items such as $3000 sneakers.
The 26-year-old admitted to accessing and photographing names,emails,dates of birth,contact numbers,addresses and driver’s licence details of nearly 500 bank customers,and using these details to lodge financial product applications for six customers while working as a contact centre associate at Commonwealth Bank in Eveleigh.
McNulty made 16 PayPal accounts held in names of other people using Commonwealth Bank data,then defrauded the payment company using two methods.
First,he bought goods,pretended to return them with a fake tracking ID,and later sold them online.
Second,he transferred funds between Paypal accounts and withdrew them. He disputed the transaction with PayPal as “unauthorised” and was refunded as compensation.
McNulty also created bank customer profiles using identification information from non-customers which he bought via Telegram chats.
McNulty (left) pleaded guilty to the fraud in late 2023.Kate Geraghty
His phone contained detailed notes describing how to carry out the fake refunds.
In one note,he wrote:“Build up account and then do claim for sneakers. Next month 1k purchase on PayPal and then order Travis Scott Jordan 1s 9.5 $3100.”
In another email to PayPal,he wrote that he had ordered a MacBook and iPhone for himself and his brother for Christmas,but to his “dismay” he received the wrong models.
“I thought as I am close to the city the order would be arriving on Monday morning/evening,” he wrote.
“As the order didn’t arrive on[sic] those times I was forced to buy a new phone locally as I need one for work. I am more than happy to return these items so I can reorder my Christmas present for me and my family.”
As the Australian Federal Police caught on to McNulty’s crimes,they searched his Balmain home on August 10,2022.
They discovered debit and credit cards in four Commonwealth Bank customer’s names,two laptops and six mobile phones.
On his devices,they found information from customers’ drivers licences,credit and debit cards,Medicare cards,passports and utility bills.
The laptop had screenshots of instructions of how to fraudulently obtain refunds from Amazon and PayPal,and Telegram chats where McNulty gave others advice.
Police told Commonwealth Bank,and McNulty made detailed admissions in an interview with his employer.
He told them he began recording customer information daily from July 2021,mainly because “life was boring in a lot of ways” and he “felt like it could make it a bit more interesting”.
McNulty was fired on September 7,2022 and arrested on August 10,2023.
He pleaded guilty to dishonestly obtaining or dealing in personal financial information,accessing data by a carriage service with intent to commit a serious offence,dishonestly obtaining financial advantage by deception,and possessing identification information.
In his sentencing at Downing Centre District Court,Judge John Pickering accepted earlier evidence given by McNulty that he was somewhat motivated by people in his online gaming community,whom he met in the height of COVID and had pressured him to open fake accounts.
He was also partly motivated by helping his debt-ridden ex-partner,as well as simply “out of his own greed”.
Pickering said a psychiatrist noted he lacked impulse control due to his ADHD diagnosis,had people-pleasing tendencies and struggled with social awareness,with his mental health slightly reducing his moral culpability.
But he said the impact of identity fraud was serious.
“It is really hard to recover your identity;it is really hard when people steal it,” he said.
Despite this,Pickering said McNulty had no prior criminal record and showed good prospects of rehabilitation,with his reoffending risk better dealt with in the community than in full-time custody.
McNulty was sentenced to a supervised intensive correction order of two years and four months for three Commonwealth offences.
He received a separate 16-month intensive correction order for the NSW offence,beginning on December 22,2025 and expiring on April 26,2027.
McNulty must do 500 hours of community service,pay a $7000 fine,continue mental health treatment and abstain from alcohol and illegal drugs.
Start the day with a summary of the day’s most important and interesting stories,analysis and insights..