Account takeover fraud: How to protect your account online

Jane has been a Colonial First State member for many years. She keeps a careful eye on her accounts, and logs in to FirstNet Investor from the same home computer she has used for years. 

Yet, sophisticated criminals came very close to taking $100,000 from her retirement savings.

Unbeknownst to Jane (not her real name), the fraudsters had gained access to her email account, intercepted a one-time password, and used this to gain access to her super and pension accounts.

Once inside, they opened several new accounts linked to her profile, positioning them to receive internal rollovers from her genuine super and pension balances. 

They then lodged a $100,000 withdrawal request from her pension account, directing it to a bank account she had never used. 

CFS' Fraud Management Team identified this unusual activity, stopped every pending payment, and worked directly with Jane to secure her details.

They helped her to place a block on her myGov account and connected her with IDCARE. 

During those follow-up conversations, Jane remembered a phone call weeks earlier from someone claiming to be from Microsoft, offering to help check her computer's security. She believes she may have granted them remote access.

In keeping with this year's Scam Awareness Week theme – No one's just a number – we’re sharing Jane’s story to help inspire more members to take proactive steps to avoid getting caught out by an account takeover or superannuation fraud. 

According to scam prevention website Scamwatch, 12,378 cases of account or identity takeover scams have been reported in Australia so far this year¹. 

And while the total number of cases appears to be trending lower than last year, average losses are greater.

Over the first eight months of 2026, losses of approximately $16.5 million were reported – which is 32% higher than the $12.5 million in losses reported for all of 2025¹. 

Account takeover fraud is when a criminal gains unauthorised access to a legitimate online account, then uses it as if they were the account holder, effectively impersonating them. 

In a super account takeover, that access is used to redirect payments, initiate rollovers to fraudulent accounts, or request lump-sum withdrawals. 

The Australian Signals Directorate has consistently identified credential-based attacks and business email compromise as among the most financially damaging categories of cybercrime affecting Australians.

Identity theft super account cases in Australia have grown in sophistication because superannuation is a uniquely attractive target. Balances are large, members may log in infrequently, and pension payments follow predictable patterns that a fraudster can quietly interrupt. 

The methods used in super account takeovers this year are refined, patient, and often involve multiple stages. 

Understanding the tactics is the first step to recognising them.

Remote access scam activity in Australia continues to feature prominently in Scamwatch reporting, and it is the tactic Jane appears to have encountered. 

These attacks succeed not because victims are careless, but because the callers are trained to sound legitimate and urgent.

Early detection matters. The sooner a customer spots something unusual, the sooner the Fraud Management Team, and the customer themselves, can act to protect a super account online.

Some signs your super account may be compromised may include:

• A login alert or OTP email you did not request.
• A new bank account added to your member profile that you do not recognise.
• Linked accounts or rollover requests you did not initiate.
• A change to the bank account receiving your pension payment.
• Difficulty accessing your myGov account, or notifications of a myGov account takeover attempt.
• Password reset emails you did not ask for.
• Your mobile suddenly showing no service, which can indicate a SIM swap.

If any of these appear, treat them as urgent. Contact CFS immediately and, if you suspect your identity has been compromised more broadly, contact IDCARE. 

CFS proactively monitors customer account activity to flag unusual events, engages with affected members, and provides clear information to help Australians protect their financial future.

Our dedicated Fraud Management Team watches for the patterns and anomalies that typically precede a super account takeover. 

In Jane's case, that monitoring is why the $100,000 withdrawal was stopped before it left her account. 

The team also plays an educational role, working one-on-one with affected members to help them secure their devices, review their personal information hygiene, and take the best next steps with agencies such as myGov and IDCARE.

To protect super account online access, a small number of practical steps make a significant difference.

1. Secure your email account first. Your email is the recovery point for almost every other account. Use a strong, unique password and enable multi-factor authentication.
2. Use a strong, unique password for FirstNet Investor. Do not reuse a password from another site. Consider a reputable password manager.
3. Enable multi-factor authentication wherever it is offered.
4. Never grant remote access to an unsolicited caller. Legitimate organisations, including Microsoft, banks, and CFS, will not phone you out of the blue and ask to control your computer.
5. Place a block on your myGov account if you suspect it has been accessed. myGov provides guidance on securing your account and reporting compromise.
6. Contact IDCARE on 1800 595 160. IDCARE is Australia and New Zealand's national identity and cyber support community, and can guide you through recovery.
7. Contact CFS immediately if you notice anything unusual on your super or pension account. The Fraud Management Team can review activity and act quickly.