Impersonation scams in Australia: How to stay secure

The approach: Earlier this year, a CFS customer – who we'll call Michael to protect the customer's privacy – received a call from a someone claiming to represent a major technology brand, who told him an unauthorised transaction of $350 had been processed against the customer's account¹. Michael was transferred to a ‘supervisor’ and then to an individual claiming to be a government official.

The hook: These scammers convinced Michael he was assisting authorities with a confidential investigation. They instructed Michael to withdraw and transfer funds as part of a government ‘sting’ operation designed to identify and apprehend offenders.

The urgency: The scammers used intimidation including threats of police action to manipulate Michael into complying with their instructions.

The ask: Acting on their instructions, Michael called the CFS contact centre and requested a withdrawal of $170,000 from his super account, advising that the funds were required to help his son purchase a property. The withdrawal was processed and paid to the customer's existing nominated bank account.

Michael then attempted to move funds through multiple channels, including a Western Union transfer, deposits into a Bitcoin ATM and the purchase of gift cards.

The exit: Michael’s suspicions were only raised when Western Union questioned the transfer he was attempting to make. His financial adviser later contacted CFS with concerns that Michael had been the victim of a scam.

The outcome: Through recovery efforts, $140,000 of the withdrawn funds were successfully recovered and returned to the customer’s super account.

These events resulted in a net loss of $30,000 from Michael’s super. They also caused Michael considerable emotional trauma.

Unfortunately, Michael is not alone in being taken in by a convincing scammer. Impersonation scams are fairly common in Australia in 2026, and scammers are often very good at telling their cover story.

They may pose as trusted organisations – such as government agencies, banks, technology companies and more – in order to steal your personal information or gain access to your accounts to steal your money.

In the first six months of this year, 5,262 reports of bank impersonation scams alone were made to Scamwatch, with associated losses totalling more than $3.2 million².

The techniques scammers use to appear legitimate are becoming increasingly sophisticated, and may include:

• AI-generated voice cloning that can sound like a family member,
• cloned websites that copy the layout and branding of legitimate institutions, and
• fake entries that may appear at the top of sponsored search results online.

A call from a scammer may feel real because the scammer already knows something about you.

Details harvested from past data breaches including names, dates of birth, employer details and even partial account numbers, help scammers to provide information you wouldn’t expect them to know.

Knowing what to look for can help you spot a scam before it causes harm.

Impersonation scams in Australia include some recognisable categories. Common Australian examples include:

• scam calls from companies reporting fake unauthorised payments,
• ATO scam calls demanding immediate tax payments,
• myGov SMS phishing scams with fake login links,
• bank 'fraud alert' impersonation scams urging you to transfer funds to a 'safe account'.

They may use different channels to approach you, and different cover stories, but the underlying goal is the same: to pressure you into handing over or transferring money, revealing personal information, or providing access to your account before you have time to verify who you are really speaking with.

Below are some common varieties of impersonation scams active in Australia in 2026, the channels they often use, claims they may make, and some of the signs to watch for. 

The cover stories may change, but some common tactics emerge repeatedly in impersonation scams reported in Australia:

• Urgency such as such threats of arrest, account closure, or loss of benefits unless you act within minutes.
• Requests for remote device access through screen-sharing software you did not install yourself.
• Unsolicited contact asking for personal or account details.
• Requests for one-time passwords or multi-factor authentication codes, which no legitimate organisation will ever ask you to read out.
• Links sent via SMS or email that lead to a login page or request a one-time code.
• Requests to move money or super to a 'safe account', which is never a genuine process.
• Caller ID that appears genuine but the caller cannot verify account details you did not share.

If you notice any of these, pause the conversation. A legitimate caller will not object to you ending the call and ringing back on an official number.

October 2026 is Cyber Security Action Month in Australia, previously known as Cyber Security Awareness Month. This year's theme is 'Take a second. Stay secure' – with the goal of encouraging you to take four steps now to help protect yourself not only this month, but year-round.

Each step is simple, takes only a few minutes and can help reduce your risk of becoming a scam victim.

Software updates patch the security vulnerabilities that scammers exploit. Devices running outdated operating systems, browsers, or apps are far more exposed to malware, phishing kits, and account-takeover tools. Set your phone, tablet, and computer to install updates automatically where possible, and restart devices promptly when an update is pending. The same principle applies to the apps you use for banking, super, and email, where delayed updates can leave known weaknesses open for weeks.

A passphrase is a sequence of four or more random words strung together, such as 'blue kettle morning river'. It is longer, more memorable, and far harder to crack than a short password with symbols. Reusing passwords is one of the most common reasons accounts are compromised: if one site is breached, scammers try the same credentials on your email, bank, and super portal through automated credential stuffing. A reputable password manager helps you generate and store a unique passphrase for every account, including your FirstNet login.

Multi-factor authentication, often shortened to MFA, requires a second piece of evidence in addition to your password, such as a code from an authenticator app or a prompt on your phone. Even if a scammer obtains your password, MFA adds a barrier that is harder to breach. It’s worth enabling MFA on every financial account you hold. Where you have the choice, an authenticator app is more secure than SMS-based codes, because SMS can be intercepted through SIM-swap attacks.

Reporting matters. It helps authorities detect patterns, warn the public, and disrupt scam infrastructure before more people are affected. Report scams to Scamwatch and to the Australian Signals Directorate's ReportCyber service.

If you suspect your CFS account may have been affected, contact us directly rather than clicking on any link in an unsolicited message. 

CFS applies multi-factor authentication on the FirstNet member portal, uses secure communications for sensitive transactions, and provides members with technical security help on FirstNet to support safe account use.

Keeping your contact details current is an important part of this, because genuine alerts, verification messages, and account notifications rely on the mobile number and email address you have registered. Confirm your details

You can also review how we handle personal information in our privacy policy, and complete identity verification securely when joining CFS to help protect your account from the outset.