This is a practical guide to how the most common Australian scams actually work — and what to do if you've already been caught.
No signup. No tracking. Nothing you read here is reported back to us. Written because this information should be easier to find than it is.
Every scam — every single one — depends on you making a decision faster than you would normally make it. Urgency is the delivery mechanism. The story changes constantly; the pressure to act now does not.
If you take nothing else from this page: the moment someone tells you there's no time to check, you are being scammed. Genuine institutions never work that way. Your bank has procedures. The ATO has timeframes. Police have processes. Nobody legitimate needs you to decide in the next four minutes.
Every scam needs you to act before you think. "Your account will be closed in two hours." "This offer expires today." "There's a warrant out." Real institutions never pressure you this way, because they have procedures and timeframes you can verify.
If someone calls claiming to be from your bank, the ATO, Telstra, or anyone else — hang up. Look up the number independently, and call them back. Never use a number the caller gives you. Never let them "transfer you."
Your bank will never call and ask for your password, PIN or a code. The ATO will never ask for your tax file number over the phone. No legitimate organisation asks you to confirm information they should already have.
There is no legitimate reason for any government body, bank, or utility company to ask you to pay in Bitcoin, gift cards, or by transferring money to a "safe account." If this is the instruction, stop. It is a scam — every time, without exception.
This deserves its own warning because it's now the single largest scam category by dollar loss in Australia. Someone claiming to be from your bank says your account has been compromised, and you need to move your money to a "safe account" while they investigate. There is no such thing as a safe account. Banks never ask you to move money to protect it. The account is the scammer's. Once transferred, the money is gone.
Scammers use VoIP services to display any number they want on your caller ID. It can show your own bank's real number. It can show the ATO's. It can show your local police station. The number on your screen means nothing.
They usually work in teams. One person keeps you talking, another sends convincing-looking emails or SMS while you're on the call, and a third handles "escalation" if you become suspicious. Sometimes they play hold music and "transfer" you to a supervisor — all fabricated.
The "from" address in an email is trivially easy to fake. Anyone can send an email that appears to come from [email protected]. Spoofing the display name is even easier — it can say "Commonwealth Bank" while the actual address is gibberish.
Modern phishing is sophisticated. Fake login pages are pixel-perfect copies of the real thing. Emails include your real name, real account details, and reference recent transactions — because your data was in a breach somewhere and is now being used against you.
The most damaging banking scams don't involve hacking anything. They involve convincing you to transfer money voluntarily — to an account that isn't who you think it is. Once you authorise a transfer, you've told your bank the payment was legitimate, and recovery becomes very difficult.
The most common variants: a scammer impersonating a supplier and sending "updated bank details", a fake invoice arriving for a service you actually use, a caller claiming to be your bank asking you to "test" a transfer, or a fake investment platform that lets you see your "returns" growing before you try to withdraw.
Two directions. Fake sellers list items they don't have — high-value items especially, cars, phones, tools, pets — and take deposits before disappearing. Fake buyers target people selling, and use a range of tricks to extract money or goods without paying.
Common buyer-side tricks: overpaying by "accident" and requesting the difference refunded, sending fake payment confirmation screenshots, using a fake escrow service, or asking you to pay a courier to release funds.
The most sophisticated scams in Australia right now. A fake trading platform shows you real-looking charts, real-looking returns, and a real-looking dashboard. You invest small amounts, withdraw small amounts successfully, and start to trust it. Then you invest seriously. Then the withdrawal stops working — and there's always one more fee or tax to pay before you can access your money.
The "pig butchering" variant is worse. A relationship is built over weeks or months — romantic, friendly, professional — before the investment opportunity is mentioned. The victim trusts the person, not the platform. Losses in the tens or hundreds of thousands are common.
Superannuation is a large pool of money that many people don't pay close attention to, which makes it a target. Common scams involve cold calls offering to "find your lost super", "review your insurance", or switch your fund to one with better returns — all of which end with your money moved somewhere it can be harvested through fees.
Insurance scams often involve fake refunds. A caller claims you've been overcharged on your premiums and can arrange a refund — they just need your bank details first. Or they offer to "consolidate" your insurance into a cheaper policy that doesn't actually exist.
Businesses lose more to payment fraud than individuals, because the amounts are larger and there are fewer protections. The single most common attack is invoice redirection — a scammer intercepts an email chain between your business and a supplier, or spoofs the supplier's address, and sends an updated invoice with new bank details.
A more targeted variant uses email compromise. If a scammer gets into a director's email account (or spoofs it convincingly), they can send instructions that look entirely internal — a payment to a new supplier, a change to banking details, a transfer that "needs to happen today".
Business payment fraud often involves an entity that's already been flagged elsewhere. If you want a business verified before you pay, this is exactly what our due diligence service is for — see the link at the bottom of the page.
Your information has almost certainly been in at least one breach. That's not a personal failing — it's the reality of living in a connected world. What matters is what scammers can do with it, and how quickly you can limit the damage.
Identity theft usually starts with small pieces of information — your name, address, date of birth, and one account number. From there, someone can open accounts in your name, access services, or impersonate you to your existing providers. The damage is often financial, but it can also affect your credit file for years.
Usually on dating apps, Facebook, or Instagram. A profile makes contact — often attractive, often slightly too available, often with a plausible reason for being overseas (military, oil rig, overseas contract). The relationship builds over weeks or months, through messages, then calls, then video.
Eventually there's a crisis — a medical emergency, customs detention, a business problem, a "can't access my funds" situation. Or an opportunity — a guaranteed investment, a short-term loan that will be repaid with interest. Either way, money is requested.
Read this in order. The first hour matters more than everything else on this page combined. Speed beats shame — do the practical things first, and deal with the emotional side after.
Most people don't report because they think nothing will come of it — and often, individually, nothing does. Your money probably won't come back. The scammer probably won't be arrested.
But every report feeds into a national picture. It's how a scam number gets taken down. It's how a fake website gets removed. It's how a bank is forced to change its processes. It's how the ACCC learns which scams are growing and where to direct enforcement.
Reporting is not for you. It's for the next person. It takes five minutes and it's one of the few things you can do that has a chance of protecting someone else from the same thing.
That instinct is usually worth listening to. Sentinel investigates companies, suppliers and individuals before you commit — registry history, ownership, digital footprint, and the record of how they've treated people before you.
See how we work →