Is this text or call from Commonwealth Bank a scam?
No. Commonwealth Bank (CommBank) is Australia's largest bank and a legitimate, ASX-listed company. The real risk runs the other way: scammers impersonate CommBank in fake texts, emails and phone calls, because a bank alert is the message Australians act on fastest. The good news: a few quick checks almost always tell a real Commonwealth Bank message from a fake.
Genuine Commonwealth Bank links lead to commbank.com.au, netbank.com.au — but a link can be made to look real, so don't go by the link alone. Below is exactly what a real Commonwealth Bank message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
Commonwealth Bank reported a 76% drop in customer scam losses since their peak (the second half of FY25 versus the first half of FY23). Source: CommBank Newsroom
What a real Commonwealth Bank message looks like
Genuine SMS from Commonwealth Bank typically arrive under the sender ID CommBank or CBA, and genuine links lead to commbank.com.au, netbank.com.au. Treat a link to any other address as a warning sign.
- Genuine SMS show the sender ID 'CommBank' or 'CBA' — though scammers can spoof these, so judge the content, not just the sender name
- Real fraud alerts ask you to confirm or deny a transaction in the CommBank app — they don't link you to a login page
- Online banking lives only at netbank.com.au and commbank.com.au
- Genuine messages address you by name and never ask you to 'verify your identity' through a link
What Commonwealth Bank will never do
- Ask for your NetBank Client ID, password or a NetCode SMS code, by phone, SMS or email (CommBank states it won't, and no bank asks for your card PIN)
- Ask you to transfer money to a 'safe', 'holding' or 'audit' account (no Australian bank does; the request itself is the scam)
- Send an SMS link to log in to NetBank (type netbank.com.au yourself or use the CommBank app)
- Ask you to install remote-access software like AnyDesk or TeamViewer
- Threaten to freeze your account within minutes unless you act on a link
Common Commonwealth Bank scams
- 'Unusual transaction' or 'account locked' texts linking to a fake NetBank-style login page that steals your credentials
- Calls from a fake 'CommBank fraud team' — often spoofing the bank's real number — asking you to read out NetCode SMS codes or move money to a 'safe account'
- Sender-ID spoofed texts that land in the same message thread as genuine CommBank messages, borrowing their credibility
- Phishing emails about new statements, rewards or cashback that link to credential-harvesting pages
Red flags to watch for
- Anyone asking for your NetBank Client ID, password or a NetCode SMS code — CommBank states it won't
- Requests to transfer funds to a 'safe', 'holding' or 'audit' account — always a scam
- Links in SMS to log in to NetBank — always type netbank.com.au yourself or use the CommBank app
- Pressure and urgency, such as 'your account will be frozen in 30 minutes'
- A caller asking you to install remote-access software like AnyDesk or TeamViewer
Commonwealth Bank scam examples
These composed examples show how scams impersonating Commonwealth Bank typically read, with the tells that give each one away. Compare them against anything you've received.
CommBank Alert: A payment of $1,847.00 to 'EBAY AU PTY' is pending on your account. If this was NOT you, verify your identity immediately at netbank-secure-verify[.]example or your account will be suspended.
What gives it away:
- The link is not commbank.com.au or netbank.com.au; real CommBank fraud alerts ask you to confirm or deny the payment inside the CommBank app, not through a login link
- It manufactures urgency with an account-suspension threat, the classic pressure play
- It invents a specific dollar figure and merchant to make you panic before you think
A caller says they are 'the CommBank fraud team', your account has been compromised, and you must move your savings to a 'safe account' right now. To 'confirm your identity' they ask you to read out the NetCode SMS that has just arrived on your phone.
What gives it away:
- No Australian bank asks you to move money to a 'safe account'; your money is already in your account, and the request itself is the scam
- The NetCode they ask you to read out is the code authorising THEIR transfer out of your account
- A familiar caller ID proves nothing; scammers can spoof the bank's real number. Hang up and call back on 13 2221 or the number on the back of your card
Subject: Your NetBank statement is ready. Dear Customer, your latest statement could not be delivered. Sign in at commbank-statements[.]example within 24 hours to restore access to your account documents.
What gives it away:
- Generic 'Dear Customer' greeting where a real bank email uses your name
- The link leads to a lookalike domain, not commbank.com.au; a statement notice never needs a deadline
- Statements live inside NetBank and the CommBank app; nothing is lost by ignoring the email and checking there yourself
Not sure about your message?
Paste the suspicious Commonwealth Bank text or email and get an instant scam verdict, free.
How to verify a message from Commonwealth Bank
Commonwealth Bank's real website is commbank.com.au and its listed phone number is 13 2221; the official app is the CommBank app. Reach Commonwealth Bank through those channels, never through the details inside a message you're unsure about.
- Don't tap the link, reply, or call any number inside the message itself
- Open the CommBank app, or type netbank.com.au into your browser yourself, and check your messages and transactions there; a genuine alert will be waiting inside
- If you're still unsure, call CommBank on 13 2221 (general personal banking) or the number on the back of your card and ask whether the message is real
- Compare the message against the current hoaxes CommBank lists on its report-a-scam page (linked below)
If you have been scammed in Commonwealth Bank's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- Call CommBank immediately on 13 2221 or the number on the back of your card; the bank can lock your account, block transfers and attempt to recover funds, and the first hours matter most
- Lock your cards in the CommBank app while you wait to get through
- Change your NetBank password once the account is secured, and change it anywhere else you reused it
- If you shared identity documents (licence, passport, Medicare), contact IDCARE (idcare.org) for free identity support
- Report the scam to Scamwatch and ReportCyber using the links below, and forward the scam SMS to 7226 so carriers can block the sender
Where to report a scam impersonating Commonwealth Bank
Received — or fell for — a message impersonating Commonwealth Bank? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Commonwealth Bank scam alerts — Commonwealth Bank's own page on current scams and how to report one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Latest Commonwealth Bank scams in 2026
Bank impersonation remains one of Australia's most reported scam types in 2026, and CommBank, as the country's largest bank, is a constant target. Current campaigns lean on sender-ID spoofing, so a fake text can land in the same thread as your genuine CommBank messages, and on hybrid attacks where a text is followed by a call from the 'fraud team' to walk you through the theft. The one habit that defeats all of them: never act through the message. Open the CommBank app or call 13 2221 yourself, and treat any request for a NetCode or a 'safe account' transfer as the scam itself.
Frequently asked questions
I got a text from CommBank about a suspicious transaction. Is it genuine?
Treat it as suspicious until verified. Real CommBank fraud alerts ask you to confirm or deny a transaction inside the CommBank app — they don't send links to log in or 'verify your identity'. Don't tap anything: open the app yourself or call CommBank using the number on the back of your card to check.
The text appeared in the same thread as real CommBank messages. Doesn't that prove it's real?
No. Scammers can spoof the 'CommBank' sender ID, which makes their text land in the same conversation thread as genuine messages. Thread position proves nothing — judge the content. Any message with a login link or a request for codes is a scam, wherever it appears.
What is CommBank's real phone number and website?
CommBank's general personal banking number is 13 2221, and its only real websites are commbank.com.au and netbank.com.au. For anything account-related, the safest habits are the CommBank app, typing netbank.com.au yourself, or the number printed on the back of your card. Never trust a number or link supplied by the message you are trying to check.
What should I do if I gave a scammer my NetBank details or a NetCode?
Call CommBank immediately using the number on the back of your card or in the CommBank app — they can lock your account, block transfers and attempt to recover funds, and the first hours matter most. Then change your NetBank password, report the scam to Scamwatch (scamwatch.gov.au) and ReportCyber (cyber.gov.au).
Would CommBank ever ask me to move my money to keep it safe?
No — and no Australian bank asks customers to transfer money to a 'safe account'. Your money is already in your account, and that request, however convincing the caller sounds, is the signature of a bank impersonation scam. Hang up and call CommBank using the number on the back of your card.
How do I report a CommBank scam text or email?
Three places, all free: report it through CommBank's own report-a-scam page so the bank can act on the campaign, report it to Scamwatch (scamwatch.gov.au) so the National Anti-Scam Centre can track it, and forward the SMS to 7226 (spells SCAM) so carriers can block the sender. If you lost money, also report to ReportCyber (cyber.gov.au) and call the bank first.
Related scam types
Scams impersonating Commonwealth Bank usually fit one of these patterns. Learn how each works:
Related brands
Other bank names scammers impersonate — check a message from one:
Sources
- How to report a scam or hoax (Commonwealth Bank)
- Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
- CommBank customer scam losses fall (Commonwealth Bank)
This guide is general information, not legal or financial advice — always verify with Commonwealth Bank through an official channel.