Is this renewal notice from Medibank a scam?

Genuine messages from Medibank link to medibank.com.au, ahm.com.au. Treat a link to any other address as a warning sign.

• Medibank only sends SMS from short codes or named IDs that appear in the member's Medibank app or on their official statements.
• Genuine Medibank emails always come from an address ending in @medibank.com.au or @ahm.com.au.
• Medibank never sends a link asking a member to upload full identity documents or Medicare details.
• Any change to a policy or claim is first visible inside the logged-in Medibank or ahm member portal.
• Medibank contacts members about a data-breach verification process only after the member has already initiated contact via the official app or website.

What Medibank will never do

• Send a link asking a member to upload full identity documents or Medicare details
• Initiate data-breach verification out of the blue; Medibank only discusses such a process after the member has made contact via the official app or website
• Email members from any address that does not end in @medibank.com.au or @ahm.com.au
• Suspend benefits or cancel a policy through a message before the change is visible inside the logged-in Medibank or ahm member portal
• Ask for bank details or passwords by SMS or email link; no legitimate health insurer collects them that way

• Scammers send SMS claiming a Medibank data-breach review is required and include a link to a fake site such as medibank-secure-verify[.]example.
• Fraudsters impersonate ahm and ask recipients to 'confirm' personal or bank details after the 2022 Medibank breach.
• Emails pretend to be from Medibank Private and threaten policy cancellation unless identity documents are uploaded to a look-alike domain.

• A message asks for passport, driver's licence or Medicare details via an SMS or email link.
• The sender address uses a domain that is not medibank.com.au or ahm.com.au.
• The SMS contains a shortened URL or a domain containing words such as secure, verify or breach.
• The message creates urgency by saying benefits or claims will be suspended immediately.
• The contact appears from a full mobile number rather than a recognised short code or Medibank app notification.

These composed examples show how scams impersonating Medibank typically read, with the tells that give each one away. Compare them against anything you've received.

Medibank's real website is medibank.com.au and the official app is the My Medibank app. Reach Medibank through those channels, never through the details inside a message you're unsure about.

1. 1Do not click the link or upload anything through the message
2. 2Type medibank.com.au or ahm.com.au into your browser yourself, or open the Medibank or ahm app, and check your policy and messages there; any real change appears in the portal first
3. 3Check the sender: genuine Medibank email ends in @medibank.com.au or @ahm.com.au, and genuine SMS come from the short codes shown in the app and on statements
4. 4If the message claims a breach review you did not initiate, treat it as a scam and report it to Scamwatch (link below)

Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.

1. 1If bank or card details were entered, call your bank immediately to block the card and dispute any transactions
2. 2Change your Medibank or ahm password from a safe device via the real site, and change it anywhere you reused it
3. 3If you uploaded a licence, passport or Medicare details, contact IDCARE (idcare.org) straight away; identity documents are exactly what these campaigns are after
4. 4Monitor your member portal, bank accounts and credit report for activity you do not recognise
5. 5Report the scam to Scamwatch and ReportCyber using the links below, and forward the SMS to 7226 so carriers can block the sender

Received — or fell for — a message impersonating Medibank? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.

• Scamwatch — Report the scam to the ACCC's national scam service.
• ReportCyber — Report cybercrime and financial loss to the police.
• ACMA — Complain about scam texts and spam SMS, email or calls.
• Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
• IDCARE — Free identity and cyber support if your details were taken.

Impersonation campaigns against Medibank and ahm still lean hard on the 2022 data breach: texts announcing a compulsory 'breach review', emails threatening cancellation unless identity documents are uploaded, and lookalike verification portals whose addresses sprinkle in words like secure, verify or breach. The through-line is the demand for high-value identity material, licence, passport or Medicare details, delivered with an immediate-suspension threat. Medibank's stated position cuts through all of it: it never sends links asking for those documents, and breach verification only happens after you initiate contact. Check anything worrying inside the member portal or app you opened yourself.

• Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
• Account or identity takeover scams (Scamwatch (National Anti-Scam Centre))
• IDCARE: Australia's national identity and cyber support service (IDCARE)