Is this renewal notice from Medibank a scam?
Insurers like Medibank are impersonated with fake refund, renewal and claim messages. A text, email or renewal notice that looks like it's from Medibank can be genuine — but it can just as easily be a scam built to look identical. The good news: a few quick checks almost always tell a real Medibank message from a fake.
Genuine Medibank links only ever go to medibank.com.au, ahm.com.au. Below is exactly what a real Medibank message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real Medibank message looks like
Genuine messages from Medibank only ever link to medibank.com.au, ahm.com.au.
- Medibank only sends SMS from short codes or named IDs that appear in the member's Medibank app or on their official statements.
- Genuine Medibank emails always come from an address ending in @medibank.com.au or @ahm.com.au.
- Medibank never sends a link asking a member to upload full identity documents or Medicare details.
- Any change to a policy or claim is first visible inside the logged-in Medibank or ahm member portal.
- Medibank contacts members about a data-breach verification process only after the member has already initiated contact via the official app or website.
Crucially, Medibank will never text you a link to claim a premium 'refund', or ask for card details to process one.
Common Medibank scams
- Scammers send SMS claiming a Medibank data-breach review is required and include a link to a fake site such as medibank-secure-verify.com.
- Fraudsters impersonate ahm and ask recipients to 'confirm' personal or bank details after the 2022 Medibank breach.
- Emails pretend to be from Medibank Private and threaten policy cancellation unless identity documents are uploaded to a look-alike domain.
Red flags to watch for
- A message asks for passport, driver's licence or Medicare details via an SMS or email link.
- The sender address uses a domain that is not medibank.com.au or ahm.com.au.
- The SMS contains a shortened URL or a domain containing words such as secure, verify or breach.
- The message creates urgency by saying benefits or claims will be suspended immediately.
- The contact appears from a full mobile number rather than a recognised short code or Medibank app notification.
Scam text examples
Here's a real example of a scam message impersonating Medibank, with the tell-tale red flags highlighted. Compare it against anything you've received.
Medibank: Due to the recent breach we need you to verify your identity immediately. Upload your documents here: medibank-secure-verify.com before your cover is paused.
What gives it away:
- A message asks for passport, driver's licence or Medicare details via an SMS or email link.
- The sender address uses a domain that is not medibank.com.au or ahm.com.au.
- The SMS contains a shortened URL or a domain containing words such as secure, verify or breach.
- The message creates urgency by saying benefits or claims will be suspended immediately.
- The contact appears from a full mobile number rather than a recognised short code or Medibank app notification.
Not sure about your message?
Paste the suspicious Medibank text or email and get an instant scam verdict, free.
How to verify a message from Medibank
- Log in directly at medibank.com.au or ahm.com.au by typing the address yourself
- Use the official Medibank or ahm mobile app to check messages and claims
Where to report a scam impersonating Medibank
Received — or fell for — a message impersonating Medibank? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Report scam texts and spam SMS or calls.
- Forward to 7226 (SPAM) — Forward the scam SMS to short code 7226 so your carrier can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Frequently asked questions
I got a text from Medibank asking for ID documents after the breach — is it a scam?
Yes. Medibank never requests full identity documents via SMS links; delete the message and report it at scamwatch.gov.au.
How do I know if an email claiming to be from Medibank Private is real?
Check that the sender address ends exactly in @medibank.com.au or @ahm.com.au and never click links; instead log in via the official app or by typing medibank.com.au yourself.
What should I do if I clicked a link in a fake Medibank message?
Change your Medibank password from a safe device, monitor your accounts, and contact IDCARE on 1300 432 273 or visit cyber.gov.au for guidance.
Related scam types
Scams impersonating Medibank usually fit one of these patterns. Learn how each works:
Related brands
Other insurance names scammers impersonate — check a message from one:
This guide is general information, not legal or financial advice — always verify with Medibank through an official channel.