Is this text or call from Westpac a scam?
No. Westpac is Australia's oldest bank, one of the big four, and entirely legitimate. That very familiarity is what criminals exploit: 'new device login' texts, fake transaction confirmations and code-harvesting messages wearing the Westpac name are a staple of Australian SMS scams. The good news: a few quick checks almost always tell a real Westpac message from a fake.
Genuine Westpac links lead to westpac.com.au — but a link can be made to look real, so don't go by the link alone. Below is exactly what a real Westpac message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
Westpac reported its scam-protection measures have helped scam losses fall 19% this year and saved customers from losing more than $300 million. Source: Westpac
What a real Westpac message looks like
Genuine SMS from Westpac typically arrive under the sender ID Westpac, and genuine links lead to westpac.com.au. Treat a link to any other address as a warning sign.
- Genuine Westpac SMS show the sender ID 'Westpac' — but scammers can spoof sender IDs, so judge the message, not the name it appears under
- A genuine Westpac email comes from an @westpac.com.au address, but addresses can be faked — don't rely on that alone; open the Westpac app or type westpac.com.au yourself
- Westpac states it won't send you a security code and then call to ask you to read it back — sharing a code is what lets a scammer in
- Westpac states it won't ask you to log in or validate your details through a link in an SMS or email — treat any such link as a scam
- A genuine Westpac alert won't push you to tap a link in an SMS or email — when in doubt, act only inside the Westpac app
What Westpac will never do
- Send you a security code and then call asking you to read it back (Westpac states it won't; sharing a code is what lets a scammer in)
- Ask you to log in or validate your details through a link in an SMS or email (Westpac states it won't)
- Push you to act through a link rather than inside the Westpac app
- Ask for your card PIN, or ask you to move money to a 'safe account'; no legitimate bank does either
Common Westpac scams
- SMS claiming a new device login or suspicious payment and urging the recipient to 'verify' via a link
- SMS styled as a transaction confirmation that asks the customer to reply with an SMS code or tap a link
- Messages pretending to be Westpac security alerts that threaten to lock the account unless action is taken immediately
Red flags to watch for
- Any unexpected link in an SMS or email — as a rule, treat links in bank texts as suspicious; don't tap them, type westpac.com.au yourself or use the app
- Sender asks for an SMS verification code or one-time password
- Urgent language about account lock, fraud, or immediate payment
- Sender ID looks similar to Westpac but includes extra characters or spaces
- Email address does not end in @westpac.com.au
Westpac scam examples
These composed examples show how scams impersonating Westpac typically read, with the tells that give each one away. Compare them against anything you've received.
Westpac: A sign-in from a new device in Melbourne was approved a few minutes ago. If this wasn't you, cancel the session now at westpac-device-check[.]example.
What gives it away:
- Westpac states it won't ask you to log in or validate details through a link in an SMS, so the link disqualifies the message on its own
- The city detail is set dressing to make the alert feel personal and urgent
- Sessions and devices can be checked inside the Westpac app; a genuine event would be visible there
Westpac: Payment of $1,260 to 'HARVEY N' is processing. To cancel, reply with the 6-digit security code we have just sent to this number.
What gives it away:
- Replying with a code hands the scammer the key; Westpac states it won't send a code and then ask you to give it back
- The invented payment exists to trigger panic; open the Westpac app and no such transaction will be there
- Real payment disputes happen in the app or on a call you make, never by texting a code to whoever messaged you
Subject: Security notice: your Westpac access will be locked. Dear Customer, unusual activity means your online banking will be suspended in 24 hours. Validate your details at westpac-secure-validate[.]example to keep your access.
What gives it away:
- Generic 'Dear Customer' greeting and a validation link, two things a genuine Westpac email won't combine
- The domain is a lookalike rather than westpac.com.au
- A countdown to suspension is the pressure lever; banks don't lock you out for ignoring an email
Not sure about your message?
Paste the suspicious Westpac text or email and get an instant scam verdict, free.
How to verify a message from Westpac
Westpac's real website is westpac.com.au and the official app is the Westpac app. Reach Westpac through those channels, never through the details inside a message you're unsure about.
- Don't tap the link, reply with anything, or read a code to anyone; step away from the message first
- Open the Westpac app, or type westpac.com.au into your browser yourself, and review your transactions and messages there
- Call Westpac using the number on the back of your card or in the Westpac app if you want a human to confirm it
- Cross-check the message against the scams Westpac describes on its how-to-report page (linked below)
If you have been scammed in Westpac's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- Ring Westpac first, on the number on the back of your card or in the Westpac app; the bank can lock the account, stop cards and attempt to claw back transfers, and early reports recover more
- Lock your cards in the Westpac app while you wait on the line
- After the account is secured, change your Westpac password and every other account sharing it
- If you shared identity documents such as a licence, passport or Medicare card, contact IDCARE (idcare.org) for free identity support
- Report to Scamwatch and ReportCyber using the links below, and forward the scam SMS to 7226 (spells SCAM)
Where to report a scam impersonating Westpac
Received — or fell for — a message impersonating Westpac? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Westpac scam alerts — Westpac's own page on current scams and how to report one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Latest Westpac scams in 2026
Westpac impersonations lean heavily on the code grab. A typical run opens with a new-device or suspicious-payment text, sometimes followed by a call in which a calm 'security officer' asks the victim to read back the SMS code that Westpac's real systems have just issued, which is the moment the account falls. Other strands stick to lookalike login links behind lock-out threats. Westpac reports its protections have driven customer losses down this year, but volume hasn't dried up. The reliable defence is a single rule applied without exception: codes are never spoken or typed anywhere except the official app or site you opened yourself.
Frequently asked questions
I got a text from Westpac with a link — is it a scam?
Westpac states it won't send an SMS asking you to log in or validate your details through a link. As a rule, treat any link in a bank text as suspicious — don't tap it; delete the message.
Westpac scam text asking for my code — what should I do?
Hang up or ignore the message. Westpac states it won't phone or text asking you to read back an SMS security code; report the message to Scamwatch at scamwatch.gov.au.
How do I know if a Westpac email is real?
A genuine Westpac email comes from @westpac.com.au, but addresses can be spoofed — don't judge by that alone. Don't tap links in the message; type westpac.com.au yourself or open the Westpac app.
Did Westpac really send this transaction alert?
Scammers can spoof the 'Westpac' sender ID, so a matching name doesn't prove a message is genuine — judge the content. If it contains a login link or asks for codes, treat it as fake and contact Westpac via the verified channels above.
What is Westpac's real website?
Westpac's only genuine website is westpac.com.au, and everyday banking is safest inside the Westpac app. Always type the address yourself; a link that merely contains the word Westpac can lead anywhere.
How do I report a Westpac scam?
Use Westpac's how-to-report page so the bank can shut the campaign down, report it to Scamwatch (scamwatch.gov.au), and forward scam texts to 7226 (spells SCAM). If money was taken, call Westpac first on the number on the back of your card, then lodge a report with ReportCyber (cyber.gov.au).
Related scam types
Scams impersonating Westpac usually fit one of these patterns. Learn how each works:
Related brands
Other bank names scammers impersonate — check a message from one:
Sources
- How to report fraud and scams (Westpac)
- Text or SMS scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
This guide is general information, not legal or financial advice — always verify with Westpac through an official channel.