Bank Impersonation Scams
Scammers pose as your bank's fraud team by phone or text — often spoofing the bank's real number or landing in the same SMS thread as genuine messages — to 'protect' your money. The goal is your login details, your one-time security codes, or convincing you to move funds to a so-called safe account. These are among the most financially devastating scams reported in Australia.
This guide explains how the scam works, the warning signs to watch for, and what to do if you've been caught out. Got a specific message in front of you? Check it now and get an instant verdict.
How this scam works
It starts with a hook: a text about a suspicious transaction, or a call from the 'fraud team' saying your account is under attack. Because sender IDs and caller numbers can be spoofed, the contact can appear to come from CommBank, NAB, ANZ or Westpac's real number — sometimes inside the same message thread as genuine bank texts. The 'fraud officer' sounds calm and professional, may know basic details about you, and manufactures urgency: your money must be moved right now, or you need to read out the one-time code just sent to your phone 'to verify it's you'. In reality, that code authorises the scammer's own transfer, and the 'safe account' belongs to them. Money moved by real-time transfer is extremely hard to claw back, which is why these scams cause some of the largest individual losses Scamwatch sees.
What the scam looks like
These composed examples show how the scam typically reads, with the tells that give each one away. Compare them against anything you've received.
NAB Alert: A payment of $1,280 to 'H NGUYEN' is pending from your account. If this was NOT you, cancel it immediately at nab-secure-check[.]example.
What gives it away:
- Banks don't send links in texts to log in; always type the bank's address yourself or open the official app
- A spoofed sender ID can land this in the same thread as genuine bank texts, so the thread proves nothing
- The invented pending payment exists to panic you into clicking before you think; a real alert asks you to confirm or deny in the app
A calm caller from your bank's 'fraud team' says your account is being drained right now. To protect your money you must transfer it to a 'safe account' they've set up, and read out the one-time code just texted to you 'to verify it's you'. They insist you stay on the line and tell no one.
What gives it away:
- No Australian bank ever asks for one-time codes or transfers to a 'safe account'; the code authorises the scammer's own transfer
- Pressure not to hang up, visit a branch or tell family is itself the giveaway; isolating you is a core scam tactic
- A spoofed caller ID showing the bank's real number proves nothing; hang up and dial the number on the back of your card
Your card has been temporarily locked due to unusual activity. Restore access at westpac-id-restore[.]invalid. Failure to verify within 2 hours will result in account suspension.
What gives it away:
- The domain is a lookalike, not the bank's official site
- The two-hour deadline is manufactured urgency; a genuinely locked card is fixed through the app or a call you make yourself
- Open your banking app directly: if there were a real problem, it would be visible there
Who gets targeted, and when
Anyone with an Australian bank account. The texts are mass-blasted, while the follow-up 'fraud team' calls often target people whose details have leaked in data breaches, which lets the caller sound convincing. Losses skew towards people with substantial savings, but the initial contact is indiscriminate: retirees, professionals and students all report the same scripts.
Bank impersonation runs all year, with bursts that follow major data breaches, when scammers hold fresh personal details to quote back at you. Waves also track the news cycle: publicity about a real bank outage, breach or fraud event gives the fake 'security team' a believable pretext for days afterwards.
How to spot it
- Anyone asking for your internet banking password, PIN or a one-time SMS code — no Australian bank ever asks for these, in any situation
- Requests to move money to a 'safe', 'holding' or 'audit' account — banks never do this; your money is already in your account
- Links in texts to log in to your bank — always type the address yourself (e.g. netbank.com.au, nab.com.au) or use the official app
- Pressure not to hang up, not to visit a branch, and not to tell family — isolating you is a core scam tactic
- Instructions to install remote-access software such as AnyDesk or TeamViewer
What to do if you have been targeted
- Hang up, then call your bank on the number from its official website or the back of your card — never a number the caller gave you
- If you shared codes or passwords, tell the bank immediately so it can freeze access and attempt to stop or recall transfers — the first hours matter most
- Change your internet banking password, plus any other account using the same password
- Report it to ReportCyber (cyber.gov.au) and Scamwatch (scamwatch.gov.au)
- If you're unhappy with how your bank handles the loss, you can complain to it formally and then escalate to the Australian Financial Complaints Authority (AFCA)
Where to report it
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
How to protect yourself
- Treat any request for a password, PIN or one-time code as the scam itself; no Australian bank asks for these
- Never log in to your bank through a link in a message; use the official app or type the address yourself
- If 'the bank' calls, hang up and dial back on the number from the back of your card, whatever the caller ID showed
- Refuse any request to move money to a 'safe', 'holding' or 'audit' account; your money is already in your account
- Never install remote-access software at a caller's request, and talk to family before acting on any urgent money call
Bank Impersonation Scams in 2026
Bank impersonation remains one of the most damaging scam categories Australians report, and the current playbook is layered: a spoofed text seeds the alarm, then a follow-up call from the 'fraud team' does the real work. Campaigns rotate through the major banks' names and increasingly quote leaked personal details to sound legitimate, while the ask stays constant: read out a code, log in through our link, or move funds to a safe account. Each of those requests is the scam. The defence that survives every variant is to hang up and call the bank yourself on the number on the back of your card.
Related brands targeted by this scam
Scammers often impersonate these names in bank impersonation scams. Here's how to tell a genuine message from a fake:
Check a suspicious message now
Paste the text or email you're unsure about and get an instant verdict — bank impersonation scams included, free.
Frequently asked questions
The call came from my bank's real phone number. How can it be a scam?
Caller ID can be faked — scammers routinely spoof banks' published numbers, so the number on your screen proves nothing. The reliable test is what's asked of you: a genuine bank will never ask for passwords, one-time codes, or transfers to another account. When in doubt, hang up and dial the bank yourself using the number on the back of your card.
My bank does send fraud alerts. How do I tell a real one from a fake?
Real fraud alerts ask you to confirm or deny a transaction — usually in the bank's app — and never include login links or ask you to reply with codes. A fake alert pushes you to a link or a phone call where someone asks for your credentials. Open your banking app yourself: if there's a genuine issue, it will be visible there.
I read out a one-time code to a caller. What should I do right now?
Call your bank immediately on its official number — that code may have authorised a payment or a device registration on your account. The bank can freeze access and try to stop or recall transfers, and speed makes the difference. Then change your banking password and report the scam to Scamwatch and ReportCyber.
Can I get my money back after a bank impersonation scam?
Sometimes, but it depends heavily on speed and how the money was taken. Banks can attempt to recall transfers, and funds are occasionally frozen at the receiving end if reported within hours. Unauthorised card charges are often recoverable through disputes. Report to your bank the moment you suspect a scam, and if you believe it mishandled your case, escalate to AFCA.
Why did the scammer know my name and details?
Personal details leak through data breaches and are bought and sold by scammers, who use them to sound credible. Knowing your name, address or even part of your account number doesn't make a caller your bank. Judge the request, not the knowledge: a demand for codes, passwords or transfers is always a scam.
How do I report a bank impersonation text or call?
Tell your bank first through its official number or app, especially if you shared anything or moved money. Then forward scam texts to 7226 (spells SCAM) so carriers can block the sender, and report the scam to Scamwatch at scamwatch.gov.au. If you lost money, also report it to ReportCyber at cyber.gov.au.
Related scam types
Other scams hitting Australians right now — know the warning signs:
Sources
- Phone scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams (Scamwatch (National Anti-Scam Centre))
- Text or SMS scams (Scamwatch (National Anti-Scam Centre))
This guide is general information, not legal or financial advice — if you've lost money, contact your bank and the reporting channels above straight away.