How to report a scam in Australia — and try to get your money back

This is the only step that has a realistic chance of getting money back, and it is time-critical. Call the fraud line — not the general enquiries number — and say clearly that you have been scammed and want the payment recalled or traced, and the account secured.

Ask specifically for four things: an attempted recall of the payment, a block on further payments to that payee, a freeze or review of the account if credentials were shared, and a written complaint reference number. Write the reference down.

If you gave anyone remote access to your device — through AnyDesk, TeamViewer or similar — say so, because the bank will treat the account as compromised rather than treating the single payment as the problem.

If you paid by card rather than by bank transfer, ask about a chargeback. Card payments have a formal dispute mechanism that direct transfers do not, which is one reason paying strangers by card is safer than paying by transfer.

ReportCyber, run through the Australian Cyber Security Centre, is the national police reporting channel for cybercrime, online fraud and identity crime. Reports are referred to the relevant state or territory police.

The practical value is the reference number. Banks, insurers, telcos and credit reporting bodies frequently ask for one before they will act on a fraud claim, and having it removes a round of argument.

Be realistic about the outcome. The overwhelming majority of online scams are run from outside Australia, and individual reports rarely result in a prosecution. That is not a reason to skip it — the report is what makes the rest of the system move.

Scamwatch is run by the National Anti-Scam Centre within the ACCC. It does not investigate individual cases and cannot recover your money, and it says so plainly.

What it does is aggregate. Reports feed pattern detection, takedown requests to platforms and domain registrars, disruption work with banks and telcos, and the public warnings that stop the next person. A scam reported by two hundred people gets acted on in a way a scam reported by one does not.

Report even if you lost nothing. Attempted scams are useful data, and the report takes a few minutes.

If you sent a photograph of your driver licence, passport, Medicare card or birth certificate, or if you gave enough personal detail for someone to impersonate you, the problem is larger than the payment.

IDCARE is a free, government-funded national identity and cyber support service. Case managers build you a specific response plan: which documents to replace, which credit bodies to notify, which agencies to alert, in what order.

Separately, place a ban on your credit report with all three credit reporting bodies — Equifax, Experian and illion. A ban stops new credit being opened in your name, is free, and lasts 21 days initially with extensions available. Doing this with all three matters, because lenders use different ones.

Some identity documents can be reissued with a new number after fraud — driver licences in most states, Medicare cards, and passports. Ask each issuer specifically about a fraud reissue rather than a routine replacement.

Banks are required to have an internal dispute resolution process and to respond within set timeframes. If you are not satisfied with the outcome, or they do not respond in time, you can take the complaint to the Australian Financial Complaints Authority.

AFCA is free to consumers, funded by the financial firms, and its determinations bind the firm but not you — if you reject the outcome you keep your right to go to court. That asymmetry is why complaints that stalled internally often resolve quickly once AFCA is involved.

The Scams Prevention Framework legislated in 2025 places specific obligations on banks, telecommunications providers and digital platforms to prevent, detect, disrupt and respond to scams, with a dispute pathway for consumers. The detail is being rolled out through sector-specific codes, so what a bank owes you is a live and improving area — worth asking about directly.

For scam calls and texts, complaints about a telco's handling go to the Telecommunications Industry Ombudsman on 1800 062 058.

Change passwords on any account that shared a password with a compromised one, starting with your email — email is the recovery route for everything else, so it is the account an attacker wants most.

Turn on two-factor authentication everywhere it is offered, preferring an authenticator app over SMS. SMS codes can be intercepted through SIM-swap fraud, which is a documented and growing attack in Australia.

Ask your mobile provider to put a port-out lock or additional security on the number. A stolen phone number defeats SMS-based security everywhere at once.

If the scam involved a romance or a long relationship, or if the loss was large, the psychological impact is real and Lifeline on 13 11 14 and Beyond Blue on 1300 22 4636 are appropriate calls to make.