Spotting scams

Crypto scams cost Australians millions each year. Unlike a bank transfer, blockchain transactions are usually permanent—once your coins are sent, they're gone for good. The ATO and ASIC warn that scammers are becoming more convincing, so knowing what to look for is your first line of defence.

Most crypto scams follow predictable patterns. A stranger on social media, a fake exchange website, or even someone posing as a support agent asks you to send coins to an address or wallet. They might promise quick profits, claim you've won a giveaway, or say your account is locked and needs urgent action. By the time you realise something's wrong, your funds have moved to an address you don't control.

Common red flags. Be sceptical of anyone promising fast returns or pressuring you to act immediately. Legitimate exchanges and projects never ask you to send crypto to a personal wallet address or share your seed phrase. If a website looks almost identical to a real exchange but the URL is slightly different, it's probably fake—scammers register lookalike domains and copy entire websites.

Impersonation is common too. A scammer might create a social media account that mimics a real company, using the same profile picture and similar handle. They'll reply to your posts or send direct messages. Always verify accounts directly through the official website or app, never click links from messages.

Checks that protect you. Before sending any crypto, verify the recipient address independently. If someone claims to be from an exchange, log into your account directly (don't click their link) and check for any notification there. Use a small test transaction first if you're moving coins to a new wallet—send a tiny amount and confirm it arrives before sending larger sums.

Register your crypto accounts with AUSTRAC if required, and use exchanges that comply with Australian law. Check ASIC's list of unlicensed financial services and warn others about suspicious websites. If you've lost money, report it to the ATO (for tax purposes) and the Australian Cyber Security Centre.

If it has already happened

Prevention is most of this lesson. If you are reading it because money has already gone, the next few hours matter more than anything else. Blockchain transactions cannot be reversed — but the money usually has to pass through the ordinary banking system to be useful to a scammer, and that part can sometimes be stopped.

Stop all contact immediately. Send nothing more, and do not tell them you have worked it out. Call your bank on the number printed on your card — never a number the scammer gave you — and say the word "scam"; Australian banks can sometimes recall or hold a recent transfer if they hear about it quickly. Tell your exchange as well: they can flag the receiving address, and they need to know if your account itself was accessed. If you shared your seed phrase, move whatever remains to a brand-new wallet before anything else, because that phrase hands over permanent access and changing your password does nothing.

Who to report it to

There is no single number, because each body does a different job:

Your bank or credit union — first, and immediately. They are the only ones who can act on the money itself.
ReportCyber, at cyber.gov.au — the police-facing channel for cybercrime. Your report is routed to the relevant state or territory police.
Scamwatch, run by the National Anti-Scam Centre — this is what warns other people and builds the picture of a campaign, even when your own money cannot be recovered.
IDCARE, on 1800 595 160 — free, and the right call if you handed over identity documents rather than only money.
AFCA, the Australian Financial Complaints Authority — if you are unhappy with how your bank handled it.

Report even when the amount feels too small, or too embarrassing, to bother with. Reports are how patterns get spotted and how the next person gets a warning.