Where to report scams and cybercrime in Australia

How to report a scam in Australia depends on what happened. Scams can be reported to Scamwatch at scamwatch.gov.au, cybercrime reports for police go through ReportCyber at cyber.gov.au, and Scamwatch says to contact your bank or card provider straight away if money is involved. There are several other official services for scams and cybercrime, and each handles something different. Reporting to one doesn’t automatically notify the others. This page is a directory: it lists each service and what that service says it handles. CyberThreats.au is an independent education website, not a government service, so we can’t take reports, investigate scams or assess what happened to you. These services can.

At a glance

Your bank or card provider

When money is involved, Scamwatch’s first step is to act fast: contact your bank or card provider and ask it to stop any transactions. The ACSC’s email guidance says to use the bank’s official phone number. The ACSC also notes that a bank may be able to freeze accounts or cards, or stop a transaction, if financial details were stolen.

Scamwatch

Scamwatch is run by the National Anti-Scam Centre, part of the Australian Competition and Consumer Commission (ACCC). Scamwatch says reports help it stop scammers and warn others, that the National Anti-Scam Centre uses reports to monitor trends, and that with consent it can work with organisations to remove scam websites, ads and contact details. Its report form is at scamwatch.gov.au/report-a-scam. Scamwatch also says it can help connect people with IDCARE. For scam texts, our phishing guide explains how to report a scam text.

ReportCyber and the Australian Cyber Security Centre

ReportCyber is the reporting service of the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), at cyber.gov.au. The ACSC’s contact page lists three things to report through it: cybercrime (to police), cyber security incidents and cyber security vulnerabilities (both to the ACSC). The ACSC’s recovery guidance says a report goes to the ACSC and the relevant police jurisdiction. Scamwatch points people to cyber.gov.au to make an official police report for cybercrime, such as stolen personal information or money. ASIC’s guidance for businesses also notes that a ReportCyber report goes directly to the relevant police jurisdiction.

The ACSC also runs the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), which it says is staffed 24 hours a day, 7 days a week. Businesses can read about preparing a small business cyber incident plan.

IDCARE

IDCARE is Australia and New Zealand’s national identity and cyber support service. Its contact page describes “expert assistance with identity theft, cyber incidents, and data breaches”. Scamwatch describes IDCARE as a free service that can help you make a plan to limit the damage.

• Individuals: 1800 595 160
• Small business and organisations: 1800 595 170
• IDCARE’s website lists its opening hours and an online Get Help form.

See how identity theft works and the checks official sources describe.

Services Australia Scams and Identity Theft Helpdesk

Services Australia runs a Scams and Identity Theft Helpdesk on 1800 941 126, Monday to Friday, 8 am to 5 pm AEST. Services Australia says it’s for people who are victims of identity theft or think they’ve been scammed, including people who gave someone their myGov sign-in details or other personal information, or whose identity documents or myGov, Centrelink or Medicare information were exposed in a data breach. It says it can arrange an interpreter. Services Australia asks for scams impersonating it to be reported to reportascam@servicesaustralia.gov.au, and other scams to Scamwatch.

Australian Financial Complaints Authority (AFCA)

AFCA describes itself as an independent external dispute resolution scheme offering individuals and small businesses a free way to resolve complaints about financial products and services. AFCA says that if you can’t resolve a complaint directly with your financial firm, you can contact AFCA; its listed phone number is 1800 931 678. Scamwatch says people unhappy with their bank’s response to a scam can complain to AFCA, and ASIC notes small businesses and sole traders can do the same.

Office of the Australian Information Commissioner (OAIC)

The OAIC handles privacy complaints, including about data breaches. It says a complaint first goes to the organisation or agency you think mishandled your information, and if there’s no response within 30 days, or you’re unhappy with it, you can lodge a complaint with the OAIC. The OAIC says complaints must be in writing, and that some complaints, such as those about banks and financial services, may need to go to an external dispute resolution scheme like AFCA first. See data breaches explained.

eSafety Commissioner

The eSafety Commissioner says it helps remove serious online abuse and illegal and restricted online content. This includes adult cyber abuse and image-based abuse, which eSafety describes as sharing or threatening to share an intimate image or video without consent. For adult cyber abuse, eSafety describes reporting to the platform first, then to eSafety if the content isn’t removed. eSafety points people to police through ReportCyber for online crimes. For sexual extortion, eSafety’s guidance is to stop contact, not pay, and report it. See sextortion and other threat scams.

The platform where it happened

The ACSC’s account guidance describes reporting a hacked account directly to the account provider, and eSafety describes reporting abusive content to the platform first. ASIC’s business guidance describes reporting impersonation to Scamwatch and the relevant platform.

Common questions

How do I report a scam in Australia?

Scams can be reported to Scamwatch through its form at scamwatch.gov.au/report-a-scam, and Scamwatch says reports help it stop scammers and warn others. If money or card details are involved, Scamwatch’s first step is to contact your bank or card provider and ask it to stop any transactions. For an official police report, Scamwatch points to ReportCyber at cyber.gov.au. The At a glance table matches each situation to a service.

Does reporting a scam to Scamwatch also report it to the police?

No. Reporting to one service doesn’t automatically notify the others. Scamwatch points people to cyber.gov.au to make an official police report for cybercrime, such as stolen personal information or money. The ACSC says a ReportCyber report goes to the ACSC and the relevant police jurisdiction. See ReportCyber and the Australian Cyber Security Centre.

Where do I report identity theft in Australia?

IDCARE, on 1800 595 160 for individuals and 1800 595 170 for small business, says it provides assistance with identity theft, cyber incidents and data breaches. If myGov sign-in details were given away, or myGov, Centrelink or Medicare information was exposed, Services Australia’s Scams and Identity Theft Helpdesk is on 1800 941 126. See IDCARE and the Services Australia helpdesk.

Who can I complain to if my bank won’t help after a scam?

Scamwatch says people unhappy with their bank’s response to a scam can complain to the Australian Financial Complaints Authority (AFCA). AFCA describes itself as a free, independent way to resolve complaints about financial products and services, once a complaint can’t be resolved directly with the financial firm. Its listed phone number is 1800 931 678. See Australian Financial Complaints Authority (AFCA).

How do I make a complaint about a data breach?

The OAIC says a privacy complaint first goes to the organisation or agency you think mishandled your information. If there’s no response within 30 days, or you’re unhappy with it, you can lodge a complaint with the OAIC in writing. It notes some complaints, such as those about banks, may need to go to AFCA first. See Office of the Australian Information Commissioner (OAIC).

What do I do if someone threatens to share intimate images of me?

The eSafety Commissioner describes sharing or threatening to share an intimate image or video without consent as image-based abuse, and says it helps remove serious online abuse. For sexual extortion, eSafety’s guidance is to stop contact, not pay, and report it. eSafety points people to police through ReportCyber for online crimes. See eSafety Commissioner.

Support after a scam

Scamwatch points to free financial counselling for scam-related money problems, and to these support lines:

• Lifeline, 13 11 14. Lifeline says its crisis support is available 24/7 by phone, text (0477 13 11 14) and online chat.
• Beyond Blue, 1300 22 4636. Beyond Blue says its free phone and online counselling service is open 24/7 for everyone in Australia.

What official sources say to record

The ACSC’s hacking guidance describes noting what happened, when it happened, whether someone contacted you and how you responded. Its account guidance also describes noting suspicious activity, such as purchases or messages sent from your profile, and recording likely causes and what you did. The ACSC’s email guidance mentions keeping the reference number from a ReportCyber report.

Watch for follow-up scams

Scamwatch warns that scammers often come back to people they’ve scammed, and to be wary of anyone offering to help get money back. The ACSC also warns that offers from third parties to recover lost money are a common scam tactic. See money recovery scams.

See also first steps after a scam and what to do if your account is hacked.