Impersonation scams: when scammers pose as trusted organisations

An impersonation scam is one where the scammer pretends to be someone you already trust: your bank, a government agency, the police, your phone or internet provider, a delivery company, or a well-known shop. Scamwatch lists impersonation as one of the three core tactics behind scams, alongside urgency and emotion. This guide covers how impersonation scams unfold, the warning signs, and how to check whether a contact is genuine.

These scams work because the organisation being copied is real. You probably do have an account with a bank, a myGov account and a phone provider, so a message about one of them can feel routine. This guide deliberately names no bank or business.

How it works

Impersonation scams vary, but most follow a similar path. Understanding the stages makes it easier to notice when a “routine” contact starts to go somewhere unusual.

1. Borrowing a trusted name. The scammer picks an organisation that lots of people deal with. ACMA says callers may pose as a bank, telco or government department, and may copy company logos and the wording of real messages.
2. Making the contact look genuine. Phone numbers can be disguised so a call appears to come from a real organisation, a practice called spoofing. Texts can land in the same thread as genuine messages. myGov guidance notes scammers may already know some personal details, for example from a data breach, which makes them sound credible. Our data breach guide explains why breached information matters.
3. Creating a problem. The story is usually something that needs fixing now: suspicious activity on an account, an unpaid fine or tax debt, your identity “linked to a crime”, a refund waiting, or a problem with your internet connection.
4. Adding pressure. Scamwatch says scammers create “time pressure to make you act quickly”. The caller may say the account will be frozen, that police are on their way, or that you mustn’t hang up or tell anyone.
5. The request. This is where the scam shows itself. It might be a one-time code, a password, personal details, installing an app that gives a stranger remote access to your device, paying with gift cards or cryptocurrency, or moving money to a “safe” account.
6. Coming back for more. Once someone has paid or shared details, Scamwatch warns that scammers often come back for more, and that offers to help get money back are a common follow-up.

“Safe account” requests

One of the most damaging patterns is being told to move money to protect it. Scamwatch says plainly: “Your bank will never ask you to open new accounts to keep your money safe.” eSafety’s Be Connected guidance says your bank may contact you about suspicious activity, but will never ask you to transfer funds to another account. The request often comes with a claim that your account has been compromised, sometimes involving a fake “investigation”.

Spoofed numbers and sender names

“Spoofing” means disguising where a call or message really comes from.

• Phone calls. In June 2025 the National Anti-Scam Centre warned that scammers had used publicly listed ACCC phone numbers, and said “Spoofing is when scammers disguise their phone number.” ACMA adds that scammers may disguise numbers to look local.
• Text threads. ACMA says scam texts can “appear in the same message chain as real messages from an organisation”.
• Sender names. ACMA runs an SMS Sender ID Register. ACMA says that from 1 July, texts sent under an unregistered branded sender ID show “Unverified” instead of the brand name. The ACSC gives the date as 1 July 2026 and says this label “may indicate a scam”. The federal communications department describes this label as “a clear warning to pause before responding or clicking on links”.

A fictional example

This example is fictional. Names and the website are invented.

On a Tuesday afternoon, Daniel gets a text that appears in the same thread as genuine messages from his bank: “A payment of $1,940 is pending. If this wasn’t you, call our fraud team on the number below.”

He calls. A calm, professional woman says she’s from the fraud team. She already knows his name and suburb. She says someone has accessed his account and that “an internal staff member may be involved”, so he mustn’t go into a branch or call the number on his card. To “lock down” the account, she reads out a code that has just arrived by text and asks him to confirm it.

Next, she says his savings are still at risk and must be moved to a new “protected account” set up in his name, with details she will text through. She stays on the line while he opens his banking app, and keeps reassuring him it’s routine.

Daniel pauses at the request to move money. He remembers reading that banks don’t ask customers to move funds to keep them safe. He hangs up, waits a few minutes, and calls the number printed on the back of his card. The bank confirms there is no pending payment and no fraud case.

What gave it away: the contact came from a message link, not a number he looked up; he was told not to use the bank’s normal channels; he was asked to share a code; and he was asked to move money to a “safe” account.

Warning signs of an impersonation scam

• A call or message you weren’t expecting about a problem with an account, a fine, a debt or a refund.
• Being told to act immediately, stay on the line, or keep it secret from family or the organisation’s own staff.
• A request for a one-time code, password, PIN or full card details. eSafety says not to give these to anyone, including someone claiming to be your bank or a government agency.
• A request to move money to a new or “safe” account, or to pay with gift cards, cryptocurrency or a wire transfer.
• A request to install an app or let someone access your device.
• Links or attachments in texts and emails, or contact details given only in the message.
• A caller who uses threats: arrest, deportation, fines or account cancellation.
• An email display name that doesn’t match the actual address, or a web address with a small spelling change.

What genuine organisations say they won’t do

Several organisations publish how they contact people, and comparing a contact with these lists is a quick check.

• Services Australia says it will never send you a link in a text or email, ask for access to your phone, tablet or computer, ask for your myGov sign-in details during a call, call from a visible mobile number, ask you to pay for its help, threaten to deactivate your myGov account, or threaten fines, arrest warrants or jail. It says it may call from a private number.
• The ATO says it will never threaten arrest or demand you stay on the line, send unsolicited robocalls, ask for payment by gift cards, crypto, cash delivery or personal or offshore accounts, or send unsolicited messages containing links or QR codes. It says genuine ATO calls show as “No Caller ID”.
• The ACCC says it will never make “cold” calls or send emails asking for personal information, request login credentials, banking details or answers to security questions, or make outbound calls from its reception lines.
• Banks: eSafety’s guidance says banks won’t ask for your password, PIN or one-time passcode in an unsolicited text, email or call. The ACSC also notes that banks often state they will never request your password.

How to check if it’s real

Based on guidance from Scamwatch, ACMA, eSafety and myGov (checked October 2026):

1. End the contact. Hang up, or don’t reply. Scamwatch’s Stop step is to “say no, hang up, or delete suspicious messages”.
2. Find the number yourself. Use the organisation’s official website, its app, the number on the back of your card, or, as myGov describes, a number on a bill or letter you already have. Never use the number or link in the message.
3. Log in through the app or typed address. If you’re told there’s a problem, check the account yourself. eSafety describes typing the company’s address or using its app instead of a link. Our phishing guide shows how to check a link before you open it.
4. Let unknown calls go to voicemail. ACMA describes this, then checking any number left against the organisation’s official website.
5. For tax contact, use the ATO’s line. The ATO says to call 1800 008 540 if you’re unsure whether ATO contact is genuine.

Common questions

What is an impersonation scam?

An impersonation scam is one where the scammer pretends to be an organisation you already trust, such as your bank, a government agency, the police or your phone provider. Scamwatch lists impersonation as one of three core scam tactics, alongside urgency and emotion. The contact usually describes a problem that needs fixing now, then asks for a code, a password, a payment or access to your device. See How it works.

How can I tell if a call is really from my bank?

Scamwatch and eSafety describe hanging up and calling the bank on a number you find yourself, such as the one on the back of your card. eSafety says banks won’t ask for your password, PIN or one-time passcode in an unsolicited call, and Scamwatch says your bank will never ask you to open new accounts to keep your money safe. See How to check if it’s real.

Would my bank ever ask me to move money to a safe account?

Scamwatch says plainly: “Your bank will never ask you to open new accounts to keep your money safe.” eSafety’s Be Connected guidance says your bank may contact you about suspicious activity, but will never ask you to transfer funds to another account. The request often comes with a claim that your account has been compromised. See “Safe account” requests.

If a caller knows my name and address, does that mean it’s real?

No. myGov guidance explains that scammers may already have details about you, for example from a data breach, which makes them sound credible. Knowing your details doesn’t make a caller genuine. The same check applies: end the contact and call the organisation on a number you look up yourself. See identity theft and How to check if it’s real.

What does “Unverified” mean on a text message?

ACMA says texts sent under an unregistered branded sender name show “Unverified” instead of the brand name, and the ACSC says this label “may indicate a scam”. ACMA also says scam texts can appear in the same message chain as genuine ones, so a familiar thread isn’t proof either. Either is a cue to check through the organisation’s own app or website. See Spoofed numbers and sender names.

What do I do if I’ve already given money or details to a scammer?

Scamwatch says to contact your bank or card provider immediately to report the scam and ask it to stop any transactions. It points to IDCARE on 1800 595 160 for free help to plan how to limit the damage, and to reporting at scamwatch.gov.au. If myGov or Services Australia details were involved, Services Australia’s helpdesk is on 1800 941 126. See If it’s already happened.

If it’s already happened

Scamwatch’s steps (checked October 2026):

1. Act fast. “Contact your bank or card provider immediately to report the scam”, and ask them to stop any transactions.
2. Get help to recover. IDCARE (1800 595 160) offers free help to plan how to limit the damage. If you’re unhappy with your bank’s response, you can complain to AFCA.
3. Report and warn others. Report to Scamwatch, and make a police report online through cyber.gov.au.
4. Watch for follow-up scams. Be wary of anyone offering to get your money back.
5. Get support. Lifeline (13 11 14) and Beyond Blue (1300 22 4636) are available.

If the scam involved your myGov or Services Australia details, Services Australia has a Scams and Identity Theft Helpdesk on 1800 941 126. Scamwatch’s Protect step also mentions changing passwords that may be compromised and telling the organisation that was impersonated. Our guide to securing your online accounts with passphrases and multi-factor authentication explains how those settings work.

Where to report

• Scamwatch takes scam reports at scamwatch.gov.au.
• ReportCyber at cyber.gov.au takes police reports of cybercrime.
• Services Australia accepts scam messages, or screenshots, at reportascam@servicesaustralia.gov.au.
• The organisation impersonated may want to know, using contact details from its website.

See where to report scams and cybercrime in Australia and, if money or details have already gone, first steps after a scam.