NumberCheck.com.au
Someone claiming to be from a bank called about 'suspicious activity'.

Bank impersonation calls in Australia: how the script works

Bank impersonation is the most expensive phone scam reported in Australia. The call is convincing because it borrows real details: a spoofed caller ID, your first name, sometimes the last four digits of a card. Here is the structure it almost always follows, and the single rule that defeats it.

Check the number that called you

The four-step script

Almost every bank impersonation call runs through the same four beats, in the same order. Recognising the shape is more reliable than recognising the number.

  • Alarm: 'We've detected a suspicious transaction on your account.' Sometimes an amount and a city you have never visited.
  • Authority: the caller reads back a detail they already know so you stop doubting them.
  • Isolation: 'Don't discuss this with anyone, the investigation is confidential' or 'stay on the line while I transfer you to the fraud team'.
  • Extraction: a one-time code, a transfer to a 'safe account', or remote-access software so they can 'secure' your banking.

The rule that beats it every time

No Australian bank will ever ask you to move money to another account, read out a one-time code or verification SMS, or install remote-access software. Not the fraud team, not in an emergency, not ever.

So you never have to judge whether a caller is genuine. Hang up, and call the number printed on the back of your card or shown in your banking app. If the call was real, the bank will find the case. If it was not, you have just ended the attack.

Why the number looked right

Caller ID is information the calling network supplies, not something your handset verifies. It can be set to a bank's real published number, which is why searching a number that 'checks out' still leaves you exposed. Treat the number as a clue about the pattern, not proof of identity.

If you already gave something away

Speed matters more than embarrassment. Call your bank's fraud line straight away using a number you looked up yourself, ask them to freeze the account and reverse any pending transfer, then change your banking password from a device that was not touched during the call. If you installed anything the caller asked for, remove it and treat every password entered on that device as compromised.

Where to report it in Australia

Reporting a call twice — once officially, once publicly — is what stops the next person answering it.

  • Scamwatch (run by the National Anti-Scam Centre) at scamwatch.gov.au collects scam reports and publishes national trends.
  • The Australian Cyber Security Centre at cyber.gov.au handles cybercrime reports, including phishing links sent by SMS.
  • Your bank's fraud line, immediately, if any account, card or code was discussed.
  • The number's page on NumberCheck, so the next Australian who searches it sees your experience straight away.

Keep reading

Prefix directoryMost reported numbers