Where to report a scam in Australia, and what changed when the Scams Prevention Framework became law.

Scamwatch is operated by the ACCC's National Anti-Scam Centre and is a reporting service for intelligence, awareness, and policy — NOT a police report. A Scamwatch report alone does not trigger a criminal investigation. ReportCyber is operated by the Australian Cyber Security Centre (within the Australian Signals Directorate) and IS the official channel for cybercrime reports that get routed to your state or territory police. If you have lost money or your data has been compromised, file with ReportCyber (often in addition to Scamwatch). If you just want to warn others about an attempted scam where nothing was lost, Scamwatch alone is fine.

The framework covers regulated banking, telecommunications and digital-platform services. The ACCC says AFCA membership is required from 1 September 2026, while most obligations and AFCA handling of eligible framework complaints begin on 31 March 2027. Membership does not mean the new complaints process has already started. Do not assume an automatic refund: use your bank's existing complaint process now and check AFCA's current eligibility rules if the dispute remains unresolved.

Report suspicious texts directly to your mobile carrier — Telstra, Optus, TPG/Vodafone all have spam-reporting routes — and submit a report to Scamwatch at scamwatch.gov.au with the message details. There is no single national '7726' equivalent in Australia (unlike the UK). For phishing emails impersonating real Australian organisations, also report to that organisation's fraud team directly (use the reporting address published on the organisation's official website), and to ReportCyber if you clicked anything or lost anything. Major mobile carriers in Australia together block billions of scam texts per year using upstream filtering, but reports help build the network-level block lists.

IDCARE is Australia and New Zealand's national identity and cyber support service — a not-for-profit jointly funded by government and the financial sector. They are the right call for identity theft, online account compromise, data-breach impact, and the practical steps to lock down your accounts and credit file. Call them on 1800 595 160 or use idcare.org. Their case managers work with you free of charge, and they coordinate with banks, credit bureaus, government, and police where needed. If your problem includes ID-document misuse, account takeover, or anything where someone else now has your personal details, IDCARE is the most valuable single phone call you can make.

A refund depends on the payment, the facts and the rules that apply. Tell the bank who initiated the transaction and ask it to explain its decision in writing. Use its internal complaint process, then check whether AFCA can consider the unresolved dispute under its existing rules. The new Scams Prevention Framework complaints arrangements are scheduled for 31 March 2027; you do not have to wait until then to make an existing bank complaint.

Yes. The 'Hi Mum' family-impersonation scam, where the scammer texts pretending to be a child with a 'new number' and an urgent money problem, was first widely documented in Australia in 2022 and the ACCC logged more than 11,000 reports that year. The scam has evolved: AI voice cloning now makes the phone-call variant more convincing, the new-number opening still works, and Australia's high WhatsApp adoption keeps the channel productive for scammers. The defence is unchanged — never send money to a new number until you have verified by calling the real person back on the number you already have. See our family-impersonation-scams piece for the full pattern.