Inside the Fake Bank Security Call: Australia's Costliest Phone Scam

The call looks legitimate because your bank's name actually appears on your caller ID. The caller knows the last digits of your card and speaks with the calm professionalism of a real fraud analyst: someone has attempted a large PayID transfer from your account, and they need to verify your identity right now. This is the most financially damaging phone scam in Australia, and it works because every detail — the spoofed number, the familiar branding, the plausible transaction — is engineered to make you stop thinking and start obeying.

The script, step by step

Fake bank-security calls follow a reliable playbook. Recognising the sequence is your best defence:

1. The hook. An automated call, a live caller, or a text warns of suspicious activity — a PayID payment, an Osko transfer, a login from another city. The details are close enough to real life to feel plausible.
2. The reassurance. The caller reads back your name, address, or card digits — information often bought from earlier data breaches, not proof of anything. You feel verified; in reality, you have been profiled.
3. The urgency. The transfer is processing now and only immediate action stops it. Real deadlines are the emotional engine of the whole scam — panic shuts down the sceptical part of your brain.
4. The extraction. Now comes the ask. It takes a few predictable forms: read back the code we just texted you, approve this push notification in your banking app, transfer the money to a safe account, or install remote-access software so we can secure your device.

The instant a bank asks for a one-time passcode on an inbound call, the call is a scam — full stop.

Why banks never ask for codes or transfers

This is the single most important rule in phone banking, and it comes straight from every major Australian bank, including Commonwealth Bank, Westpac, ANZ, and NAB: your bank will never ask you for a verification code, never ask you to move money to keep it safe, never ask you to approve a login you did not start, and never ask you to install remote-access software. One-time passcodes exist to prove that the person holding your phone is you. The moment you read one aloud, you have handed over the last factor of authentication.

The send-it-to-yourself trick is equally fraudulent. Scammers sometimes have you send a PayID payment to your own number or email, then intercept it because they have already linked your PayID to their account. Sending money to yourself through compromised rails still means sending it to the scammer. No legitimate fraud process anywhere in the Australian banking system requires a customer to move their own money.

The verification callback: your strongest move

If a caller claims to be from your bank, hang up and call the number on the back of your card. This verification callback defeats spoofing entirely. Scammers can make any number appear on your caller ID — including your actual bank's customer service line — but they cannot intercept a call you place yourself to the genuine number printed on your card or shown in your banking app.

Habits that reinforce this defence:

• Never trust the inbound number. Spoofing your bank's real support line takes cheap software and a few minutes, so caller ID proves nothing.
• Never rely on a number the caller gives you. Call this department back at… is the same scam with extra steps.
• Say nothing about your accounts until you have hung up and called back. Even confirming yes, that's my account gives the scammer useful data.
• Tell the real fraud team. When you reach your actual bank, report the impersonation attempt — banks track these campaigns and can flag your account for extra monitoring.

Red flags in the caller's behaviour

Beyond the code request, listen for these tells:

• Pressure to stay on the line. Real fraud teams are happy for you to hang up and call back. Scammers insist you must not disconnect, because a callback ends the scam.
• Instructions to lie to your bank. If the caller tells you to tell the real bank the transfer is for a car, a renovation, or a family member, that is proof of fraud — scammers rehearse victims to defeat bank safety questions.
• Remote-access requests. No bank ever needs to see your screen. Tools like AnyDesk or TeamViewer in a bank call mean the caller is taking over your device.
• Requests for PINs or full passwords. Real bank staff never ask for these on any call, inbound or outbound.

If you already gave up information or money

Speed matters more than embarrassment. Act immediately:

1. Call your bank's real number now and ask them to freeze your accounts, reverse what they can, and reissue compromised cards. For PayID and Osko payments, minutes matter — these transfers settle fast.
2. Change your online banking password and any password shared with it, from a different device, and switch on multifactor authentication.
3. Report to Scamwatch at scamwatch.gov.au and to ReportCyber at report.cyber.gov.au.
4. Call IDCARE on 1800 595 160 if personal details were compromised — Australia's free identity-support service will build you a recovery plan.
5. Watch for follow-up scams. The same criminals often call back days later posing as recovery agents who can get your money back for a fee. They cannot — it is round two.

The best outcome is one where the scam call never reaches you at all: carrier scam filters and a call-blocking app like NoCall screen known impersonation numbers before you pick up. But the habits matter most: hang up on unsolicited fraud alerts, call your bank back on the card's number, and treat any request for a code as the scam it is. No real bank will ever be upset that you verified — and the fake ones cannot survive being verified.