The 2026 Scam Playbook: What's New, What Works, and What Doesn't¶

Australians lost a record $3.1 billion to scams in 2025, according to ACCC Scamwatch. The 2026 trend lines are clear: AI-generated voice and video are now mainstream tools in the scammer's toolkit, and the delivery channel has decisively shifted from email to SMS and encrypted messaging apps.

This is a field guide to the scams your bank is seeing this year — and what actually works to defend against them.

What's Different in 2026¶

Three shifts define the 2026 scam landscape:

1. AI voice cloning is cheap and convincing. A 3-second voice sample from a social media video is enough to clone a voice well enough to fool most family members. "Hi Mum, I've lost my phone" calls are now routinely AI-generated.
2. Deepfake investment endorsements. Celebrity deepfakes promoting crypto and AI investment platforms saturate social media. The video quality is good enough that fewer than 1 in 3 viewers can identify them as fake in controlled testing.
3. SMS and WhatsApp have overtaken email. 61% of reported scams in Q1 2026 arrived via SMS or messaging apps, up from 38% two years ago.

The Top 5 Scam Types in 2026¶

1. Investment Scams — $1.1 billion lost in 2025¶

Fake investment platforms promise 8–15% monthly returns via AI trading, crypto arbitrage, or "property-backed" tokens. Characteristics:

• Professional websites with real brokerage branding copied
• Small initial "wins" to build trust, then large deposits vanish
• WhatsApp groups run by fake "analysts" who provide personal 1-on-1 guidance
• Pressure to act quickly on "limited allocations"

Defence: never invest via a platform you found through social media ads or WhatsApp groups. Check ASIC's Moneysmart Investor Alert List before depositing anything. If the returns sound extraordinary, they are not real.

2. Remote Access Scams — $218 million lost in 2025¶

Callers impersonating the NBN, banks, ATO, or Microsoft convince victims to install AnyDesk or TeamViewer. Once installed, the scammer takes control of the device and empties accounts.

Defence: no bank, ATO, Microsoft, or telco will ever ask you to install remote-access software. Hang up immediately. If in doubt, call the organisation back on the number printed on your bank card or a previous bill.

3. AI Voice Cloning ("Hi Mum") — $47 million lost in 2025¶

A cloned voice of a family member in apparent distress requests an urgent transfer. The AI is good enough to fool most recipients on a short call.

Defence: establish a family safe word that would be asked in any emergency call. Hang up and call back on the person's known number. Never transfer funds on a first request.

4. Romance Scams — $212 million lost in 2025¶

Long-running relationship scams on dating apps and social media. The scammer builds rapport over weeks or months before asking for money — often framed as an investment opportunity or an emergency.

Defence: never send money to someone you haven't met in person. Reverse image search profile photos. Be suspicious of rapid professions of love, especially if the person is "travelling" or "working offshore" and unable to meet.

5. Business Payment Redirection — $197 million lost in 2025¶

Fraudsters compromise a supplier's email account and send fake updated bank details to accounts payable teams. Payments go to the fraudster. This is devastating for small businesses.

Defence: verify any bank detail change via a phone call to a known number — not the one on the email. Implement dual authorisation on payments over a threshold. Apex Business accounts support this natively.

What Doesn't Work¶

• Checking the sender name on an SMS. SMS sender IDs can be spoofed trivially. A message appearing from "ApexBank" is not proof of anything.
• Looking for spelling errors. AI-generated scam messages are grammatically perfect in 2026.
• Trusting because the website has HTTPS. Lock icons only confirm the connection is encrypted, not that the site is legitimate.
• Relying on caller ID. Voice-over-IP spoofing is trivial. Incoming calls can display any number.

What Actually Works¶

1. Pause before acting on any urgent request. Urgency is the single most reliable signal of a scam.
2. Call back on a known number. Not the number the scammer gave you. Look up the number yourself.
3. Use Confirmation of Payee. Apex Bank's PayID lookup now warns if the recipient's registered name doesn't match the name you entered.
4. Enable all push authorisations. Every transaction over $500 requires a push confirmation on your registered device — scammers without your phone can't complete the transaction.
5. Turn on daily transfer limits. The Apex Bank app lets you set a daily transfer limit. For most people, $5,000/day is more than enough, and it caps worst-case losses.

If You've Been Scammed¶

1. Call your bank immediately — 1800 XXX XXX (24/7). The sooner we know, the higher the chance of recovery.
2. Report to Scamwatch at scamwatch.gov.au.
3. Report to IDCARE at idcare.org (free identity theft support service).
4. If you shared remote access, factory reset the device and change all passwords from a different device.
5. File a police report — required for many claims and insurance processes.

Apex Bank's 2026 Scam Defences¶

• Confirmation of Payee — warns if PayID name and account name don't match
• Mandatory push confirmation for transfers over $500
• AI fraud detection — blocks anomalous patterns in real time
• Scam alerts in-app — warnings when you're about to transact with a known-bad merchant
• 24/7 scam response team — 1800 XXX XXX, trained specifically in recovery

If you're worried you've been targeted by a scam, or you're just not sure about a transfer you're about to make, stop and ask. The Apex AI assistant can talk you through any scam scenario, or you can reach our scam response team at 1800 XXX XXX.

General information only. Consult our Scam Prevention Guide for comprehensive security advice.