This article provides general information only and does not constitute personal financial advice. It has been prepared without taking into account your objectives, financial situation or needs. Before acting on any information in this article, you should consider whether it is appropriate for you and seek advice from a licensed financial adviser if necessary.

Financial fraud targeting Australian investors and superannuation members has grown more sophisticated in recent years. Scammers impersonate the ATO, clone legitimate investment platforms, and exploit data breaches to access retirement savings. The Australian Competition and Consumer Commission (ACCC) reported that Australians lost over $569 million to scams in 2023, with investment scams accounting for the largest share. Your superannuation balance, often the largest asset outside your home, is a prime target. Protecting these assets requires understanding common fraud tactics, implementing strong security measures, and knowing how to respond when something goes wrong.

This guide walks you through the practical steps to secure your investments and super from fraudulent activity, based on guidance from ASIC MoneySmart, AFCA, and the ATO.

What You Will Learn

By the end of this article, you will know how to verify the legitimacy of investment opportunities and financial advisers, secure your super and brokerage accounts with multi-factor authentication and strong passwords, identify phishing attempts and impersonation scams, monitor your accounts for unauthorised transactions, and report suspected fraud to the correct authorities. You will also learn the common mistakes that make investors vulnerable and the steps to take if you have already been targeted.

Step 1: Verify the Legitimacy of Investment Opportunities and Advisers

Before committing funds to any investment or engaging a financial adviser, check that the provider holds a valid Australian Financial Services Licence (AFSL). According to ASIC, all entities providing financial services in Australia must be licensed (ASIC, 2026). You can verify an AFSL on the ASIC Connect Professional Registers at asic.gov.au. Search by the company name, individual name, or AFSL number.

When an adviser contacts you with an opportunity, request a Financial Services Guide (FSG). This document explains the services offered, how the adviser is paid (commission, fee-for-service, or both), and the complaints process. Legitimate advisers provide this document before giving advice. If the adviser cannot or will not produce an FSG, do not proceed.

Be wary of unsolicited investment offers, especially those received via phone, email, or social media. Cold calls promoting “guaranteed returns”, offshore tax havens, or time-limited opportunities are red flags. As covered in foundational texts such as Principles of Finance (OpenStax, 2022), legitimate investments carry risk, and no reputable adviser guarantees returns. High-pressure tactics (such as “invest today or miss out”) are hallmarks of fraud.

Cross-check the physical address and contact details the adviser provides. Scammers often list serviced offices or mailbox addresses. Call the listed phone number independently (do not use the number in the email you received) to confirm the firm operates from that location.

Step 2: Secure Your Superannuation Account

Your super fund account should be protected with the strongest available security settings. Log in to your fund’s member portal and enable multi-factor authentication (MFA) if offered. MFA requires a second verification step, such as a code sent to your mobile, in addition to your password. This prevents unauthorised access even if your password is compromised.

Change your super fund password to a unique, complex passphrase of at least 12 characters, mixing upper and lower case letters, numbers, and symbols. Do not reuse passwords across accounts. Consider a password manager (such as 1Password, Bitwarden, or LastPass) to generate and store strong passwords.

Review your nominated bank account details in your super portal every quarter. Fraudsters who gain access to your account may change the bank account to which lump-sum withdrawals or pension payments are sent. According to the ATO, super fraud often involves changing contact details and bank accounts before requesting an early release or rollover (ATO, 2026).

Set up account alerts if your fund offers them. Many funds now send SMS or email notifications when you log in from a new device, update contact details, or request a withdrawal. These alerts let you detect unauthorised activity immediately.

Be cautious of early access or illegal release schemes. Scammers promote schemes to access super before preservation age (currently 60 for most Australians) by claiming financial hardship or setting up sham SMSFs. The ATO actively prosecutes illegal early release. Legitimate early access is tightly regulated and limited to specific compassionate grounds, terminal illness, or severe financial hardship. Verify any claim about early access eligibility directly with your fund or the ATO.

Step 3: Protect Your Investment and Brokerage Accounts

If you hold shares, ETFs, or managed funds through a broker or platform (such as CommSec, SelfWealth, or Stake), apply the same security discipline as for your super. Enable MFA on every account. Most platforms now support authenticator apps (such as Google Authenticator or Authy) or biometric login (fingerprint or face recognition).

Monitor your holdings and transaction history weekly. Look for trades you did not authorise, changes to your registered email or phone number, or withdrawals to unfamiliar bank accounts. If your broker sends a trade confirmation for a transaction you did not make, contact the broker immediately and freeze the account.

Beware of share sale scams targeting holders of unlisted or suspended stocks. Scammers cold-call investors claiming to have a buyer for illiquid shares at an inflated price, then request an upfront fee for due diligence, taxes, or registration. ASIC MoneySmart warns that these schemes never result in a sale (MoneySmart, 2026). Legitimate buyers do not require upfront fees from the seller.

Do not click links in emails claiming to be from your broker or fund manager. Phishing emails mimic the branding of major platforms and direct you to fake login pages that harvest your credentials. Instead, manually type the broker’s URL into your browser or use a saved bookmark. Check the email sender address carefully: phishing emails often use lookalike domains (such as “commsec.com.au” versus “c0mmsec.com.au” with a zero).

Step 4: Recognise and Avoid Phishing and Impersonation Scams

Phishing scams impersonate trusted organisations to steal login credentials, personal details, or payments. Common Australian targets include the ATO, myGov, super funds, banks, and Australia Post. The ATO has confirmed it does not request payment via gift cards, iTunes cards, or cryptocurrency, nor does it threaten immediate arrest for unpaid tax. Any communication claiming otherwise is a scam.

Examine emails and SMS messages for red flags: generic greetings (such as “Dear member” instead of your name), spelling and grammar errors, urgent threats (account suspension, legal action, arrest), and links to unfamiliar domains. Hover over links without clicking to reveal the true destination URL. Legitimate ATO emails link to ato.gov.au, not ato-gov.com or similar variants.

If you receive a suspicious call from someone claiming to represent the ATO, your super fund, or a financial institution, hang up and call the organisation directly using the phone number listed on their official website or your account statement. Do not use the callback number the caller provides.

Never provide your myGov login details, tax file number, or super account password in response to an unsolicited request. The ATO, Centrelink, and Medicare do not call or email asking for these credentials. Scammers use stolen myGov access to lodge fraudulent tax returns and divert refunds, or to link to your super account and request a rollover.

Step 5: Monitor Your Accounts and Credit File Regularly

Set a recurring calendar reminder to review your super balance, investment account statements, and bank transactions every month. Look for withdrawals, trades, or fees you do not recognise. Small unauthorised transactions are sometimes test charges before a larger theft.

Read also: Melbourne Cup Long Weekend: How to Budget for Spring Spending in Australia

Request a free copy of your credit report from a credit reporting body (Equifax, Experian, or illion) every three months. Under Australian privacy law, you are entitled to one free report per year from each body. Your credit file lists all credit enquiries and accounts in your name. If you see applications for credit cards, personal loans, or phone contracts you did not apply for, this indicates identity theft.

Consider a credit ban if you are not planning to apply for credit in the near future. A ban prevents any credit provider from accessing your credit report, blocking fraudulent applications. You can apply for a ban at no cost through each credit reporting body and lift it when needed.

Check your myGov inbox regularly for unexpected correspondence from the ATO or Centrelink. Scammers who gain access to myGov may lodge tax returns, claim benefits, or request super rollovers without your knowledge. Enable login alerts in your myGov account settings so you receive an SMS when someone logs in.

Step 6: Report Suspected Fraud Immediately

If you identify unauthorised activity in your super, investment, or bank account, act within hours, not days. Contact your super fund or broker immediately to freeze the account and reverse any pending transactions. Most funds have a dedicated fraud hotline available 24 hours.

Report the fraud to your bank if money has been transferred out. Banks have a limited window (often 24 to 48 hours) to recall payments sent to other Australian institutions. International transfers are harder to reverse, so speed is critical.

Lodge a complaint with the Australian Financial Complaints Authority (AFCA) if your super fund or financial institution does not resolve the issue to your satisfaction. AFCA is a free, independent dispute resolution service covering superannuation, banking, insurance, and financial advice (AFCA, 2026). You must first raise the complaint with the provider and allow them 30 days to respond before escalating to AFCA.

Report the scam to ASIC via the ASIC report misconduct portal, and to Scamwatch (run by the ACCC) at scamwatch.gov.au. While these reports do not result in individual compensation, they help regulators track trends and shut down fraudulent operators.

If your personal information (tax file number, driver licence, passport) has been compromised, contact IDCARE (a free identity and cyber support service) on 1800 595 160 for a response plan. IDCARE works with victims of identity crime to secure accounts and limit damage.

Consider filing a police report at your local station or online via the relevant state police website, especially if you have lost a significant sum or your identity documents have been stolen. The police report creates a record useful for insurance claims and credit file annotations.

Common Mistakes That Increase Your Vulnerability

One of the most common errors is using the same password across multiple accounts. When one service suffers a data breach, criminals test the stolen credentials on banking, super, and brokerage platforms. Use a unique password for each financial account.

Many investors fail to enable MFA, assuming a strong password is sufficient. MFA is the single most effective defence against account takeover. Even if your password is leaked, the attacker cannot log in without the second factor.

Clicking links in unsolicited emails is another frequent mistake. Phishing emails are visually convincing and often bypass spam filters. Train yourself to manually navigate to websites rather than clicking links.

Ignoring small, unfamiliar transactions is risky. Fraudsters often test stolen account details with a minor charge (a few dollars) before attempting a larger withdrawal. Treat every unexplained transaction as potentially fraudulent.

Failing to check an adviser’s AFSL is a critical oversight. Unlicensed operators have no regulatory supervision, no professional indemnity insurance, and no accountability. If an unlicensed adviser defrauds you, recovery is extremely difficult and AFCA cannot assist (it only covers licensed providers).

Frequently Asked Questions

What should I do if I have already sent money to a scammer?
Contact your bank immediately to request a recall or chargeback. Report the scam to ASIC, Scamwatch, and the police. If the payment was made via a cryptocurrency exchange, contact the exchange to freeze the receiving wallet. Recovery is unlikely, but prompt reporting improves the chance.

Can I get compensation if my super fund allows unauthorised access?
If the fund failed to implement reasonable security measures or did not act on your report of suspicious activity, you may have grounds for a complaint to AFCA. Outcomes vary depending on whether the fund met its obligations under the law.

How do I know if an investment opportunity is registered with ASIC?
Search the ASIC Connect Professional Registers for the company name or AFSL number. If the investment involves a managed fund, check the product disclosure statement (PDS) for the AFSL and trustee details. If you cannot find the entity on ASIC’s register, do not invest.

Are cryptocurrency investments covered by the same protections as shares or super?
Cryptocurrency investments are not covered by the Financial Claims Scheme (which guarantees deposits up to $250,000 per ADI) and generally fall outside traditional super and managed fund regulations. If you hold crypto on an exchange, that exchange may not hold an AFSL, and you may have limited recourse if the platform collapses or is hacked.

What is the difference between ASIC and AFCA?
ASIC is the regulator that licenses and supervises financial service providers. AFCA is the dispute resolution scheme that handles complaints between consumers and providers. Report misconduct to ASIC; lodge a complaint about a specific provider’s conduct to AFCA.

Conclusion

Protecting your investments and superannuation from fraud requires a combination of vigilance, strong account security, and swift action when you detect suspicious activity. Verify every adviser’s AFSL, enable multi-factor authentication on all financial accounts, scrutinise unsolicited offers and communications, monitor your balances and credit file regularly, and report fraud immediately to your provider, AFCA, and the authorities. The time invested in these steps is negligible compared to the cost of recovering from a successful scam.

Review your security settings this week. Enable MFA on your super fund and brokerage accounts, update weak passwords, and check your most recent account statements for unexplained transactions. If you receive an unsolicited investment offer, pause, verify the sender’s credentials on the ASIC register, and consult a licensed financial adviser before proceeding. Your financial security depends on consistent, informed habits, not one-off actions.