Skip to content
Confluence Data Center flaw CVE-2026-90436 lets unauthenticated attackers run code through the Remote API
Black Shard

Loading

    AUSTRAC warns that scammers are impersonating the agency and its staff to demand payments

    The scams arrive as emails, calls and messages demanding urgent payment or personal details. AUSTRAC says it never takes payment in cryptocurrency or through WhatsApp or Telegram, and it notifies a business in writing and gives it time to contact AUSTRAC with questions.

    Black Shard Policy Desk

    Event date 2 min read

    Share
    On this page
    1. What AUSTRAC released
    2. Who has to act
    3. What to do now

    What AUSTRAC released

    AUSTRAC warned on 26 August 2026 that scammers have impersonated the agency and its staff in an attempt to steal money and sensitive information. CEO Brendan Thomas said the scammers use emails, phone calls and messages that appear legitimate to pressure victims into urgent payments or disclosing personal details.

    AUSTRAC says these scams are designed to exploit trust in government agencies. An AUSTRAC staff member will never ask for an additional payment to engage with AUSTRAC. In almost all cases, AUSTRAC will contact a business before taking any action and explain what is happening.

    Who has to act

    AUSTRAC says it takes payment from reporting businesses for things like levies and infringement notices, and that AUSTRAC-regulated businesses may receive valid invoices from it.

    From 1 July 2026 AUSTRAC regulates certain designated services typically provided by real estate professionals, lawyers, conveyancers, accountants and trust and company service providers. Those firms now sit among the businesses that can receive a genuine AUSTRAC invoice.

    What to do now

    AUSTRAC asks that any unexpected request for money, personal information or urgent action be verified through official AUSTRAC channels before payment. Three checks build that into the firm's own process.

    • Supplier master file: trace each AUSTRAC payee entry to a written notice; flag changes made by email or call
    • Accounts payable approvals: hold AUSTRAC invoices seeking crypto, WhatsApp or Telegram payment, or leaving no time to contact AUSTRAC first
    • Reception call notes and shared inboxes: open no links in AUSTRAC messages; verify using contact details on AUSTRAC's website

    Sources

    1. PrimaryAUSTRAC, AUSTRAC warns of scammers impersonating agency and staff (26 August 2026)Retrieved 15 Nov 2026
    2. PrimaryAUSTRAC, About the AML/CTF reformsRetrieved 30 Oct 2026

    Where this shows up in our work

    Tell us which framework you are preparing for.