The ASD’s ACSC is aware that criminals are using Australia’s national cybercrime reporting channel and impersonating police to try to scam Australians out of funds from their cryptocurrency or seed wallets.
Cybercriminals have illicitly obtained personal information—such as email addresses and phone numbers—and used this to submit false reports to Australia’s national cybercrime reporting tool, ReportCyber.
Cybercriminals have then contacted their victims and quoted an official report reference number to ultimately trick the victims into transferring their cryptocurrency into the criminals’ account. By creating a false report in ReportCyber, criminals make their scam appear more legitimate.
What kind of signs should I watch out for?
The Australian Federal Police (AFP) have provided the below real life example of this scam, so that you can be aware of the warning signs:
Real-life example:
- The target was called by someone purporting to be from the AFP. They were told someone had been arrested on the weekend and the target had subsequently been identified in a data breach related to cryptocurrency and finance.
- The scam caller, impersonating an AFP officer, claimed a cybercrime report had been submitted and supplied the target with an official reference number. This was plausible as ReportCyber allows individuals to report cybercrime on behalf of others.
- The scam caller asked the target to check the report status themselves in the ReportCyber portal by submitting their email address, reinforcing the scam’s credibility.
- The scammer then advised that another contact would come from a representative of the cryptocurrency platform, who would provide the same reference number to verify legitimacy.
- This second caller then tried to get the target to transfer money from their platform wallet to a ‘Cold Storage’ account.
- Thankfully the target became suspicious and hung up.
In this scam, the criminals step through a verification process that matches common expectations, and then move quickly from making the report to calling the target, which creates a false sense of urgency.
In some cases, criminals have also used techniques such as ‘spoofing’ (impersonating) legitimate phone numbers.
How do I protect myself from this type of scam?
If you’re contacted by someone about a ReportCyber report that you didn’t lodge or authorise someone to make on your behalf, terminate the call and notify ReportCyber or 1300CYBER1 (1300 292 371).
ReportCyber remains a safe a secure platform and you should continue using it to report cybercrimes.
However, like with any other scam, you should be aware of how your personal details may be used by criminals to extort further information through legitimate online platforms.
Remember, AFP and legitimate law enforcement officials will never:
- Ask you to transfer money or cryptocurrency to any accounts.
- Ask to access your cryptocurrency accounts, wallets, bank accounts or cryptocurrency wallet seed phrases.
- Ask for your personal information such as your passwords, bank details or answers to your security questions.
- Ask you to purchase gift cards or cryptocurrency.
- Threaten you or pressure you to stay on the line.
What else can I do to protect myself from scams?
If you receive an unexpected phone call from someone claiming to be from the AFP, law enforcement, or any other organisation, and you’re not sure if it is legitimate, do not give out any of your personal information. Instead, hang up and call the organisation back on the official number listed on their website.
Further advice can be found on cyber.gov.au on how to identify phishing emails, along with tips on how to recognise scams.