ASIC Just Published Six Months of Bank Impersonation Data. The Scam That Breaks Your File Isn’t In It

What ASIC published, and what it doesn’t measure

On 24 August 2026, ASIC drew attention to National Anti-Scam Centre data covering 1 January to 30 June 2026: 5,262 bank impersonation scam reports and $3,249,618 in reported losses. ASIC Commissioner Alan Kirkland framed the mechanism plainly.

“These scams are designed to create fear and urgency. Scammers make people believe their money is at risk and convince them to act quickly without stopping to check.”

Bank impersonation is a specific pattern — someone poses as your client’s bank and pressures them into moving money to a “safe account”. It is worth knowing about. But it is not the pattern that shows up in broker files, and the $3.25 million figure is not the number to quote when you talk to a client about settlement risk.

The relevant number is in the ACCC’s annual scam reporting. In its 30 March 2026 release covering calendar 2025, the ACCC put total reported scam losses at $2.18 billion across 481,523 reports, up 7.8% year on year. Broken down by type, payment redirection scams accounted for $166.8 million — the second-largest loss category in the country, behind only investment scams at $837.7 million, and ahead of romance ($139.9m), phishing ($97.6m) and remote access ($69.9m).

Fewer victims, bigger single hits

Here is the part the “scams are surging” headlines usually skip. The Australian Bureau of Statistics’ Personal Fraud release for 2024–25, published 12 March 2026, found scam victimisation actually fell — 2.7% of people aged 15 and over, down from 3.1% in 2023–24, or about 600,000 people and roughly 80,000 fewer victims than the prior year. One in seven Australians (3.2 million) experienced some form of personal fraud, but the bulk of that is card fraud: 2.3 million people, $2.2 billion gross, reduced to $350 million in net loss to individuals once reimbursements are counted, with 72% of card fraud victims fully reimbursed.

Read those two datasets together and the picture sharpens. Scam incidence is flat to falling. Card fraud, the highest-volume category, is largely absorbed by the banks. What is not absorbed, and what does not get reimbursed, is a single large authorised transfer made by a client who thought they were paying their solicitor.

That is the exposure sitting in your pipeline right now. Not a diffuse risk spread across your database — a concentrated, one-shot risk that fires on a specific day, for a specific amount, in every purchase file you write.

Your exposure is the file, not the funds

No money moves through a mortgage broker at settlement. That fact reassures brokers more than it should, because the loss does not have to touch your account to destroy your file.

Broker Daily reported on 26 August on a case described by Eva Loisance, principal at Finni Mortgages, in which a client lost $80,000 to a settlement impersonation scam. The scammer used an email address that differed from the legitimate solicitor’s by a single special character. The client transferred the funds believing they were going to the solicitor’s trust account. Recovery took more than two years — and in the meantime, the client had to resubmit the mortgage application at 95% LVR instead of 80%.

“I would always recommend calling up and confirming account details over the phone. It may take an extra five minutes, but you may have an extra $100,000 in your pocket.”

The recovery path your client actually has

This is where brokers most often give clients false comfort, usually without meaning to. The instinct is to say “the bank will sort it out”. Frequently it will not, and the reason is technical.

ASIC’s ePayments Code draws a hard line between an unauthorised transaction — one the customer did not make and did not consent to — and a payment the customer made themselves. The Code’s protections for unauthorised transactions are meaningful. Its “mistaken internet payment” provisions, which oblige the sending institution to chase the receiving institution for recovery, were expressly narrowed in ASIC’s 2022 update to exclude mistaken payments resulting from a scam. A typo in a BSB is a mistaken internet payment. A payment made to a scammer because the client was deceived is not.

A scammed client, in other words, has authorised the transfer. They fall outside the strongest part of the Code, and their recovery depends on how fast the receiving bank freezes the account, whether the funds have already been moved on, and whether the sending bank’s own controls should have caught it.

That last point is now live law rather than theory. On 18 June 2026, in ASIC release 26-127MR, the Federal Court ordered a $35 million penalty against HSBC for scam protection failures. HSBC admitted, among other things, failing to implement scam controls on the internal payment rail where most customer losses occurred, taking an average of 144 days to investigate customer scam reports, failing to apply ePayments Code rules when determining loss liability, and lacking adequate systems to restore banking access for affected customers. Justice Bennett held the failures were serious. HSBC had paid $21.5 million in compensation as at the release, with further payments due by the end of July 2026, and $6.5 million recovered and returned to customers. ASIC Chair Sarah Court’s assessment was that “Banks have been well on notice about the risks of scams for some time.”

Stage 1 of the Scams Prevention Framework covers three sectors. Settlement isn’t one of them

Australia now has a statutory anti-scam regime. The Scams Prevention Framework Act 2025 (Cth) took effect on 21 February 2025, amending the Competition and Consumer Act 2010. Stage 1 designation followed: according to legal analysis of the instruments published in June 2026, the Competition and Consumer (Scams Prevention Framework – Regulated Sectors) Designation 2026 took effect on 23 May 2026 and designates three sectors — banks, telecommunications carriers and digital platforms. The same analysis indicates the “reasonable steps” obligations commence at the earliest on 31 March 2027, with AFCA expected to become the external dispute resolution scheme for those three sectors from the same date.

Two consequences follow, and both are worth understanding before you repeat anything about the framework to a client.

First, mortgage brokers, aggregators and conveyancers are not in the Stage 1 designated sectors. Nothing in the framework currently imposes SPF obligations on your business. That is a reprieve, not an endorsement — Stage 1 is called Stage 1 for a reason, and the professional services that sit inside the property settlement chain are an obvious candidate for later consideration.

Second, and more immediately relevant: the framework’s obligations and its dedicated dispute pathway do not bite until 2027. A client scammed at settlement this week has no SPF remedy. Their route runs through their bank’s internal dispute resolution, the ePayments Code where it applies, and AFCA under existing jurisdiction. If a client has read a headline about the new scam laws and believes they are protected today, correcting that gently is a genuine service.

The settlement-week protocol

The fix here is process, not vigilance. Vigilance fails because the scam lands on the one day the client is most rushed and least sceptical. Build the following into the file instead.

1. Warn early, in writing, at the front of the file. Put the payment-redirection warning in your initial engagement communication, not at settlement. At settlement it reads as noise. At week one it sets an expectation that account details never change by email.
2. Set the “no change by email” rule explicitly. Tell them: no solicitor, conveyancer, agent or lender will ever change bank account details by email, and if an email says they have, it is a scam until proven otherwise by a phone call.
3. Give them the call-back rule, and the number source. Verify account details by calling the firm on a number the client sourced independently — from the engagement letter, the firm’s website, or a prior call log — never a number in the email carrying the new details.
4. Do not become the source of truth. This is the trap. Do not confirm, forward or hold trust account details on the client’s behalf. If you supply account details and they are wrong, you have moved the exposure onto yourself. Point the client to the source; do not become it.
5. Flag the high-risk windows. Deposit payment, any variation to the contract, and the day before settlement. Those are the moments the intercepted thread pays off.
6. Note it in the file. Date-stamp that the warning was given and the rule explained. If the worst happens, the file note is the record of what you did.
7. Know the first-hour script. If a client calls you first — and some will — the sequence is: call the sending bank immediately and report a scam payment, ask them to contact the receiving institution, report to the client’s bank in writing the same day, report to Scamwatch and Cyber.gov.au, then notify the solicitor so they can warn other clients on the same compromised thread. Speed is the only variable you control.

ASIC’s own consumer guidance runs on a three-step model — stop, check, protect: don’t act under pressure, verify contact details independently, and report to the bank, Cyber.gov.au and Scamwatch. It is a reasonable frame to hand a client, and it costs you nothing to be the person who hands it to them.

Why clients don’t check

Broker Daily’s coverage cited Commonwealth Bank Behavioural Science Centre research finding that scam victims often skipped verification for reasons that were social rather than technical: 34% felt embarrassed, 33% did not think it was necessary, and 31% were confident they could handle it themselves. The same report noted Bankwest data putting phishing at 52% of its scam cases in the last financial year — the only scam type to increase in volume year on year across all demographics — and ANZ figures showing a 24% fall in scam losses alongside more than $100 million prevented or recovered.

The embarrassment finding is the operationally useful one. Clients do not verify because checking feels like accusing a professional of being a fraud. Which means your job is not to tell them to be careful — it is to give them permission, in advance, to make the awkward phone call. “Everyone in this transaction expects you to ring and confirm the account before you send anything. Nobody will be offended” is a more effective control than any warning about scams.

What to watch next

Three things. Whether Treasury’s Stage 2 designations under the Scams Prevention Framework reach professional services in the property chain. Whether AFCA’s determinations post-HSBC start to push harder on sending-bank detection standards for large one-off transfers. And whether lenders begin building settlement-payment verification into their own processes — the first major to do so will make it a competitive point, and brokers will be asked about it.

The bottom line

The number ASIC published this week is not the one that should change your process. $166.8 million in payment redirection losses is. Scam incidence is falling while the loss per successful event concentrates in exactly the kind of large, authorised, one-shot transfer that property settlement requires — and the statutory framework built to deal with it covers the bank, the telco and the platform, not the settlement email, and not until 2027.

That leaves a gap, and the broker sits inside it commercially even while sitting outside it legally. A four-line warning in your first client email, a call-back rule the client understands, and a file note that says you gave both is not a compliance burden. It is the cheapest protection available for the one event that can turn a settled 80% file into a 95% rebuild.