Australia warns of AI-driven scams & account takeovers

Australian fraud specialists and Cyber Security executives warn that impersonation scams and account takeover attacks are likely to intensify in 2027, with artificial intelligence helping to increase the scale and credibility of scam attempts.

Recent scam data has sharpened concern across the sector. Australians reported AUD $2.18 billion in scam losses in 2025, according to figures cited by the commentators, even as the number of reports fell. Investment scams accounted for AUD $837.7 million in reported losses, while payment redirection scams accounted for AUD $166.8 million.

The experts described a threat landscape in which social engineering is converging with payment fraud, account compromise and impersonation across email, text, websites and phone calls. They said generative AI is making false endorsements, voice cloning and fabricated business communications more plausible, while stopping short of claiming that every scam is AI-driven.

Johan Fantenberg, Director Product and Solution Marketing at Ping Identity, said organisations need to move beyond a narrow focus on login checks. Fraud controls, he argued, should assess the wider context of a customer or employee interaction, especially before funds move or account details change.

"Fraud will become more industrialised, more convincing and harder to detect through any single channel," said Johan Fantenberg, Director Product and Solution Marketing, Ping Identity.

He pointed to a shift from one-off authentication to continuous assessment of identity, device, behaviour and transaction signals. In his view, the key intervention points are high-risk payments, new payees, supplier bank-detail updates, account recovery and unusual login behaviour.

Tori Starkey, Director at Kudosity, described business messaging as a front line in the fight against impersonation. She said AI is improving the quality of fake messages, voices and video, while Australia's sender verification measures are giving legitimate businesses stronger ways to prove who they are.

"I expect a growing contest between increasingly convincing impersonation and stronger ways to establish who a business really is," said Tori Starkey, Director, Kudosity.

Starkey said the SMS Sender ID Register is making it harder to impersonate brands through text messages. She also highlighted RCS Business Messaging, which adds verified business identities and branded profiles in supported messaging services. That changes the balance from asking customers to judge a message by its wording alone, she said.

Both commentators said stronger verification alone will not be enough. Useful signals often sit across banks, telcos, digital platforms, identity systems, devices and customer service teams, but governance and privacy issues can slow fraud prevention efforts. When those signals are fragmented, organisations may spot risk too late.

Fantenberg said businesses must establish legal authority for information sharing, set limits on what data is used, and maintain controls over access, security and retention. He also said automated decisions need clear ownership, monitoring and a path to human review.

Starkey raised similar concerns in the messaging environment. She said organisations need clear ownership of messaging accounts, agency authorisations, APIs and employee access. Companies introducing richer messaging and AI tools should also understand how providers process message content, who can access it and how long information is retained, she said.

The payments data offered another note of caution. Fantenberg said he expects more attempted fraud and more targeted attacks, but not a uniform rise across every metric. He noted that while reported scam losses increased, Australian-issued card fraud fell to about AUD $854 million in the 2024-25 financial year, and its rate per dollar spent also declined.

That mixed picture has pushed attention towards prevention before money leaves an account. The commentators said businesses should strengthen account recovery, secure privileged access, independently verify bank-detail changes and payment requests, and measure outcomes such as prevented losses, intervention times, false positives and repeat victimisation.

David Caspari, Managing Director and Vice President ANZ at Check Point Software Technologies, said scams now combine AI-generated phishing, impersonation, malicious websites, SMS and phone calls. He said staff behaviour remains critical alongside technical controls, particularly when messages create urgency or seek credentials or payment details through unfamiliar channels.

Pressure on governance is also rising as scams policy moves into operational practice. The commentators pointed to the Scams Prevention Framework as a major compliance driver for banks, telecommunications providers and digital platforms. Readiness is becoming a board-level issue rather than a narrow technology task, they said.

For all three, the common message was that fraud defence now depends on identity assurance, channel trust, rapid verification and human oversight. Attack methods may be changing quickly, but the most vulnerable moments remain the same: when a customer or employee is asked to trust a message, change an account or move money.