TL;DR: On June 8, 2026, the AFP and Royal Thai Police revealed a script found in a scam compound in O’Smach, Cambodia in January 2026. It told scammers to claim a victim’s identity had been used to open a bank account linked to a money laundering investigation. The AFP identified about 300 potential Australian victims, whom the National Anti-Scam Centre warned by text in February.
What happened
The joint release says scammers moved victims to encrypted video calls, had them record a statement and asked them to identify a fake suspect. The aim was to collect bank details and withdraw funds.
The NASC warned around 300 Australians on February 11, 2026 after documents seized in a Thai-led raid included their phone numbers, names and addresses. The NASC never sends texts that include a phone number to call, or links or attachments.
Operation Firestorm, launched in August 2024, has supported five offshore scam centre investigations leading to 560 arrests and the disruption of 15 scam centres in Thailand, the Philippines, Malaysia and Cambodia.
Why it works
The script is built to make a stranger feel like both a suspect and a witness, which keeps people on the line and secret. Video calls and a “statement” add false formality.
Being on such a list does not mean you have been scammed, but it means unexpected contact is more likely.
Background: our explainers on vishing. See also ACMA Q1 2026: 109.3M Scam Calls Blocked, Lycamobile Penalised and ASIC Now Lists Licensee Websites to Help You Spot Fake Sites.
What the AFP and NASC advise
- Pause before acting on any call, text or email claiming to be from the AFP, even if it seems convincing.
- The AFP will not ask for bank details, passwords or money over the phone or video, and police will never ask you to move money to a “safe account”.
- Do not join new calls or video sessions described as “protection” or “verification”.
- Report through ReportCyber; if you sent money, contact your bank right away; if you spotted a scam but sent nothing, report to Scamwatch.
If you have already sent money
Contact your bank immediately, report the scam to Scamwatch and through ReportCyber, and call IDCARE on 1800 595 160 if your identity may be at risk. Our guides on the Scamwatch and IDCARE recovery process, Australian bank impersonation scams and how to reverse a wire transfer scam explain the steps, and what to do after a scam, wherever you live covers the first 24 hours. Scammers often start with details taken from past leaks, so run our free digital footprint check to see what of yours is already exposed.
Frequently Asked Questions
What did the script tell scammers to say?
To claim the victim’s identity had been used to open a bank account linked to a money laundering investigation.
How many Australians were warned?
About 300, by text from the National Anti-Scam Centre on February 11, 2026.
Does the NASC send texts asking you to call?
No. The NASC never sends texts that include a phone number to call, or links or attachments.
Will police ask me to move money to a safe account?
No. The AFP says police will never ask you to move money to a “safe account”.
Sources
- AFP: Revealed, the sophisticated script Cambodian scammers used to pose as AFP officers (Jun 8, 2026)
- Scamwatch: National Anti-Scam Centre warns 300 Australians of data exposure (Feb 11, 2026)
Related Reading
- ACMA Q1 2026: 109.3M Scam Calls Blocked, Lycamobile Penalised
- ASIC Now Lists Licensee Websites to Help You Spot Fake Sites
- West Shore RCMP: Fake Police Letter Demands a Fine in 24 Hours
- Australia Scam News: October 2026 Roundup and Warnings
- Average Loss per Victim by Scam Type (2025)
- What to do after a scam, wherever you live