TL;DR: On April 7, 2026, Scamwatch and the ACMA issued a joint alert on mobile number fraud: criminals take control of a mobile number or change a phone account, then receive verification codes to reset passwords on services such as bank accounts and myGov. Warning signs include a phone suddenly losing service or showing “SOS only”.
What happened
The alert says scammers may gain access through a compromised email account, stolen ID documents, or passwords obtained through phishing or data breaches. They then receive verification codes and use them to reset passwords and lock victims out of accounts. The alert contains no statistics.
Separately, the ACMA said telcos have paid almost A$5 million in penalties over 18 months. SpinTel paid A$59,400 after scammers exploited a weakness to obtain one-time verification codes: between February and March 2025 they transferred 10 consumers’ mobile numbers without authorisation, with reported losses over A$45,000. SpinTel also agreed to an 18-month court-enforceable undertaking.
Why it works
The number is the key to many accounts because services text a code to it. Whoever controls the number can reset the password and receive the code.
Under the Mobile Number Pre-Porting Additional Identity Verification Industry Standard, providers must verify a customer’s identity before transferring a service.
Background: our explainers on how common SIM swapping is in 2026 and setting up passkeys and an authenticator app. See also ACMA Q1 2026: 109.3M Scam Calls Blocked, Lycamobile Penalised and Scamwatch Alert: Fake Personal Loan Providers Charge Upfront Fees. For wider numbers, see our data page on breaches loaded into Have I Been Pwned.
What Scamwatch and ACMA advise
- If your phone stops working unexpectedly or you see suspicious activity, contact your bank first, then your phone provider.
- Change passwords, check bank statements, and call IDCARE on 1800 595 160 if scammers have your personal details.
- Verify any contact claiming to be your telco by calling the number on your bill or the official website or app.
- Use strong, unique passwords and multi-factor authentication, and delete emails containing ID documents so they cannot be accessed if your email is compromised.
If you have already sent money
Contact your bank immediately, report the scam to Scamwatch and through ReportCyber, and call IDCARE on 1800 595 160 if your identity may be at risk. Our guides on the Scamwatch and IDCARE recovery process, Australian bank impersonation scams and how to reverse a wire transfer scam explain the steps, and what to do after a scam, wherever you live covers the first 24 hours. Scammers often start with details taken from past leaks, so run our free digital footprint check to see what of yours is already exposed.
Frequently Asked Questions
What is mobile number fraud?
Criminals take control of your mobile number or make unauthorised changes to your phone account so they can receive verification codes and reset passwords.
What are the warning signs?
Unexpected account alerts, verification codes you did not request, password reset emails you did not start, or your phone suddenly losing service or showing “SOS only”.
Who should I contact first?
Your bank first, then your phone provider, according to the Scamwatch and ACMA alert.
What did the ACMA do about SpinTel?
SpinTel paid A$59,400 and agreed to an 18-month court-enforceable undertaking after scammers transferred 10 consumers’ numbers without authorisation.
Sources
- Scamwatch: Scam alert, watch out for mobile fraud (Apr 7, 2026)
- ACMA: Compliance net tightens on mobile number fraud (2026)
Related Reading
- ACMA Q1 2026: 109.3M Scam Calls Blocked, Lycamobile Penalised
- Scamwatch Alert: Fake Personal Loan Providers Charge Upfront Fees
- SIM-Swap Fraudster Jailed After Almost £200,000 Crypto Theft
- Australia Scam News: October 2026 Roundup and Warnings
- Breaches Loaded Into Have I Been Pwned, 2024 to 2026
- What to do after a scam, wherever you live
- Do Not Call Register Australia: How to Register