TL;DR: The newest bank scam emails don’t have a link. They have a phone number. "New login detected", "Automatic Payment Arrangement Now Active", "new direct debit set up", "unfamiliar charge on your card": call us now. Westpac, NAB and ANZ have all warned about these in 2026. The number reaches a fake fraud team that talks you into moving money to a "safe account" or reading out codes. Never call a number from an email. Use the one on your card or app.
The 2026 versions
| Bank | Email claims | Source |
|---|---|---|
| Westpac (Oct 2026) | New login detected; call this number. Follow-up pushes a "safe" account transfer | Westpac |
| NAB (Sep 2026) | Profile used on a new device / suspicious activity; call this number | NAB |
| NAB (Sep 2026) | "Automatic Payment Arrangement Now Active"; call this number | NAB |
| NAB (Aug 2026) | "Unfamiliar charge on your card"; call or click to approve | NAB |
| ANZ (Feb 2026) | A new direct debit was set up; call this mobile number | ANZ |
Why phone numbers instead of links
People have been told for years "don’t click links." Fair enough. So scammers switched to "call us". Email filters don’t flag a phone number the way they flag a dodgy link, and a human voice is more persuasive than a web page.
It’s the scam equivalent of a shop that got banned from the mall opening a stall in the car park.
What happens on the call
- A calm "fraud specialist" confirms there’s a problem.
- They may know your name, address or partial account number (thanks, data breaches).
- They ask you to read out a code, install an app for "security", or move money to a safe account.
- Your money goes to the scammer.
The rules that beat it
- Never call a number from an unexpected email or text. Use the number on your card, in your app or on the bank’s website.
- No bank uses "safe accounts." Westpac and NAB both say they’ll never ask you to move money to keep it safe.
- Never read out a code. See read-back code scams.
- Never install remote access software for a bank.
If you called and acted
- Hang up. Call your bank on the official number immediately.
- Ask them to stop or recall any payment.
- Change passwords from a different device.
- Report to Scamwatch and ReportCyber; contact IDCARE (1800 595 160).
Forward the email to your bank’s hoax address: full list here. A free exposure check shows if breach data is why they knew your details.
Frequently Asked Questions
Is a "new login detected" email from my bank real?
Westpac and NAB have warned about fake "new login" emails that ask you to call a number. Call your bank on its official number instead.
What is a safe account scam?
A scammer posing as your bank convinces you to move money to a "safe" account that they control. Banks don’t do this.
Why do scam emails ask me to call instead of click?
People are wary of links, and phone numbers are harder for filters to catch. A live caller can also pressure you more effectively.
What should I do if I called the number?
Call your bank on its official number immediately, stop any payments, change passwords and report it.