TL;DR: CommBank says it never sends an SMS or email asking for your NetBank client ID or password, never asks you to share a NetCode, and never includes a link to log in directly. Watch for the digital wallet scam, where someone gets your card details and NetCode and adds your card to their phone. Not sure a caller is real? Ask them to use CallerCheck in the CommBank app. Forward fakes to hoax@cba.com.au.
What CommBank never does
From CommBank’s report hoaxes page:
- Send an SMS or email asking for your NetBank client ID or password
- Ask you to share a NetCode
- Include a link in an SMS or email to log in directly
Type commbank.com.au yourself or open the CommBank app instead.
The three scams CommBank flags
1. SMS and email phishing. Messages link to fake sites or ask for personal info.
2. Digital wallet scams. This one’s sneaky. Scammers trick you into sharing your card details and NetCode, then use them to add your card to a digital wallet on their phone. From then on, they tap and pay with your card, no physical card needed. The NetCode is the final lock, and you’re the one being asked to open it.
3. Remote access scams. A caller claims to be from a well-known company and wants access to your device or accounts.
CallerCheck: verify a real caller
If someone calls saying they’re from CommBank, you can ask them to use CallerCheck in the CommBank app. A real CommBank staff member can send a check to your app. If they can’t or won’t, hang up.
What CommBank has changed
CommBank says its measures are working. According to Australian Broker (August 2025):
- customer scam losses had fallen 76% from their peak in the first half of 2023;
- CommBank invested more than $900 million in FY25 against fraud, scams, financial crime and cyber threats;
- from August 2025, some online card purchases need real-time approval in the CommBank app instead of an SMS one-time code;
- its identity-protection app Truyu added a free Scam Checker: upload a screenshot of a suspicious text and get an instant assessment.
That in-app approval matters for the digital wallet scam. Codes sent by SMS can be read out to a scammer; an approval screen in your own app shows what you’re approving. If it says "add card to a new device" and you didn’t ask for that, decline it.
CommBank’s general manager of group fraud, James Roberts, has said scammers often impersonate legitimate businesses by text, and that the app can give clearer guidance and warnings than a text message can.
Red flags in a "CommBank" text
| What you see | Why it’s a scam |
|---|---|
| A link to "log in," "verify" or "unlock" | CommBank says it never includes a login link in SMS or email |
| A request for a NetCode | CommBank never asks you to share one |
| "A new device has been added; call this number" | Use the number in the app or on your card, never the one in the message |
| A caller who refuses CallerCheck | Real CommBank staff can send one to your app |
How to report
- Forward the suspicious SMS or email to hoax@cba.com.au.
- Or use "Report an email or SMS" to send a copy or screenshot.
- Delete the message.
- Also forward scam texts to ACMA on 0429 999 888 (guide).
If you clicked or shared a NetCode
- Contact CommBank straight away through the app’s Message us or the official contact page.
- Change your NetBank password.
- Check for unfamiliar digital wallet devices or transactions.
- Report to Scamwatch; get help from IDCARE (1800 595 160).
The bigger lesson
A code that arrives on your phone is for you to use, never to tell someone else. That’s true for every bank, and for food delivery apps too. Our read-back code guide covers it. A free exposure check shows if your details are in the breaches scammers use.
Frequently Asked Questions
Does CommBank send texts with links to log in?
No. CommBank says it never includes a link in an SMS or email to log in directly.
Will CommBank ask for my NetCode?
No. CommBank says it never asks you to share a NetCode.
How do I report a CommBank scam text?
Forward it to hoax@cba.com.au, then delete it.
Has CommBank stopped using SMS codes?
From August 2025, some online card purchases need real-time approval in the CommBank app instead of an SMS code, according to Australian Broker.
What is CommBank CallerCheck?
A feature that lets a real CommBank caller verify themselves through your CommBank app.