Scammers exploit Australia’s ReportCyber to steal crypto

Offenders create fabricated case files that name intended victims, then make direct contact while presenting themselves as police. They reference the bogus case number and, in some instances, point victims to legitimate government websites so a report appears to exist.

The approach often uses multiple callers. An initial caller, posing as a police officer, claims the victim is tied to a crypto investigation. A second caller pretends to represent a cryptocurrency company to “confirm” the narrative. The victim is told to move assets between wallets for safety or verification, but the destination address belongs to the scammers. In a recent incident, the target noticed inconsistencies and ended the calls before sending funds.

According to the AFP, the scripts mirror real investigative steps, with references to arrests, ongoing cases and procedural language. Callers share matching details, present fabricated verification documents and coordinate handoffs between the impersonated roles to increase pressure.

Authorities urged caution if contacted about a ReportCyber submission you did not make. Legitimate officers will not request access to cryptocurrency wallets, bank accounts or recovery phrases. Anyone receiving such contact should end the call and verify through official police channels.

ReportCyber is an online system that routes cybercrime reports from the public to the appropriate law enforcement agency. The AFP noted that scammers are leveraging trust in official systems and recognizable URLs to make their claims appear verifiable.

As we covered previously, test lures and research presented at a regional anti-scam forum showed criminals increasingly using cryptocurrency and AI, with reported global online-scam losses around $1 trillion over the past year. Authorities also flagged scam compounds in Southeast Asia and deepfake-enabled heists, including a $25 million transfer in Hong Kong.