Monday Scam Brief — 21 September 2026

The Australian Taxation Office is warning about a new malware email that pretends to be a payment update or an income-statement review. Clicking through can install remote-access software on your device. ASIC also added 37 names to the Moneysmart investor alert list, including four impersonations of real Australian companies. In Western Australia, Consumer Protection warned that fake concert and festival tickets are already circulating ahead of summer.

Scamwatch did not publish a fresh news-and-alerts item after 17 August. Older official warnings on fake purchase-callback texts remain current.

Official alerts this week

ATO: September malware email

Source: ATO scam alerts (last updated 18 September 2026)

The ATO has received reports of emails that look like they come from the Tax Office. The message may say there is a new payment update in your ATO profile, or that you need to review your income statement, and it includes a link. The link opens a page that asks you to view or download a file. That download is malicious remote-desktop software, which can give the scammer control of your device.

The ATO will not send an unsolicited message that takes you to a log-in page. Do not click the link, open the attachment or download the file. Forward the email to ReportScams@ato.gov.au and delete it. If you already clicked, entered details or made a payment, call the ATO on 1800 008 540. Sign in only through ato.gov.au or my.gov.au that you typed yourself.

ASIC Moneysmart investor alert list — new names this week

Source: ASIC Moneysmart investor alert list

Between 14 and 17 September 2026 ASIC added 37 names. Most are unlicensed crypto- or trading brands on throwaway domains. Four impersonate real Australian companies:

Impersonation of Guppytraders.com Pty Ltd (ACN 089 941 560) at ausprimecapital.com.au — the real site is guppytraders.com
Impersonation of Frequency Ventures Management Pty Ltd (AFSL 493852) at frequency-ventures.com, listing a Camberwell, Victoria address — the real site is frequencyventures.com
Impersonation of HFT Enterprises Pty Ltd (ACN 151 987 218) at hft-markets.com, listing a Macquarie Place, Sydney address
Impersonation of 102 Pty Ltd (ACN 659 864 865) at 102pty.ltd

Unlicensed names added this week include a DGI Group pair (connectwithdgi.com, readaboutdgi.com), AI-Pro-App at aussiebrief.com, Kyprionex, Immediate Bienestar, Stockerpro Trade, PeakView Capital Wealth, a Velo-Syn pair, Digital Asset Reserves, LXT Group, Evulus (listing Melbourne), Libre Creditance (listing a Canberra address) and a further Keen Accruvance domain at flashvibeup.info. Being on the list means ASIC says the operator is not licensed to offer investments in Australia. The list is not complete: a missing name is not a green light. Check the live list and ASIC’s professional registers before you send money, and treat unexpected wealth, broker or crypto offers as hostile until you have verified them yourself.

WA ScamNet / Consumer Protection WA: fake event tickets

Source: Consumer Protection WA, 17 September 2026

WA ScamNet is already seeing fake-ticket reports as summer festivals and outdoor concerts approach. More than $1,000 was reported stolen in the first few days of September. Last year more than 80 per cent of those losses landed in the warmer months.

The ads appear on social media and online marketplaces. Payment is usually by bank transfer or PayID. New seller profiles with little history are a warning sign. After you pay, the seller disappears — or you only find out at the gate that the ticket is fake, duplicated or cancelled. Buy from the official seller or a verified reseller. If you deal with a private seller, use PayPal Goods and Services, not bank transfer and not PayPal Friends and Family. Too-cheap tickets are not a bargain. Report attempts to WA ScamNet.

Telstra active scams — two newly listed types

Source: Telstra active scams

Telstra’s Cyber Security team added two descriptions to its current list:

“Buy it for me” scams. Someone you met online, on social media or in person asks you to buy an expensive device, often a new phone, and promises to pay you back. They never do. You are left with the bill. Do not buy a device you cannot pay for yourself.
Emoji email scams. An email that claims to be from Telstra and uses emojis in the subject — a flashing light, a megaphone or similar — is a scam. Telstra says it does not send official account, payment or invoice emails with emoji characters in the subject.

Check bills and account changes only in the My Telstra app or on telstra.com.au that you typed yourself.

Still active official warnings

Fake purchase-callback texts

Source: Scamwatch, 14 July 2026

A message claims you bought something you did not buy and tells you to call a number to cancel. The number is the scammer. Hang up and check any real purchase through the store’s official app or website. Do not read back a one-time code to anyone who rang you.

ATO and myGov impersonation

Source: Scamwatch and the ATO, 26 June 2026

Emails, texts and calls pretending to be from the ATO or myGov are still circulating, now including the September malware variant above. The ATO will not demand urgent payment by gift card, crypto or a transfer to a “safe account”. Sign in only through ato.gov.au or my.gov.au that you typed yourself.

ASD Australian Cyber Security Centre: switch on multi-factor authentication

Source: ASD ACSC, 1 September 2026

ASD’s September campaign is still current. A password on its own is no longer enough. Turn on phishing-resistant multi-factor authentication, starting with email, banking and social-media accounts. Prefer passkeys where a service supports them; otherwise use an authenticator app. Do not read a one-time code back to anyone who rang or messaged you first. Setup steps are on the Centre’s multi-factor authentication guide.

What to do

Stop. Unexpected messages that rush you to pay, call, click, buy gift cards or share codes are a warning sign. Pause.
Check. Use a phone number or website you already know, not the one in the message. For investments, check ASIC’s registers and the investor alert list. For tickets, use the official seller.
Protect. Turn on multi-factor authentication. If money or details have gone, contact your bank first, then report it.

How to report

Scamwatch (ACCC): scamwatch.gov.au/report-a-scam
Report a cybercrime to police via ReportCyber: cyber.gov.au
Identity and recovery support: IDCARE on 1800 595 160

This brief is a public-interest summary of official Australian sources. It is not legal, financial or tax advice. Always rely on the original agency page linked above.