Monday Scam Brief — 5 October 2026

On 28 September Scamwatch warned that investment scams are showing up inside ordinary chat groups, through people you know, and on fake news pages. From 28 September to 2 October, ASIC added 33 names to the Moneysmart investor alert list. Five are impersonations of real Australian companies. The same day, the Australian Signals Directorate’s Australian Cyber Security Centre warned organisations that stolen keys and login sessions are being used to get into AI services. On 1 October ASD opened Cyber Security Action Month with the theme “Take a second. Stay secure.”

The ATO’s current scam alert is still the September malware email, last updated 18 September: a message about a payment update or an income-statement review that leads to a malicious download. WA ScamNet’s four featured warnings, the ACCC public warning notice register and Telstra’s active scam list had no new item this week.

Official alerts this week

Scamwatch: investment scams hiding in plain sight

Source: Scamwatch (ACCC / National Anti-Scam Centre), 28 September 2026

Scamwatch says these scams often start without a hard sell. One path is a WhatsApp group built around a hobby such as fishing or sport. Once the group feels friendly, someone claiming to be a professor or investment expert pushes a trading platform. Other members post glowing results. The platform may show profits, and a small withdrawal may even go through. When you try to take more money out, you are asked for extra fees or taxes, or the account is blocked.

A second path is a referral from a friend or relative who believes their own account is earning, or who is offered a commission for bringing people in. Scamwatch says the figures they can see may be false, or early payouts may be coming from money paid in by newer investors. Withdrawals are then delayed or refused.

A third path is a fake news story. Scammers copy trusted media brands. Scamwatch’s example is a fake Reuters page that claimed a platform had passed safety checks and had an official partnership with Reuters, then sent readers to open an account. Fake articles about well-known people are used the same way: the story draws you in, and the link leads to the scam.

Warning signs on the alert include pressure to act, an invitation to a chat group that turns into an investment, a celebrity story or “news article” that links to a signup, promises of high or steady returns, a commission for recruiting friends, and any extra payment demanded before you can withdraw.

ASIC Moneysmart investor alert list — new names this week

Source: ASIC Moneysmart investor alert list

ASIC added 33 names from 28 September to 2 October 2026. Five are in the imposter category. The website in the alert is not the company’s real site. None of these five entries lists a real website for the company being copied:

Impersonation of Beta Investing Pty Ltd (ACN 118 586 208, AFSL 403504) at beta-investments.com, added 28 September. ASIC lists the phone (07) 3519 1512 and the email info@beta-contact.com.
Impersonation of FX Corp Pty Ltd (ACN 165 555 046, AFSL 459050) at digitalcab.org, added 28 September.
Impersonation of Innovation Investments Pty Ltd (ACN 162 726 169) at innovationspay.com, added 28 September. ASIC lists an address in Watson, ACT (2602), and the email info@innvoationspay.com.
Impersonation of Remarket Group Pty Ltd (ACN 694 491 640) at remarketsolutions.com, added 28 September. ASIC lists the phone +61 468 095 903.
Impersonation of DNA Invest Pty Ltd (ACN 162 365 040) at dnainvests.com, added 1 October. ASIC lists the phone +61 3 7075 1365.

The other 28 are in ASIC’s unlicensed category. ASIC has not marked them as impersonations of a named licensee. A familiar brand on an unfamiliar domain is still an alert. Names that stand out this week:

Australian Alpha Growth, also styled Aus Markets, at ausmarkets.com.au (30 September).
Pro Wealth Capitals at prowealthcapitals.com, listing 8 Windmill Street, Barangaroo (30 September).
UxoTrade at uxotrade.net, listing the Australian phone +61 2 7264 5216 as well as a UK number, and an address in Basel (1 October).
Marble Zinsara at marblezinara-au.com (30 September).
True Accrumance on two domains, driftmeadowzp.pro (30 September) and cedarnotehubm.info (2 October).
BullBitTrade on two domains, lugovik.top (30 September) and dorivalabs.pro (2 October).
Market Insights on au2.thefortnightlypost.com and au4.offsetdailyau.com, both listing a London address (28 September).

Being on the list means ASIC says that name should not be treated as a licensed way to invest in Australia. An imposter entry means the site is copying a real company. The real company is a separate entity from the website in the alert. The list is not complete: a missing name is not a green light. Check the live list and ASIC’s professional registers before you send money, and match the website, not just the company name. Treat unexpected wealth, broker or crypto offers as hostile until you have verified them yourself.

ASD Australian Cyber Security Centre: access to organisations’ AI services

Source: ASD ACSC, 28 September 2026

ASD says malicious actors are getting into organisations’ AI services with compromised API keys, stolen login tokens, hijacked user sessions, vulnerable apps and third-party access. That access can be used to generate harmful material, copy model capability, burn through paid credits and interrupt real work. A compromised session or agent may also reach other systems the account is connected to.

ASD’s advice is to treat AI access as a security-sensitive asset. Keep an inventory of accounts and keys, give each one an owner, and remove access that is no longer needed. Use phishing-resistant multi-factor authentication, keep keys out of code, documents, logs and prompts, and separate sensitive use from experiments. If a key or session may have leaked, revoke it, isolate the device and keep the logs before you turn access back on.

Cyber Security Action Month

Source: ASD ACSC, first published 1 October 2026. IDCARE is supporting the same month.

October is Cyber Security Action Month. The theme is “Take a second. Stay secure.” ASD is asking people to apply updates, back up important files, turn on multi-factor authentication, use long unique passwords, learn how to recognise and report scams, check privacy settings, and think before posting personal details. IDCARE is carrying the same steps for individuals and small businesses, and will share weekly tips through October. If you have already lost money or had your identity misused, IDCARE’s support line is 1800 595 160.

What to do

Stop. A hobby chat that turns into a trading tip, a friend urging you to invest, or a news link that opens an account form is a warning sign. Pause before you move money. An extra fee or tax demanded before you can withdraw is a warning sign too.
Check. Use a website or phone number you looked up yourself. For an investment, check the investor alert list and ASIC’s professional registers, and match the domain to the real company. Open a news site by typing it yourself.
Protect. Turn on multi-factor authentication for email and banking. Do not read a one-time code back to someone who contacted you. If you look after an organisation’s AI tools, keep API keys out of code, documents and chat prompts, and revoke them if you think they have leaked.

How to report

Scamwatch (ACCC): scamwatch.gov.au/report-a-scam
Report a cybercrime to police via ReportCyber: cyber.gov.au
Identity and recovery support: IDCARE on 1800 595 160

This brief is a public-interest summary of official Australian sources. It is not legal, financial or tax advice. Always rely on the original agency page linked above.