Monday Scam Brief — 2 November 2026

ASIC added 24 names to the Moneysmart investor alert list between 26 and 30 October. Four are impersonations of real companies: LWP Capital, Grovesta, Glen Elgin Investments and All Roads Wholesale Fund. The other 20 are unlicensed names. Two put BlueSkyMint, a name ASIC has listed since August, onto new domains.

On 29 October the Australian Taxation Office updated its scam alerts page. The new alert is an email that says you must complete a crypto-asset disclosure form. The link opens a fake ATO site that collects personal information and cryptocurrency wallet details.

Scamwatch’s news feed has no item newer than the 28 September investment-scam alert. WA ScamNet’s four featured warnings are unchanged: event and festival tickets, fake shipping-container sites, flexible-work job scams, and tax phishing emails. The ACCC public warning notice register’s newest entries are still the 3 July 2025 ghost-store notices. Telstra’s active scam list had no new scam type. The Australian Signals Directorate’s alerts page has nothing newer than the 23 October Fortinet alert. The National Anti-Scam Centre’s newest news item is still 14 September.

Official alerts this week

ASIC Moneysmart investor alert list — new names this week

Source: ASIC Moneysmart investor alert list

ASIC added 24 names from 26 to 30 October 2026. The list checked on 2 November had no names dated after 30 October. Four are in the imposter category. The website or contact in the alert is not the company’s real site:

Impersonation of LWP Capital Pty Ltd (ACN 620 956 550, AFSL 540596) at lwp-capitalltd.com, added 29 October. ASIC lists the email info@lwp-capitalltd.com and the phone +61 27239 9523. ASIC lists no real website.
Impersonation of Grovesta Pty Ltd (ACN 682 169 544) at grovestafund.com, added 27 October. ASIC lists the alias Grovesta and the email support@grovestafund.com. ASIC lists no AFSL and no real website.
Impersonation of Glen Elgin Investments Pty Ltd (ACN 166 953 653, AFSL 510708) at glenelgininvestments.com, added 27 October. ASIC lists 10 Franklin St, Adelaide SA 5000, the phone +61 (0) 8 7094 5242 and the email info@glenelgininvestments.com. ASIC lists the real company’s website as netherfieldcapital.com.
Impersonation of All Roads Wholesale Fund Limited (ACN 119 506 937, AFSL 305740) at tcap-group.com, added 26 October. ASIC lists the email info@tcap-group.com, the phone 442038075602, and the address City of London, United Kingdom. ASIC lists no real website.

The other 20 are in ASIC’s unlicensed category. ASIC has not marked them as impersonations of a named licensee. A familiar brand on an unfamiliar domain is still an alert. Names that stand out this week:

BlueSkyMint on two domains, both added 30 October: blueskymint-ltd.com and area.bl-sym.com. ASIC lists the alias Blue Sky Mint. The first domain lists 20 Fenchurch St, London EC3M 3BY, the emails support@blueskymint-ltd.com and info@blueskymint-ltd.com, and the phones +61 870 922 858, +44 2039 965 526 and +41 717 793 390. The second is a login page and lists no extra contact. ASIC listed Blue Sky Mint on 12 August at blueskymint.com and blueskymintltd.com.
Southledger on two domains, both added 28 October: southledger.com and southledgers.com. Both list the email support@southledger.com.
Finance AU at au2.finenceau.com, added 28 October. ASIC lists 20 Wenlock Road, London, England, N1 7GU. The domain spells finance as finence.
CA-TDX at ca-tdx.com, added 29 October. ASIC lists a login page at live.ca-tdx.com, the email support@ca-tdx.com, and the address 152 Vaughan Way, London.
Meritbrace Equity at cazkadelufepm.pro, added 27 October. ASIC lists the alias Valorstead. ASIC listed Valorstead on 15 September at valorstead.biz and on 13 October at themoneydetectives.com.
LedgerFintech at ledgerfintech.com, added 26 October. ASIC lists the alias Ledger Fintech, the email support@ledgerfintech.com, and the address Havannah St, Cardiff, CF10 1DX, Wales. The name uses the word Ledger. ASIC has not marked this entry as an impersonation of a named licensee.
Billabongbrief at billabongbrief.com/ai-app-au, added 26 October.
OakridgeAU at oakridgeau.com, added 26 October. ASIC lists the alias Oakridge AU, the email support@oakridgeau.com, and the phone 0468 059 931.
Elevate North Advisors at elevatenorthadvisors.com, added 27 October. ASIC lists the email support@elevatenorthadvisors.com, the phone +41 (55) 455 02 04, and the address 1214 Vernier, Chemin de l’Ecu 12. ASIC’s entry points to a Swiss FINMA warning for the same name.

ASIC also added these unlicensed names on 26 and 27 October: Ultimopay at ultimopay.io (ASIC lists the phone 1234567890 and the address Armstrong House, Front St, Bamburgh NE69 7BJ), Unrive at unrive.io, Vertex Fluxrov at vertexfluxrov.net, Plaza Activoire at plazaactivoire-ai.net, Molen Waardhoph at molenwaardhoph.com, Bit AI App at bitalapp.net, BluevaultDdexeris at bluevaultddexeris.org, Immediate Income at immediateincome.net, and Equitonbury at lofotenaliqua.info.

Being on the list means ASIC says that name should not be treated as a licensed way to invest in Australia. An imposter entry means the site or contact is copying a real company. The real company is a separate entity from the website in the alert. The list is not complete: a missing name is not a green light. Check the live list and ASIC’s professional registers before you send money, and match the website, not just the company name. Treat unexpected wealth, broker or crypto offers as hostile until you have verified them yourself.

Australian Taxation Office: cryptocurrency compliance email

Source: ATO scam alerts, page last updated 29 October 2026

The ATO says it has received reports of a new email impersonation scam. The email claims you must complete a crypto-asset disclosure form. Some versions say that failing to complete it will bring financial charges and administrative penalties. The link opens a fake ATO website. The ATO says that site uses compliance requirements, penalties and deadlines to create urgency, and that it may refer to tax rulings and determinations. The site is built to collect personal information and cryptocurrency wallet information. The ATO says variations have been reported.

The ATO’s published example is an email dated 9 October 2026. The display name is Australian Taxation Office, Compliance Division. The address shown is sales@tangshanautomation.com, which is not an ato.gov.au address. The subject is Formal Notification: Digital Asset Tax Obligations. The message gives 24 hours to fill in the form and links to “COMPLETE DISCLOSURE FORM”. The fake page that follows copies the ATO header, asks for a name, date of birth, address, phone and email, and includes a button labelled Continue to Wallet Verification. Another example on the ATO page is headed Self-disclosure regarding crypto assets.

The ATO says it will never send an unsolicited message that directs you to provide personal information, login credentials or cryptocurrency wallet details through a link in an email or SMS. Do not reply, click the link, or enter wallet details. Forward the email to ReportScams@ato.gov.au and delete it. If you opened the site or gave information, phone the ATO on 1800 008 540. Open the real ATO only by typing ato.gov.au yourself.

The September malware alert is still on the same page. It is not new this week. That one is a payment-update or income-statement message that leads to a malicious download, last updated 18 September.

What to do

Stop. An email that gives you 24 hours to disclose crypto holdings, a trading site one character away from a real broker, or a .com address that is not the licensee’s site is a warning sign. Pause before you click, move money, or type a wallet seed phrase. An extra fee or tax demanded before you can withdraw is a warning sign too.
Check. Use a website or phone number you looked up yourself. For an investment, check the investor alert list and ASIC’s professional registers, and match the domain to the real company. Open the ATO, myGov or your bank by typing the address yourself, or call the ATO on 1800 008 540. A sender address that does not end in .gov.au is not the ATO.
Protect. Turn on multi-factor authentication for email, banking and any crypto exchange, and use a passkey where you can. Do not read a one-time code back to someone who contacted you. Do not enter wallet details on a page you reached from an email.

How to report

Scamwatch (ACCC): scamwatch.gov.au/report-a-scam
Report a cybercrime to police via ReportCyber: cyber.gov.au
Identity and recovery support: IDCARE on 1800 595 160

This brief is a public-interest summary of official Australian sources. It is not legal, financial or tax advice. Always rely on the original agency page linked above.

Sources used

Scamwatch’s news-and-alerts HTML page returned HTTP 403 to the automated fetch on 2 November 2026. The news RSS was opened the same day. The newest item is the 28 September investment-scam alert. The ACCC public warning notice register also returned HTTP 403 to the automated fetch. The register was opened the same day, and its newest notices remain those dated 3 July 2025. The National Anti-Scam Centre news page returned HTTP 403 to the automated fetch. The news page was opened the same day. Its newest item is 14 September 2026. No NASC news item is dated in the last seven days.