Australian banks are warning about a rise in phone scams where the caller pretends to be from the bank's fraud team. In October 2026, BOQ reported customers getting calls about a "suspicious transaction", a "suspicious sign-in" or a card that had supposedly been compromised. Some people got a text message first, to make the call feel expected. The goal is always the same: to get your card details, the codes for your banking app, or the one-time code sent to your phone.
Why that one-time code matters
A one-time code is the last lock on your account. Even if a scammer already has your card number or password, the code is what stops them from getting in or moving money. Read it out to a caller and you've handed over the key.
These calls can be convincing. Scamwatch says scammers can make a call look like it's coming from your bank's real number, and they may already know your name or address. Your bank will never ask you for your one-time code, PIN or online banking password over the phone.
What to do if the phone rings
Hang up. It's fine to end a call you weren't expecting, even if the caller sounds official or says it's urgent.
Call back on a number you found yourself, such as the one on the back of your card or on the bank's website. Never use a number from the call, text or email.
Never share a code, PIN or password, and never let a caller onto your computer with remote access software.
Already shared something? Call your bank straight away, then call us on (02) 8213 4225.
The same rule applies at work
Multi-factor authentication (MFA) is switched on by default for iHelp IT's managed clients, so your Microsoft 365 sign-ins are protected by a code or an approval prompt as well as your password. That protection only works if the code stays with you. If a sign-in prompt pops up and you aren't signing in, tap Deny and let us know.
Quick tip: restart when your computer asks
iHelp IT handles security updates for every managed client, so you don't need to chase them yourself. Many updates only finish installing after a restart, though. When your computer asks, save your work and restart that day rather than snoozing it for a week.
Keeping software and operating systems patched, along with MFA, is part of the ASD Essential Eight. We recommend the Essential Eight for every business, and strongly recommend it for certain industries.
Need a hand?
If a call, text or email doesn't feel right, check with us before you act. Call (02) 8213 4225 or email support@ihelpit.com.au.
Sources: BOQ, Latest Alerts (October 2026); Scamwatch, Phone scams; Scamwatch, Scammers impersonating banks.
