Australia warns of AI-driven scams & account takeovers - SecurityBrief Australia
Australian fraud specialists warn that impersonation scams and account takeovers will intensify in 2027 as artificial intelligence makes fraudulent attempts more convincing and widespread.
Australian fraud specialists and cybersecurity executives warn that impersonation scams and account takeover attacks are likely to intensify in 2027, with artificial intelligence helping to increase the scale and credibility of scam attempts. Recent scam data has sharpened concern across the sector, with Australians reporting AUD $2.18 billion in scam losses in 2025, even as the number of reports fell.
Investment scams accounted for AUD $837.7 million in reported losses, while payment redirection scams accounted for AUD $166.8 million. The experts described a threat landscape in which social engineering is converging with payment fraud, account compromise and impersonation across email, text, websites and phone calls.
They said generative AI is making false endorsements, voice cloning and fabricated business communications more plausible, while stopping short of claiming that every scam is AI-driven.
Beyond Login Checks
Johan Fantenberg, Director Product and Solution Marketing at Ping Identity, said organisations need to move beyond a narrow focus on login checks. Fraud controls, he argued, should assess the wider context of a customer or employee interaction, especially before funds move or account details change.
Fraud will become more industrialised, more convincing and harder to detect through any single channel.
He pointed to a shift from one-off authentication to continuous assessment of identity, device, behaviour and transaction signals. In his view, the key intervention points are high-risk payments, new payees, supplier bank-detail updates, account recovery and unusual login behaviour.
Messaging Front Line
Tori Starkey, Director at Kudosity, described business messaging as a front line in the fight against impersonation. She said AI is improving the quality of fake messages, voices and video, while Australia's sender verification measures are giving legitimate businesses stronger ways to prove who they are.
I expect a growing contest between increasingly convincing impersonation and stronger ways to establish who a business really is.
Starkey said the SMS Sender ID Register is making it harder to impersonate brands through text messages. She also highlighted RCS Business Messaging, which adds verified business identities and branded profiles in supported messaging services.
Data Sharing Challenges
Both commentators said stronger verification alone will not be enough. Useful signals often sit across banks, telcos, digital platforms, identity systems, devices and customer service teams, but governance and privacy issues can slow fraud prevention efforts.
Fantenberg said businesses must establish legal authority for information sharing, set limits on what data is used, and maintain controls over access, security and retention. Starkey raised similar concerns in the messaging environment, noting the need for clear ownership of messaging accounts, agency authorizations, and understanding how providers process message content.
David Caspari, Managing Director and Vice President ANZ at Check Point Software Technologies, said scams now combine AI-generated phishing, impersonation, malicious websites, SMS and phone calls. He emphasized that staff behavior remains critical alongside technical controls, particularly when messages create urgency or seek credentials through unfamiliar channels.
Related
