Fraud risks facing Australian financial institutions

Australian financial institutions sit at the centre of a fraud ecosystem shaped by instant payments, digital onboarding, data-rich customer relationships, and increasingly convincing impersonation.

In 2025, combined scam losses reported across key Australian channels reached $2.18bn, an increase of 7.8%, despite the number of reports falling. Investment scams accounted for $837.7m, while payment redirection scams resulted in losses of $166.8m.

These figures highlight the financial consequences of fraud and the increasing sophistication of the methods being used. A fraudulent payment can be authorised and transferred within seconds, stolen identities can be used to open accounts remotely, and criminals can impersonate customers, executives, or professional advisors with remarkable accuracy.

For financial institutions, fraud exposure extends across customer onboarding, payments, lending, cybersecurity, AML/CTF, third-party relationships, and internal operations. Understanding where these risks intersect is increasingly important for Boards and senior management.

How fraud is exploiting gaps in financial institutions

A fraud incident can involve several processes and control points before a loss is identified.

A stolen identity may satisfy digital onboarding requirements, and the resulting account may remain inactive before receiving scam proceeds, which are then rapidly transferred to other accounts or overseas. Similarly, a fraudulent payment instruction may pass through customer service, authentication, and transaction processing without any individual control identifying the full circumstances.

These situations demonstrate why fraud prevention depends on the quality of information shared between teams, the effectiveness of controls throughout the customer relationship, and the speed at which suspicious activity can be escalated.

Several areas warrant particular attention.

Scams, account takeover & payment redirection

Investment scams, phishing, remote-access fraud, and compromised digital banking credentials continue to expose customers and institutions to substantial losses.

Payment redirection fraud is particularly concerning. Criminals may impersonate a supplier, customer, or professional advisor and request changes to banking details, often using legitimate-looking correspondence or compromised email accounts.

Verification procedures can fail when staff confirm a change through the same email address or communication channel used by the fraudster.

Institutions also need to identify circumstances where customers have authorised payments themselves after being deceived, as traditional controls designed around unauthorised transactions may fail to detect these situations.

Fraudulent onboarding & money mule accounts

Stolen identities, synthetic identities, and recruited account holders are used to establish accounts that receive and disperse fraudulent funds.

New accounts receiving payments from unrelated parties, followed by rapid transfers or withdrawals, may indicate money mule activity. Company structures and intermediaries can further complicate identification of the individuals controlling an account.

The connection between onboarding information and ongoing transaction monitoring is particularly important. Information that appears unremarkable during account opening may become significant when considered alongside subsequent account activity.

AI-enabled impersonation & document fraud

Artificial intelligence is making identity and document fraud increasingly convincing.

AI-generated identification documents, cloned voices, deepfake videos, and highly personalised communications can be used to impersonate customers, employees, and executives.

These techniques create vulnerabilities in digital onboarding, contact-centre authentication, and payment verification, particularly where processes rely on static personal information, document appearance, or voice recognition without additional safeguards.

Financial institutions should be testing how their existing controls respond to these techniques, including whether staff can recognise and appropriately escalate suspected impersonation.

Mortgage, lending & application fraud

Fraudulent loan applications can involve overstated income, fabricated financial records, identity misuse, manipulated property information, and collusion between borrowers, brokers, or other parties.

These risks can be difficult to detect when individual documents appear credible, or information is independently verified through compromised or related parties.

Controls should consider the broader application process, including the conduct of intermediaries, inconsistencies between supporting documents, and patterns across related applications.

Insider fraud & collusion

Employees and contractors may have access to customer information, payment systems, approval authorities, and knowledge of internal control processes.

Unauthorised overrides, misuse of privileged access, and collusion with external parties can enable fraud to continue undetected.

Changes in personnel, offshore processing arrangements, and inadequate reviews of system access can increase exposure, particularly where employees retain permissions beyond those required for their roles.

Third-party & outsourced operations

Financial institutions increasingly rely on payment providers, fintech platforms, brokers, technology providers, shared service centres, and outsourced operations.

These arrangements create additional points of exposure where responsibilities for fraud prevention, monitoring, incident reporting, and investigation may be shared between organisations.

Institutions need assurance that third-party controls are operating effectively and that suspicious activity can be identified and escalated without unnecessary delay.

Overseas banks operating in Australia

Foreign bank branches and subsidiaries face additional challenges arising from cross-border transactions, reliance on global systems, and offshore decision-making.

In April 2026, AUSTRAC reported that 50 foreign bank branches had moved $2.5 trillion into and out of Australia over the preceding year. Its supervisory work identified low levels of suspicious matter reporting among foreign branches and money mule risks within foreign bank subsidiaries.

These findings are particularly relevant given the nature and volume of transactions undertaken by foreign-owned banks.

Cross-border payments can move suspected fraud proceeds beyond Australian recovery channels quickly. Trade finance and correspondent banking also create exposure to false invoicing, fraudulent trade documents, complex ownership structures, and sanctions evasion.

Some overseas banks rely on group-wide transaction monitoring, customer due diligence systems, and offshore investigation teams. While these arrangements can provide consistency across jurisdictions, the controls must also account for Australian payment behaviour, scam typologies, suspicious matter reporting obligations, and local regulatory expectations.

Australian management should be able to demonstrate how these risks are identified, monitored, and escalated, including where decisions or investigations are undertaken offshore.

Clear accountability is particularly important when an incident requires immediate intervention across multiple institutions or jurisdictions.

Warning signs that warrant closer attention

Certain patterns of activity can provide early indications of fraud exposure or weaknesses in existing controls.

For Boards and executives, areas worth examining include:

• fraud, AML/CTF, cybersecurity, customer complaints, and operations teams identifying related issues without sharing intelligence
• unusual account activity that includes recently opened accounts receiving funds from unrelated parties and rapidly transferring them through domestic or international payment channels
• customer contact details, beneficiary information, or staff access permissions being changed shortly before high-value payments or unusual account activity
• payment recalls, scam complaints, or law enforcement enquiries involving common accounts, devices, addresses, or intermediaries
• identity or payment verification requirements being overridden without independent approval or adequate supporting evidence
• reporting levels that appear inconsistent with the institution’s transaction volumes, customer profiles, or cross-border activity
• management being unable to explain how offshore monitoring systems identify locally relevant fraud patterns
• external providers identifying suspicious transactions or behaviour before internal monitoring systems.

Individually, these indicators may have legitimate explanations. Repeated or connected activity, however, can expose weaknesses in an institution’s fraud prevention and detection arrangements.

What should Boards & executives be asking?

Fraud risk reporting should provide a clear understanding of the institution’s exposure, the effectiveness of existing controls, and the ability to respond when suspicious activity is identified.

There are several questions worth putting to management.

1. Where can funds move through our institution faster than suspicious activity can be identified, stopped, or recovered?
2. Can we connect customer onboarding, device information, payments, complaints, cyber incidents, and AML/CTF intelligence to identify related accounts and broader fraud networks?
3. How have our identity verification and payment controls been tested against AI-generated documents, voice cloning, and other impersonation techniques?
4. Are we monitoring risks associated with receiving accounts and payment beneficiaries, as well as the customers initiating transactions?
5. How frequently are authentication, onboarding, and payment verification exceptions occurring, and what does this tell us about control effectiveness?
6. For overseas banks, which controls are operated locally, which depend on group systems, and how are gaps between them identified and managed?
7. When was the last institution-wide fraud risk assessment undertaken, and have response procedures been tested through realistic scenarios?
8. Can we preserve evidence, make timely decisions, and coordinate investigations and fund recovery across other banks and jurisdictions?

The quality of management reporting is important. Boards should have visibility of emerging fraud patterns, significant control exceptions, recurring incidents, and the actions being taken to address identified weaknesses.

Preparing for the Scams Prevention Framework

Australia’s Scams Prevention Framework introduces obligations for regulated entities to prevent, detect, disrupt, report, and respond to scams.

AFCA membership became mandatory for entities providing regulated services from 1 September 2026, with most framework obligations scheduled to commence on 31 March 2027.

For affected financial institutions, preparation should include reviewing fraud and scam controls across customer onboarding, transaction monitoring, payment verification, incident response, and complaints handling.

Particular attention should be given to how information moves between teams, how suspicious activity is escalated, and whether the institution can demonstrate that its controls are operating effectively.

The upcoming obligations also provide an opportunity to examine how fraud and scam risks are considered within broader governance, operational risk, and financial crime frameworks.

Reviewing fraud exposure & control effectiveness

Fraud methods will continue to evolve as criminals exploit changes in technology, payment systems, and customer behaviour.

Regular fraud risk assessments, targeted transaction analysis, and independent testing can help financial institutions identify vulnerabilities that may be difficult to recognise through routine monitoring.

Reviews should consider how fraud could occur across the institution, the controls intended to prevent or detect it, and whether those controls remain effective against current methods.

There is also value in examining previous incidents, complaints, investigation findings, and control exceptions to identify patterns that may indicate broader weaknesses.

For institutions with offshore operations or third-party dependencies, the review should extend to the systems and processes relied upon outside the Australian business.

How SW can help

SW’s Fraud & Forensics team works with financial institutions to assess fraud exposure, strengthen controls, and investigate suspected fraud.

Our services include:

• fraud risk assessments across financial institutions and individual business units
• fraud control framework reviews, gap analysis, and benchmarking
• targeted data analytics across customers, payments, suppliers, employees, and third parties
• reviews of account onboarding, money mule detection, payment verification, and exception controls
• independent investigations, transaction tracing, and recovery support
• cross-border fraud governance reviews, including local and group control arrangements
• fraud response planning, simulation exercises, and investigation readiness
• executive, Board, and employee fraud awareness training.

Talk to us

Anthony Hodgkinson, Partner – Fraud & Forensics, has more than 30 years’ experience in fraud, corruption risk management, and forensic investigations.

For assistance assessing your institution’s fraud exposure, reviewing existing controls, or investigating suspected fraud, contact Anthony or your SW advisor.