CommBank Scam: Fake CommBank Calls, NetBank Phishing and Remote Access Cons

A CommBank scam is a call, text, email or message from criminals pretending to be the Commonwealth Bank, usually to steal your NetBank login, get you to install remote-access software, or persuade you to move money to a “safe account”. CommBank’s security advice makes the same points as every Australian bank: it won’t ask you to move money to protect it, and it won’t ask you to share your password or codes. If you’re unsure, hang up and contact CommBank yourself using the number on your card or through the official CommBank app.

These scams are designed by organized groups who practice the same scripts every day. Being targeted, or even caught out, doesn’t mean you were careless. This guide covers the main versions, the warning signs, what to do in the first few minutes and where to report it.

How CommBank scams usually work

CommBank is one of Australia’s biggest banks, so its name is one of the most copied. Most scams fall into three patterns: impersonation, NetBank phishing and remote access. They often overlap in a single attempt.

Impersonation calls from the “fraud team”

A caller says they’re from CommBank’s fraud or security team and that there’s suspicious activity on your account. They may know your name, address and part of your card number, and the caller ID may show a real CommBank number, because caller ID can be spoofed. Our guide to vishing explains how this works.

From there the caller asks you to “verify” yourself by reading out a NetCode or other one-time code, approving a request in the app, or moving your savings to a “secure account” while they “investigate”. Every one of those requests is a sign of a scam.

NetBank phishing texts and emails

An SMS or email says your NetBank access has been suspended, a new payee has been added, a payment needs confirming or your details must be updated. It links to a page that looks like the NetBank log-on screen. Whatever you type, including your client number, password and NetCode, goes straight to the scammer, who logs in and moves money out.

Australian banks have committed to stop including links in text messages to customers, which makes a text with a link claiming to be from your bank an especially strong warning sign. Our guide to smishing covers scam texts in general.

Fake log-on pages from search ads

Some people search for “NetBank login” and click the first result. Scammers sometimes pay for ads that lead to lookalike pages. Use the official CommBank app, or type the address in yourself and bookmark it.

Remote-access requests

This is one of the most damaging versions. A caller says your computer or phone has been hacked, your NetBank has been compromised, or you’re owed a refund, and asks you to install an app such as a screen-sharing or remote-support tool so they can “fix” it. Once connected, they can watch you log in, hide what’s happening on screen and move money while you think they’re helping.

These calls sometimes start as a fake telco or tech support call and are then “transferred” to someone claiming to be from CommBank. Our Telstra scam guide covers the telco side of this.

Safe account and investment stories

Callers may say a bank employee is involved in fraud and your money must be moved to a new account to protect it. Others pose as CommBank advisers offering high-return term deposits or bonds, with payments going to an account that isn’t CommBank’s. Our guide to investment scams explains those offers.

What CommBank says about how it contacts you

CommBank publishes its security guidance on its official website, and that’s where to check the current details. In general terms, it describes the same limits as other Australian banks. Genuine bank staff won’t:

• Ask you to move money to a “safe” or “secure” account.
• Ask for your NetBank password or a NetCode by phone, text or email.
• Ask you to install remote-access or screen-sharing software.
• Send you a text with a link to log in.
• Pressure you to keep a call secret from family or branch staff.

CommBank has also added features in its app designed to help you check whether a caller is genuine and whether a payee’s name matches the account you’re paying. Check the app for what’s currently available, and use those checks whenever a call or payment feels off.

Warning signs of a CommBank scam

• Urgency: your money will be lost unless you act right now.
• A link in a text or email asking you to log on to NetBank.
• Requests for a NetCode, password or app approval you didn’t start.
• Requests to install an app or give someone access to your screen.
• A request to move money to a new account for “safekeeping”.
• Being transferred between a “telco”, “police” and the “bank”.
• Coaching on what to say if the bank asks why you’re making a payment.

What to do right now

1. End contact. Hang up, stop replying and close any page you opened from a link.
2. If someone had remote access, disconnect the device from the internet, uninstall the remote-access app and don’t log on to banking from that device until it’s been checked.
3. Contact CommBank through the number on your card or the official app, from a different device if yours may be compromised. Tell them exactly what you shared, approved or sent.
4. Lock your cards using the card controls in the app if card details were shared.
5. Change your NetBank password and your email password from a safe device.
6. Check for new payees, changed contact details, new devices or scheduled payments, and report anything you don’t recognize.
7. Keep evidence: screenshots, the numbers that called you and a note of what was said.

If your identity documents or personal details were shared, IDCARE offers free identity and cyber support in Australia. Our guide to what to do if your bank account is hacked covers securing linked accounts.

Where to report a CommBank scam

• CommBank, first and fastest, through the number on your card or the official app.
• Scamwatch: report the scam to Scamwatch, run by the National Anti-Scam Centre. Our guide on how to report a scam to Scamwatch explains the process.
• ReportCyber: if you lost money or someone accessed your device or accounts, report it through ReportCyber at cyber.gov.au.
• The platform, for fake ads, pages or social media accounts using CommBank branding.

For reporting routes in other countries and general next steps, see our guide on how to report a scammer.

Can you get your money back?

It depends on how the money left your account and how fast you report.

• Transactions you didn’t authorize, such as payments made during a remote-access session: report them immediately. Banks assess these claims, and the outcome often depends on whether codes or passwords were shared.
• Transfers you were tricked into making: the bank can try to recover funds from the receiving bank. This sometimes works, especially within minutes or hours, but it isn’t assured.
• Card payments: ask about a chargeback.
• Crypto and gift cards: usually very hard to recover. Contact the exchange or issuer anyway.

If you’re unhappy with CommBank’s decision, use its internal complaints process first. If that doesn’t resolve it, you can complain to the Australian Financial Complaints Authority (AFCA), which is free. Be wary of anyone who offers to get your money back for a fee; recovery scams often follow a first scam.

A worked example

This is an illustrative scenario, not a real case. Dennis, a retired builder in Perth, gets a call from someone saying they’re from his internet provider. His connection has been “hacked”, they say, and they need him to install an app so a technician can check his computer.

1. After a few minutes, the “technician” says criminals have got into his NetBank and transfers him to a “CommBank fraud officer”.
2. The new caller asks Dennis to log on to NetBank so they can “secure” his savings in a new account, and asks him to read out the NetCode that arrives.
3. Dennis remembers his daughter telling him that banks never ask for remote access. He hangs up and switches off the computer.
4. Using his mobile, he calls the number on the back of his card. CommBank confirms no one from the bank called, checks his account and advises him to get the computer cleaned before using it for banking.
5. He reports the call to Scamwatch and ReportCyber.

Dennis lost nothing because he ended the call before sharing the code. If he had, calling CommBank immediately would still have been the right first step.

Common mistakes to avoid

• Trusting caller ID. A real CommBank number on screen proves nothing.
• Logging on through a link in a text, email or search ad.
• Reading out a NetCode. Codes are for you to type into the real app or site only.
• Letting anyone onto your device. Remote access gives a scammer control.
• Waiting before reporting. The first hour gives the best chance of stopping a transfer.

How to protect your CommBank accounts

• Use the official CommBank app for anything to do with your accounts.
• Turn on notifications for payments, new payees and new devices.
• Use the app’s checks for callers and payee names whenever they’re offered.
• Talk to older relatives about remote-access and safe account calls.
• Know the other brands scammers copy, as covered in our Westpac scam, ANZ scam, NAB scam and myGov scam guides, plus fake fraud team calls in our ING scam guide.

If scammers have used your name or your business in messages like these and it’s affecting what people find when they search for you, our personal reputation management team can help you see what’s showing and what can be corrected.

Frequently asked questions

Will CommBank ever ask me to move money to a safe account?

No. No genuine bank, CommBank included, will ask you to move money to a “safe” or “secure” account. If anyone asks, hang up and call the number on your card or contact CommBank through the official app.

Does CommBank send texts with links to NetBank?

Treat any text with a link asking you to log on to NetBank as a scam. Australian banks have committed to stop sending links in texts to customers. Open the official app or type the address yourself instead.

What should I do if I gave a scammer remote access?

Disconnect the device from the internet, uninstall the remote-access app and call CommBank from a different device using the number on your card. Get the device checked before you use it for banking again.

Where do I report a CommBank scam?

Report it to CommBank first, then to Scamwatch. If you lost money or your device or accounts were accessed, also report it through ReportCyber at cyber.gov.au.

Can I get my money back after a CommBank scam?

Sometimes. It depends on how the money was taken and how quickly you report. If you’re unhappy with CommBank’s decision, you can complain to AFCA, which is free.