Optus Scam: Fake Bill Texts, SIM Swaps and Data Breach Lures

An Optus scam is a text, call or email from criminals pretending to be Optus, usually claiming your bill is overdue, a payment failed, you’re owed a refund, or your details were caught up in a data breach. The aim is to get your card details or login, or to take over your mobile number through a SIM swap. If a message about your Optus account arrives unexpectedly, don’t tap the link or call the number in it. Check your account in the official My Optus app or on Optus’s website, which you reach by typing the address yourself.

Optus is one of Australia’s biggest mobile and internet providers, so its name looks routine on a text or email. If you tapped a link or gave details, you’re not foolish: these messages are written by organized groups who send them in bulk and refine them over time. What matters now is acting quickly.

Common versions of the Optus scam

Version	How it usually looks
Overdue or failed payment text	A text or email says your Optus payment was declined or your bill is overdue, and links to a fake payment or login page.
Refund or overcharge	You’re told you were overcharged and must enter card details to get a refund.
Rewards or loyalty offer	A message offers a gift, discount or free upgrade if you sign in or pay a small fee.
Fake support call	A caller says there’s a problem with your service or account and asks for your details, a verification code or remote access.
SIM swap or number port attempt	A scammer tries to move your number to their SIM, sometimes by asking you for a code sent to your phone.
Data breach lure	A message says your details were exposed and offers “compensation”, “identity protection” or a refund through a link.

The same bill and refund scripts are used under other providers’ names. Our Telstra scam guide covers the remote access version in more depth.

How scammers used the Optus data breach as a lure

After Optus disclosed a large data breach in 2022, scammers began sending messages that referred to it. Some claimed to offer compensation or refunds, some offered to “protect” your identity for a fee, and some asked people to “confirm” their details or pay to have their data removed. None of these came from Optus.

This is a common pattern after any widely reported breach. Scammers know people are worried and expect to hear about it, so a message mentioning the breach feels believable. If you get a message about a data breach, don’t use its links or numbers. Check the company’s official website for any genuine notice, and see our guide to Have I Been Pwned for a safe way to see which breaches your email address has appeared in.

How SIM swap scams work

Your mobile number receives the one-time codes that protect your banking, email and other accounts. In a SIM swap or unauthorized port, a scammer gets your number moved to a SIM they control. They might impersonate you using details stolen elsewhere, or trick you into reading out a verification code sent to your phone by saying it’s needed to “fix” something.

Once they have your number, your phone loses signal and codes meant for you go to them. Australian telcos use extra identity checks before moving a number to a new SIM or provider, and a code sent to your phone is often part of that. That’s exactly why a stranger asking for such a code is a red flag.

Warning signs of an Optus scam

• A link in a text about your bill, refund or rewards that goes to a web address that isn’t Optus’s.
• Anyone asking you to read out a code sent to your phone.
• Urgency: “service suspended today”, “final notice”, “claim within 24 hours”.
• Offers of breach compensation or identity protection that need a payment or your details.
• Requests for remote access to your computer or phone during an unexpected call.
• Sudden loss of mobile signal while others nearby have coverage.
• Caller ID that looks real. Numbers can be spoofed.

Optus publishes its own scam guidance on its official website, including how it contacts customers. Check it there for current details.

What to do right now

1. Stop contact. Don’t reply, don’t tap the link and hang up on callers.
2. If your phone has lost signal unexpectedly, contact Optus straight away through the official app, website or a store and ask whether your SIM or number has been changed.
3. If you entered card or banking details, contact your bank through its official app or the number on your card. Ask it to block cards and watch for unusual payments.
4. Change passwords from a safe device, starting with your email, banking and My Optus account, then anything that uses your number for codes. Our guide on what to do if your account was hacked goes account by account.
5. Check your Optus account for new services, SIM changes or device orders you didn’t make.
6. Protect your identity if you shared your driver license, passport or Medicare details. IDCARE can help you decide what to replace and what to monitor.
7. Save evidence: screenshots, sender numbers, links, call times and payment details.

Where to report an Optus scam in Australia

• Scamwatch: report the text, call or email to Scamwatch, run by the National Anti-Scam Centre. Our guide on how to report a scam to Scamwatch explains what to include.
• ReportCyber: if you lost money or data to a cybercrime, such as a SIM swap or hacked account, report it through ReportCyber at cyber.gov.au.
• Optus: its official website explains how to report scam messages and calls. Use the details you find there, not those in the message.
• Your bank: report it as fraud if you shared card or banking details.

For every reporting route in one place, see our guide on how to report a scammer.

Can you get your money back?

• Card payments: ask your bank about a chargeback or fraud claim as soon as possible.
• Unauthorized transactions after a SIM swap: report them to your bank at once. Banks investigate these under their own terms and industry codes.
• Bank transfers you were tricked into making: your bank can try to recall them, but this works only sometimes, and usually only if you’re very quick.
• Gift cards and crypto: often impossible to reverse, but report them anyway.
• If your bank says no: complain to the bank first, then to the Australian Financial Complaints Authority (AFCA), which is free.

Watch for people offering to recover your money for a fee after a scam or breach. These are recovery scams.

A worked example

This is an illustrative scenario, not a real case. Priya gets a text saying her Optus payment has failed and her service will be suspended tonight. She taps the link, and a page that looks like My Optus asks her to sign in and then enter her card. She enters her login but stops at the card page because the web address looks odd.

1. She closes the page and opens the official My Optus app. Her bill is paid and there’s no suspension notice.
2. She changes her My Optus password and her email password, which she had reused, and turns on two-factor authentication.
3. That evening a caller claiming to be from Optus says there’s been a problem with her account and asks her to read out a code just sent to her phone. She hangs up.
4. She contacts Optus through the app to report both the text and the call, and reports them to Scamwatch.

If Priya had read out the code and lost signal, the right order would have been: contact Optus immediately, call her bank, change passwords from another device, then report to ReportCyber.

How to protect yourself next time

• Check bills only in the My Optus app or on the website you type in yourself.
• Use app-based authentication instead of SMS codes where you can, so a stolen number is less useful.
• Use unique passwords and a password manager, so one leaked login can’t open others.
• Be extra careful after any breach news. Expect scammers to reference it.
• Learn to spot text scams. Our guide to smishing explains the patterns.
• Talk to family, especially older relatives, about never reading out codes to callers.

If a scam or breach has led to fake accounts or content in your name appearing online, our personal reputation management team can help you find and address it.

Common mistakes to avoid

• Paying for “breach compensation” or identity protection offered by text.
• Reading out a code to a caller who says they’re protecting you.
• Ignoring a sudden loss of signal. It can mean your number has been moved.
• Reusing your telco password on email or banking.
• Keeping it to yourself. Optus, banks and IDCARE deal with these cases every day.

Frequently asked questions

How can I tell if an Optus text is real?

Don’t use the link. Open the My Optus app or type Optus’s website address yourself and check your account. If the bill or problem isn’t there, the text was fake.

Is a message offering Optus data breach compensation real?

Messages offering compensation, refunds or identity protection through a link or for a fee are a common scam. Check Optus’s official website for any genuine notice and don’t use contact details from the message.

What should I do if my phone suddenly has no signal?

If others nearby have coverage and you don’t, contact Optus straight away through official channels to check for a SIM swap or port. Then call your bank and secure your email.

Where do I report an Optus scam?

Report it to Scamwatch, and through ReportCyber if you lost money or data to a cybercrime. You can also tell Optus through its official website. IDCARE can help if your identity details were exposed.