Crypto phishing in Australia has matured. The scams that catch people now don’t look like “Nigerian prince” emails. They look like normal exchange notifications, bank warnings, ATO or AUSTRAC “compliance” messages.
If you use any crypto exchange, you’re in the target set. Attackers don’t need to be clever forever; they just need you to be tired, distracted, or rushed once.
This article shows you how these scams typically work, what tells to look for, and what to do if you’ve already clicked. The goal isn’t paranoia but to build one habit: when a message tries to create urgency around your money, you slow down and verify through a path you control.
Why crypto exchange users are being targeted right now
Crypto exchange users are valuable targets because the payout can be fast. If an attacker gets access to your account, they can often withdraw to an external wallet within minutes. Unlike credit card fraud, there isn’t a simple chargeback mechanism. Once funds are sent, they’re usually gone.
Australia-specific payment methods make the urgency feel even more believable. We’re used to instant transfers, PayID confirmations, and bank security messages. Scammers mimic those patterns because they match what “real” friction feels like. The more realistic the workflow looks, the more likely you are to comply.
What “crypto exchange phishing” looks like in 2026
The most common version still starts with an email that appears to be from your crypto exchange. It might say there was an unusual login, your account has been locked, or it might claim you need to verify your identity again. The link in the email takes you to a page that looks identical to the real site, and the moment you type your login details, you’ve handed them over.
SMS scams are arguably worse because you’re usually on your phone, the screen is small, and URLs get shortened or hidden. These messages often claim there’s a pending withdrawal that you can “cancel” by tapping a link. That framing is psychologically powerful because it makes you feel like you’re stopping a loss rather than taking a risk.
Phone scams are also increasing. You’ll receive a call from “security” or “support” saying suspicious activity was detected. Sometimes they’ll read out a reference number. Sometimes they’ll claim your account is being protected. Sometimes they’ll tell you to stay on the line while they “secure it.” The call is designed to keep you anxious and compliant.
Then there are fake customer support channels. If you ever ask for help in a public forum, eg: Discord, Telegram groups, X, scammers will DM you pretending to be the crypto exchange. They’ll offer to “verify your account” and push you toward handing over credentials or installing something that gives them access.
Finally, one of the most dangerous routes is search. People Google “CoinSpot login” or “CoinSpot support,” click the top result, and land on a lookalike page. Always make sure that you are clicking on the official website link before entering your login details.
The attacker’s playbook (and why it works)
Phishing works because it’s not a technical attack, it’s actually a behavioural attack.
The first move is urgency. The message tells you something is happening right now: a withdrawal, a login, a verification deadline, an account freeze. If you feel rushed, your brain reaches for shortcuts. You click.
The second move is authority. The scam pretends to be a “security team,” a “compliance officer,” a bank department, or a regulator. Australians are especially used to receiving official-looking notices and scammers exploit that social conditioning.
The third move is to remove safe verification. They want you to use their link, their number, their chat channel, their “secure” process. The moment you follow their pathway, they control the environment.
The fourth move is credential capture or transaction approval. Sometimes they take your password and 2FA code and log in. Sometimes they trick you into approving a “secure” withdrawal or “verification” payment. Either way, they’re trying to turn your attention and anxiety into an irreversible action.
Remember these rules that will save you
There are a handful of rules that almost never have exceptions. A legitimate crypto exchange will not ask for your seed phrase or private keys. If anyone asks for them (no matter how convincing their story is) you’re dealing with a scam.
A legitimate exchange will not need you to install remote access software to “fix” your account. If someone wants AnyDesk, TeamViewer, or screen sharing, that’s not support; that’s takeover.
A legitimate exchange does not need your one-time codes. If you’re being asked to read out a 2FA code or SMS code, you’re being phished.
And perhaps the most important operational rule is this: never log in from a link in a message. If the alert is real, it will still be real when you open the exchange app directly, or type the domain yourself, or use a saved bookmark you already trust.
A quick way to spot phishing in under a minute
The fastest mental model is to ask two questions.
First: is the message trying to push me down a pathway I didn’t choose? That includes links to “verify,” numbers to call, or requests to continue on Telegram. Real crypto exchanges don’t mind you verifying through official channels. Scammers do.
Second: is the message trying to take something from me that cannot be safely shared? That includes passwords, one-time codes, seed phrases, or remote access. If the answer is yes, you can stop immediately without feeling unsure.
If you want a few practical tells, here are the ones that show up constantly. The sender details don’t match the brand. The URL has extra words or misspellings. The message relies on urgency or threats. The page looks right but your password manager won’t autofill. The “support agent” tries to keep you from hanging up or checking the app yourself.
None of those are perfect alone, but together they’re more than enough to justify treating the message as hostile.
The safe way to verify a scary alert
When you get a message that claims something urgent (especially anything involving a withdrawal) your job is not to solve it quickly. Your job is to verify it safely.
Don’t click the link, or reply to the SMS, or call back the number in the message. Open your crypto exchange using the method you already trust: the official app, a bookmark you’ve saved, or typing the domain manually.
Once you’re inside, check whether anything matches the alert. Look at notifications. Look at login activity if it’s available. Look at withdrawals and withdrawal addresses. If nothing is happening inside the account, the message is almost certainly a scam.
If you do need support, start from inside the platform, or from the official domain you navigated to yourself. The whole point is to keep the attacker from controlling your communication channel.
If it was a phone call, hang up. Then find the official support path on the exchange website or inside the app. If you still want to talk to someone, you initiate the call through verified details, not through the caller’s script.
If you clicked or entered details, act fast
If you’ve already clicked a link and entered your password, don’t waste time trying to work out whether it was real. Assume it was not and act as if you’re already compromised.
Start with your email, because email is how password resets happen. Change yourxt email password, enable 2FA, and check for inbox rules or forwarding addresses you didn’t create. Attackers often set these up so they can intercept notifications quietly.
Then change your exchange password immediately and make it unique. If your exchange supports session management, log out other sessions or revoke any devices you don’t recognise. If you’ve ever used API keys, revoke them too.
If your exchange offers withdrawal protections, turn them on. Address whitelisting and withdrawal locks can buy you time, and time is everything in this situation.
If you sent money from your bank account because a scammer told you to, contact your bank immediately. The earlier you act, the better your odds of intervention.
Finally, report it. In Australia, Scamwatch exists for exactly this reason. Reporting won’t always recover funds, but it does help patterns get tracked and warning systems improve.
Prevention that makes a difference
The easiest improvement most people can make is using a password manager. It’s not just about strong passwords. It’s about autofill behaving like an alarm system. If your manager doesn’t recognise the domain and refuses to autofill, that’s a strong signal you’re on the wrong site.
Lock down your email account like it’s a bank account, because functionally it is. Use 2FA, protect recovery options, and review recent sign-ins periodically. Most exchange takeovers become easy once email is compromised.
On your phone, use a proper passcode, keep your OS updated, and consider adding carrier-level protections like a SIM PIN or account PIN to reduce SIM-swap risk. SMS-based security is better than nothing, but it’s not the strongest layer.
Finally, consider limiting exposure. Keeping only what you actively need on a safe crypto exchange such as CoinSpot, and storing longer-term holdings in a cold storage crypto wallet, reduces what can be stolen in a single incident.
The mantra that prevents most losses
When phishing works, it’s usually because urgency wins. I find it a good idea to use a simple mantra: pause, verify, proceed.
Pause when you feel rushed. Verify through an app, bookmark, or typed domain, not through the attacker’s link. Proceed only when you can confirm the alert inside the platform using channels you chose.
That habit alone will stop the majority of crypto exchange phishing attempts targeting Australians.