Fake AFP Officers Are Calling Australians to Steal Their Crypto

A police impersonation crypto scam is sweeping across Australia, and it is catching out even careful investors. Criminals are now phoning Australians while posing as Australian Federal Police (AFP) officers, then walking them step by step toward handing over their cryptocurrency, wallet access, or seed phrase.

The threat is not theoretical. Investment and crypto fraud remains Australia's single largest scam-loss category, with Australians reporting $2.18 billion in total scam losses in 2025 and $121.3 million tied specifically to cryptocurrency and digital currency exchanges, according to the National Anti-Scam Centre and Scamwatch.

How the Police Impersonation Crypto Scam Works

The AFP-led Joint Policing Cybercrime Coordination Centre (JPC3) has detailed a real case showing exactly how the police impersonation crypto scam unfolds. It is methodical, and it is designed to manufacture trust before it manufactures urgency.

  1. The victim receives a call from someone claiming to be an AFP officer, often from a "spoofed" phone number that looks legitimate.
  2. The caller says a suspect has been arrested and that the victim's details have surfaced in a data breach linked to cryptocurrency and finance.
  3. The impersonator supplies an official-looking reference number for a cybercrime report supposedly lodged on the victim's behalf.
  4. The victim is told to verify the report themselves in the ReportCyber portal — a step that makes the whole scheme feel real.
  5. A "second caller", posing as a representative from the victim's crypto platform, quotes the same reference number to confirm legitimacy.
  6. That second caller then pressures the victim to move funds into a so-called "Cold Storage" or "safe" account controlled by the scammers.

The ReportCyber Twist

What makes this wave particularly dangerous is the abuse of ReportCyber, Australia's genuine national cybercrime reporting tool. Because ReportCyber lets people lodge reports on behalf of others, criminals who already hold a victim's email and phone number can submit a fake report, then point the victim to it as "proof". The platform itself remains safe to use — but scammers are weaponising its credibility.

Inside the Cambodian Scam Compound

On 8 June 2026, the AFP and the Royal Thai Police revealed a detailed script recovered from a scam compound in O'Smach, Cambodia, raided in January 2026. Investigators also found AFP logos and signage allegedly used to make video calls look like they were coming from a real AFP facility.

The script coached offenders to tell victims a bank account had been opened in their name by a suspect in a money-laundering investigation, then escalate to an encrypted video call, a fake "confidentiality agreement", and a "temporary surveillance protocol" with check-ins every four hours. The goal was to isolate victims and keep them compliant while their accounts were drained.

The AFP identified roughly 300 potential Australian victims from that single compound, who were warned by text in February 2026. It is one front in Operation Firestorm, launched in August 2024, which has supported five offshore scam-centre investigations, contributed to 560 arrests, and disrupted 15 scam centres across Thailand, the Philippines, Malaysia and Cambodia.

AFP warning graphic about police impersonation crypto scams targeting Australians

Why This Scam Is So Convincing

Traditional scam advice — "watch for bad grammar" or "ignore obvious threats" — does not protect against this tactic. The criminals lean on authority, verification, and speed:

  • Authority: impersonating the AFP, a trusted national institution, primes victims to comply.
  • Verification: real reference numbers, working ReportCyber links and a "second caller" create layers of false proof.
  • Urgency: moving quickly from "report" to phone call generates panic and short-circuits careful thinking.
  • Isolation: confidentiality agreements and surveillance "protocols" discourage victims from calling family or their bank.

Warning Signs of a Police Impersonation Crypto Scam

Treat any of the following as a red flag and hang up:

  • An unsolicited call claiming to be from the AFP, police, or a crypto exchange's "security team".
  • Reference to a ReportCyber report you did not lodge or authorise.
  • Any request to share your seed phrase, wallet keys, passwords, or bank balances.
  • Pressure to move crypto or cash to a "cold storage", "safe", or "holding" account.
  • Instructions to move to a new phone call, video call, or encrypted app for "protection" or "verification".
  • Demands for secrecy, "confidentiality agreements", or scheduled check-ins.

How To Protect Yourself

The AFP's ClickFit guidance translates into six concrete steps:

  1. Stop and think. If you get a call, text, or email claiming to be the AFP, pause before doing anything.
  2. Protect your codes and details. Legitimate police will never ask for account information, passwords, balances, or a wallet seed phrase.
  3. Never join a new call. Police will not ask you to switch to another phone or video call to "verify" yourself.
  4. Secure your accounts. Use strong, unique passphrases and turn on multi-factor authentication everywhere.
  5. Do not transfer money on request. No genuine officer will ask you to move funds to a "safe account".
  6. Verify independently. Hang up and call the organisation back on a number you find yourself, never one the caller gives you.

What To Do If You've Been Targeted

If a caller references a ReportCyber report you did not lodge, terminate the call and notify ReportCyber or 1300CYBER1 (1300 292 371). If you have already transferred money or crypto, contact your bank or exchange immediately using the official contact details on their website — speed matters, because once crypto leaves your wallet it is extremely difficult to recover. If there is an immediate threat to your safety, call 000. You can also report scams to the ACCC's Scamwatch to help authorities track emerging tactics.

Every report helps police build intelligence and protect the next potential victim. As AFP Detective Superintendent Marie Andersson put it, the fact this scam surfaced through self-reporting shows Australians' cyber awareness is growing — but the criminals are evolving just as fast.

Sources