crypto-sydney Open account
Cryptocurrency coins beside a laptop, illustrating online investment fraud risk

Safety · NSW

Crypto scams in Sydney: what they actually look like

Almost nobody loses crypto to hacking. They lose it to a phone call, a dating app, a job offer or a helpful stranger. These are the patterns operating in Sydney right now, and the exact reporting sequence if one has already reached you.

Trading crypto carries risk. Verify any provider's AUSTRAC registration before you send money.

Last reviewed: August 2026

If it is happening right now

Stop. Do not send another payment, including any "fee" required to release your funds. Hang up. If you are standing at a crypto ATM with someone on the phone, walk out of the shop. Then work through the reporting steps below. Nothing you have been told about urgency, deadlines or legal consequences is true.

How big the problem actually is

Two numbers put this in context. Australian authorities recorded roughly 150 reports of crypto ATM scams in a single twelve-month period, with estimated losses around A$3 million — and that is only the machine channel, only reported cases, and almost certainly a fraction of reality. AUSTRAC found the pattern serious enough to impose formal conditions on every crypto ATM operator in the country in mid-2025, including a A$5,000 cash cap and mandatory scam warnings on screen.

The second number is who it happens to. AUSTRAC's analysis identified people aged sixty to seventy as both among the heaviest users of Australian crypto ATMs and among the most frequent victims. That is not the demographic most people picture when they think about crypto, and it tells you something important: these are not scams that target crypto enthusiasts. They target ordinary people who have been talked into using crypto as a payment rail.

Which is why this page is on a crypto buying guide. The most useful thing we can do for a Sydney reader is make sure that if they are being led toward a purchase, they recognise it before the money moves.

The crypto ATM coercion call

This is the most damaging pattern in Australia and the most preventable. The structure is always the same. Someone calls claiming to be from an organisation with authority — the tax office, a bank's fraud team, the police, a telecommunications provider, a government agency. They create an urgent problem: your account is compromised, a warrant has been issued, your identity has been used in a crime, your money must be moved to a "secure account" immediately.

Then the instruction: withdraw cash and take it to a crypto ATM. They stay on the phone throughout, often for hours, to prevent the victim from talking to anyone else. They provide a QR code or wallet address to scan. They may coach the victim on what to tell bank staff or the shop assistant if asked.

Everything about that description is diagnostic, and the rule that follows is absolute: no legitimate organisation on earth will ever ask you to resolve anything by putting cash into a crypto machine. Not the ATO, not your bank, not NSW Police, not a court, not a utility. There is no exception, no unusual circumstance, no emergency where this is real. If someone is on the phone with you at a machine, you are being robbed.

What they say vs what is trueScripts reported by Australian victims.
The scriptThe reality
"Your account has been compromised — move funds to a secure wallet."Banks never move your money to crypto. The "secure wallet" is theirs.
"There is a warrant. Pay now to avoid arrest."No Australian agency takes payment by crypto ATM, ever.
"Stay on the line — do not tell the shop staff."Isolation is the technique. Telling someone is the defence.
"Scan this QR code I am sending you."That address is the scammer's wallet. Never scan an address from anyone.
"Say it is for family if the bank asks."Being coached on what to tell your bank is proof of fraud.

Fake brokers and cloned trading platforms

The second major pattern is the investment platform that does not exist. A victim is contacted — by advertisement, social media message, a professional-looking cold call, or through an investment group — and directed to a platform with charts, balances and a support team. The early experience is deliberately good: small deposits, visible gains, and often a successful small withdrawal to build confidence.

Then the deposits grow, and the withdrawal stops working. There is a tax to pay first, or a compliance fee, or an account upgrade, or a released-funds charge. Each payment produces another obstacle. The numbers on the screen were never real; the platform is a front end over a database.

A common variant clones a genuine, well-known exchange's branding on a lookalike domain. This is why we repeat one rule on every page: never reach a financial platform through a link someone sent you. Type the address yourself, and verify the legal entity on the AUSTRAC register and the ASIC company register before depositing. Our verification guide takes two minutes and eliminates this entire category.

Romance and long-con investment fraud

Sometimes called "pig butchering" in the security industry — an ugly term for an ugly crime. A relationship develops over weeks or months on a dating app or social platform. It feels genuine because considerable effort goes into making it genuine. Money is never requested. Eventually the other person mentions their own investing success and offers to help.

The financial mechanics are identical to the fake broker scam. What makes it far more destructive is that the victim is not just defrauded but emotionally invested in the person defrauding them, which is why so many keep paying long after the pattern is obvious to everyone around them, and why so many never report.

The diagnostic is simple and worth memorising: a person you have never met in physical space is helping you invest. That is the whole tell. It does not matter how long you have talked, how consistent their story is, or whether they have video-called you. If they arrived in your life online and the conversation has reached investing, it is a scam.

Task scams and job-offer fraud

A newer pattern with real traction in Sydney. A message offers remote work — reviewing products, optimising app listings, completing simple online tasks — with immediate small payments that actually arrive. Then the tasks require you to deposit your own crypto to "unlock" higher-paying work or to cover a negative balance. The commission you have supposedly earned can never be withdrawn until you top up.

Legitimate employment does not require you to send money to your employer. That single sentence defends against the entire category.

Recovery scams: being robbed twice

This one is particularly cruel and it is worth warning people before it happens. After a loss, victims are contacted by "recovery specialists", "blockchain forensics firms" or people claiming to represent a regulator or law firm, offering to retrieve the stolen funds for an upfront fee. They frequently know details of the original scam, because the contact lists circulate among the same networks.

Genuine crypto recovery is rare and is pursued through police and formal legal process, not through a firm that contacted you. Never pay an upfront fee to recover stolen funds. If you have already been scammed, assume that anyone who contacts you about it afterwards is part of the same operation.

The universal red flags

Every scam above shares most of these. Any one of them is enough to stop.

They contacted you first

Cold call, message, ad, dating app, group chat. Legitimate Sydney platforms and desks do not solicit retail customers this way.

Guaranteed returns

Any promised percentage, "arbitrage bot" or risk-free yield. Markets do not work this way and no licensed provider claims otherwise.

Urgency and deadlines

Countdown timers, expiring allocations, "act tonight". Pressure exists to prevent you from thinking or asking anyone.

Secrecy

Asked not to tell family, bank staff or the shop assistant. Isolation is the core technique of every version of this.

Fees to withdraw

Tax, unlock fee, compliance charge, upgrade. Real platforms deduct fees from the withdrawal; they never ask for money to release it.

Remote access software

Anyone asking you to install screen-sharing or remote-control software to "help" is taking control of your accounts.

Reporting in NSW: exactly who to contact

Do all of these, and do them in roughly this order. Speed genuinely matters in the first few hours.

  1. Stop all payments and contact

    Send nothing further, including any fee described as necessary to release funds. Block the contact across every channel.

  2. Secure your accounts

    Change passwords from a different device. Uninstall any remote-access software. If a seed phrase may have been exposed, create a brand-new wallet and move any remaining crypto to it immediately.

  3. Call your bank

    Use the number on your card, not one anyone gave you. If payments left by card or transfer, report them now — occasionally a very recent transfer can still be stopped.

  4. Notify the exchange

    If funds moved through an Australian exchange, contact its support and provide transaction IDs and wallet addresses. If the destination address is still on a compliant platform, a fast report can occasionally result in a freeze.

  5. Lodge with ReportCyber and Scamwatch

    ReportCyber is the national online police reporting service and routes your report to the relevant jurisdiction. Scamwatch, run by the National Anti-Scam Centre, records the pattern and feeds disruption work.

  6. Report to NSW Police

    Make a report in New South Wales with everything documented: transaction records, wallet addresses, screenshots, phone numbers, the platform name and all correspondence.

  7. Get support

    IDCARE provides free identity and cyber support if your documents were compromised. Free financial counselling is available nationally. Talk to someone you trust — the isolation is part of the harm.

Editor's note

The one question that ends most of these

If you take a single thing from this page, take this. Whenever crypto is involved in something that arrived in your life rather than something you went looking for, ask: who contacted whom?

If you found the platform yourself, verified it on the AUSTRAC register and typed the address into your own browser, you have eliminated the overwhelming majority of Australian crypto fraud. If someone reached out to you — however plausible, however long you have known them online, however professional the website looks — the answer is no. There is no version of this where the person who contacted you is the exception.

It is a blunt rule and it will occasionally cause you to decline something legitimate. That cost is trivially small compared with the alternative.

Protecting an older relative

Given who is most affected, this deserves its own section. If an older family member has started talking about crypto, three questions will surface almost every problematic case, and none of them require you to understand crypto at all.

Who introduced you to this, and did they contact you first? A friend from the tennis club is different from a person who messaged them on Facebook. Is anybody helping you make the transactions? Legitimate platforms do not require a helper, and a helper is the defining feature of almost every version of this crime. Has anyone asked you to keep it private, or to install software so they can see your screen? Both are unambiguous.

Approach it without judgement. Shame is the single biggest reason these scams run for months — victims stop telling anyone because they feel foolish, and the isolation the scammer engineered gets reinforced by embarrassment. These operations are professional, well-resourced and specifically designed to defeat intelligent, careful people. Falling for one says nothing about anybody's judgement.

  • Nobody legitimate will ever ask you to pay via a crypto ATM. Not once, not ever.
  • Never scan a wallet QR code or address that another person provided.
  • Never reach a financial platform through a link. Type the address yourself and verify the entity.
  • Anyone who contacts you first about a crypto opportunity is running a script.
  • After a loss, anyone offering paid recovery is the second half of the same scam.

Frequently asked questions

Can I get my money back after a crypto scam in Sydney?

Honestly, recovery is rare. Crypto transactions are irreversible and funds are usually moved and laundered within hours. Report immediately anyway — speed occasionally allows an exchange to freeze funds still sitting on its platform, and every report adds to the intelligence picture. Be extremely wary of anyone who contacts you promising to recover your funds for a fee; that is a second scam.

Who do I report a crypto scam to in NSW?

Report to ReportCyber (the national online police reporting service), to Scamwatch run by the National Anti-Scam Centre, and to NSW Police. Also notify your bank and any exchange involved as fast as possible. IDCARE provides free support if your identity documents were compromised.

Why do scammers ask victims to use Bitcoin ATMs?

Because a crypto ATM converts a victim's physical cash into an irreversible transfer to the scammer's wallet in about ten minutes, with no bank in the loop to freeze it. AUSTRAC identified this pattern explicitly, capping machine cash at A$5,000 and mandating on-screen warnings after Australians reported millions in losses.

Are crypto scams common in Sydney specifically?

Sydney has Australia's largest population and the densest crypto ATM network, so it carries a substantial share of national losses. Scams here follow national patterns rather than local ones — investment fraud, romance fraud, ATM coercion and job-offer scams — but the machine density makes cash-collection scams more practical here than in most cities.

How can I check whether an investment platform is real?

Search the entity's legal name on the AUSTRAC register, check the ASIC company register, and check ASIC's investor alert list of unlicensed entities the regulator has warned about. Our verification guide walks through it. If someone contacted you first about the platform, treat it as fraudulent regardless of what the checks show.

My elderly parent is talking about crypto. What should I ask?

Ask who introduced them to it, and whether that person contacted them first. Ask whether anyone is helping them make transactions or telling them to keep it private. Ask whether they have been asked to install remote-access software. Those three questions catch the overwhelming majority of cases. AUSTRAC specifically identified 60–70 year olds as both heavy crypto ATM users and frequent victims.