A bank boss appears to storm out of a TV interview after a secret trading platform is exposed. A famous investor seems to reveal the "loophole" the banks don't want you to know. A trusted market commentator appears to message you a tip. None of it happened. Each is a variation on the same manufactured scam — and the recurring structure beneath them is what makes them both dangerous and, for the institutions in the payment chain, disruptable.
In this guide
The recurring anatomy
Strip the branding away and the same five-part structure appears every time. The names change; the machine does not.
- A stolen identity. A real, trusted figure — someone with authority in money — is impersonated using an AI image, deepfake video or cloned voice.
- A credibility wrapper. The impersonation is dressed in the trappings of a legitimate source: a fake news article, a mocked-up TV segment, a lookalike media domain, a spoofed brokerage page.
- A paid distribution channel. The lure is pushed as a paid ad or promoted post, so it reaches a wide, algorithmically targeted audience rather than waiting to be found.
- An off-platform funnel. The victim is moved into a private space — a WhatsApp or Telegram group, or a fake platform's sign-up flow — away from moderation and interruption.
- A boiler room. Fake "brokers", "account managers" or "members" coach the victim through deposits, show fabricated profits, and escalate the amounts until withdrawal is blocked.
Recognising this as one machine, rather than a stream of unrelated incidents, is the single most useful shift a fraud team can make. It means the same controls disrupt the whole family, not one instance at a time.
The variations Australia has seen
The same anatomy has surfaced in several distinct guises reported over the past couple of years.
The fake bank scandal
In one of the largest documented campaigns, a Commonwealth Bank chief executive was impersonated in fabricated news stories — including a staged "interview" confrontation — run as paid ads on Facebook. Security researchers at Bitdefender documented the operation as roughly 310 malvertising campaigns comprising more than 26,000 ads between 9 February and 5 March 2026, spanning around 25 countries and at least 15 languages, with roughly a dozen campaigns aimed at Australia. Fact-checkers confirmed the "scandal" never occurred and that a lookalike ABC News page was used to funnel readers toward a scam platform. The bank executive was impersonated; he did nothing of the sort.
The cloned finance personality
Familiar market commentators are impersonated to issue "tips". ASIC has warned of a surge in these schemes and named several impersonated figures, including a well-known market commentator, financial author Scott Pape and businessman Andrew "Twiggy" Forrest. The commentators cannot lawfully message the public with buy signals — and do not — so the "tip" is itself the tell.
The deepfake celebrity trading platform
The ACCC's Scamwatch has repeatedly warned that celebrities and public figures are not getting rich from online trading platforms, and that scammers fabricate news articles and deepfake videos to suggest otherwise. In one case Scamwatch highlighted, a single Australian lost $80,000 after watching a deepfake video, clicking through and registering their details. ACCC Deputy Chair Catriona Lowe summarised the mechanism: scammers "are creating fake news articles and deepfake videos to convince people that celebrities and well-known public figures are making huge sums of money using online investment trading platforms, when in fact it is a scam."
Why the pattern works
The effectiveness is not an accident; it is a deliberate stack of psychological levers, now cheap to deploy at scale.
Transferred trust
People do not evaluate an investment from scratch. They shortcut to "do I trust the source?" By stealing a trusted face or masthead, the scam skips the scrutiny that a cold pitch would attract. The more respected the identity, the more scrutiny it disarms.
The authority of "news"
A story that looks like it came from a national broadcaster carries that broadcaster's authority. Hosting the fake on a lookalike domain, and pushing it through paid ads, lends a veneer of legitimacy that a raw sales page never could.
Manufactured momentum
Inside the funnel, fabricated profit screenshots, fake fellow "members", a small early "win" and a countdown all point one way: act now, everyone else is. Social proof and urgency are doing the persuading, and both are trivial to fake.
Precision targeting
Paid distribution lets criminals aim. As NAB's Chris Sheehan has observed, "digital platforms use sophisticated algorithms to push content to people based on the user's search history" — so someone who has been reading about retirement or shares can be served exactly the lure most likely to land. Regulators have noted these schemes appear to deliberately target Australians nearing retirement, the cohort with savings to invest.
None of this makes the victims naive. It makes them ordinary people met with a professional-grade deception aimed squarely at how human trust works.
How the campaigns dodge detection
These are not amateurish operations, and understanding their evasion tradecraft matters for anyone trying to catch them. Reporting on the CommBank-impersonation campaign described techniques including ad "previews" that pointed at legitimate domains such as major news and search sites while the real destination was a scam network, and character-substitution tricks — swapping visually identical letters from other alphabets — to slip past keyword filtering. Networks of disposable lookalike media domains redirected victims onward, and the whole operation ran across dozens of countries and languages simultaneously. The lesson for defenders is that filtering on obvious keywords or single bad domains is not enough; the operations are built specifically to defeat that.
The red flags
- A celebrity or executive "endorsement" of a specific investment. Genuine public figures and institutions do not promote trading schemes this way. Treat the endorsement itself as the warning.
- A dramatic "news" story that only appears via an ad — a secret platform exposed, a bank "scandal", a leaked loophole — especially if the page URL is not the outlet's real domain.
- A push into WhatsApp or Telegram to continue "privately".
- Guaranteed returns, an early small "win", and pressure to deposit more.
- Withdrawals that are blocked or gated behind "fees" and "taxes".
- No verifiable Australian Financial Services Licence, and an entity absent from — or listed on — ASIC's alerts.
How to disrupt it, by player
Because the funnel crosses the whole ecosystem, no single institution can stop it alone. Each owns a slice, and the disruption compounds when they layer.
Advertising and social platforms
- Faster, evasion-resilient detection and takedown of impersonation ads and deepfake creative featuring public figures.
- Synthetic-media detection tuned to the "trusted figure endorses an investment" pattern.
- Verified-identity signals for genuine executives, institutions and commentators, so imposters stand out.
- Friction and monitoring on the redirect into encrypted messaging, where the platform loses sight of the victim.
Banks and brokers
- Behavioural, payee-aware transaction monitoring that scores deviation from the customer's own baseline and lifts risk on payments to new payees, exchanges and flagged beneficiaries.
- Proportionate, risk-based holds and step-up checks that create a moment to reconsider before an irreversible payment.
- Scam-specific warnings that name the pattern rather than issuing a generic disclaimer.
- Strong mule detection on the receiving side — the destination of every one of these payments.
Payment platforms and marketplaces
- Scrutiny of newly onboarded "investment" or "brokerage" merchants, and mismatches between stated business and transaction flow.
- Clusters of small first-time deposits followed by withdrawal complaints treated as the boiler-room signal they are.
Across all of them
Structured, timely information sharing is the connective tissue. The sending bank, the receiving bank, the platform hosting the ad and the regulators each hold one piece; the criminals rely on those pieces never being assembled quickly enough to matter.
The scale, in numbers
The context is not marginal. Investment scams were the largest scam-loss category in Australia in 2025, with the ACCC and National Anti-Scam Centre reporting roughly $837.7 million in investment scam losses within $2.18 billion of total reported scam losses for the year. NAB has noted that around 70 per cent of investment scam losses originate from social media or websites — the precise channels this playbook exploits. And the direction of travel is toward fewer but costlier scams, as AI drives the marginal cost of a convincing lure toward zero.
That is the uncomfortable efficiency defenders are up against: one deepfake, endlessly re-skinned, distributed by algorithm, funnelled through encrypted chat, and cashed out through mule accounts. The good news is that the machine's very consistency is a weakness. Build controls against the funnel — not the face of the week — and you disrupt the whole family at once.