How to report a crypto scam in Australia

If you have been scammed with cryptocurrency in Australia, do two things today: lodge a cybercrime report through ReportCyber, and put the wallet addresses on the public record.

The ReportCyber lodgement gets your case in front of police. The public record works straight away — the address becomes visible to exchange compliance teams, to investigators, and to the next person about to transfer money to it. Two different jobs, and neither substitutes for the other.

The first hours decide most of it. The sooner the receiving addresses and hashes are written down, the better the odds an exchange freezes something before the funds are broken up.

Key takeaways

• Lodge the cybercrime report at ReportCyber (cyber.gov.au). It is the Australian Government's cybercrime reporting tool, and in cyber.gov.au's own words it is how "you can report a cybercrime to police".
• ReportCyber cannot get your money back. Your bank might. Call the bank first, then lodge.
• A Scamwatch report is not a police report. Scamwatch, run by the ACCC through the National Anti-Scam Centre, uses your report to get scam sites, ads and contact details taken down. Worth doing, and a separate act from reporting the crime.
• To speak to an officer, contact your state or territory police — 131 444, or 000 if someone is in danger.
• ASIC does not act on individual cases. In its own words: "ASIC does not intervene or act in individual matters."
• The investor alert list on Moneysmart (ASIC) is a before-you-pay check, not a place to report — and not exhaustive.

What to do in the first hours

Stop sending money. Most people make one last payment because they have been told a tax, a fee, a "verification deposit" or a withdrawal release is outstanding. That money never comes back, and the request itself is the confirmation you were looking for.

Then, in this order:

1. Copy every destination address and transaction hash (TXID). They are in your wallet history or your exchange records. This is the single most useful thing in the whole report.
2. Screenshot everything before it disappears. Full WhatsApp, Telegram or Messenger threads, the profile that contacted you, the platform's website, the dashboard showing your supposed gains. These sites come down within days.
3. Call your bank. If any leg went through a bank transfer, card payment or PayID, tell them now and ask them to attempt a recall. Banks work in hours, not weeks.
4. Tell the exchange you sent from. Give them the receiving address so they can flag it and act on it if the funds landed with them.
5. Lodge the ReportCyber report.

If you installed remote-access software — AnyDesk, TeamViewer, anything a "broker" walked you through — remove it, change your passwords, check your online banking. Assume they had the device.

Where to report

ReportCyber — cyber.gov.au

ReportCyber is the national cybercrime reporting tool. Reports are assessed and the relevant ones are assigned to police and other law enforcement agencies; the WA Government describes it as referring reports "to the most applicable agency in Australia."

Three things about the form catch people out, all of them in Victoria Police's guidance on it.

Do not attach files — type the addresses, hashes, URLs and phone numbers into the fields and keep your screenshots. Investigators will ask if they want them.

Download your copy before you close the page. You are prompted once and cannot get one afterwards. That copy and the reference number are what your bank and your exchange will ask for.

And lodge once. A second report on the same matter escalates nothing.

Not every report leads to its own investigation. Not a reason to skip it — crypto investment fraud runs at scale, and the same receiving addresses turn up across dozens of Australian victims.

Your state or territory police

Policing is a state and territory responsibility in Australia, and that is where an investigation actually sits. Call 131 444, the national Police Assistance Line, to reach your local police, or attend a station. Call 000 if there is an immediate threat.

Go in with the documents. A report that says only "I was scammed online" carries no case. Bring the addresses, the hashes, the statements and a written timeline.

Scamwatch and the National Anti-Scam Centre — ACCC

Report the scam to Scamwatch too, and understand what you are doing when you do. The ACCC runs Scamwatch under the National Anti-Scam Centre, and with your consent it uses reports to remove scam websites, ads and contact details and to publish warnings.

That is disruption work, and it is valuable — it is how the platform that took your money stops taking other people's. It is not an investigation into your loss. Scamwatch's own reporting page tells cybercrime victims to make a police report through cyber.gov.au. Do both.

A vocabulary note that helps when you file. What the rest of the world calls pig butchering, the ACCC calls romance baiting — an investment scam that opens on a dating app or in a DM. Australians lose more to investment scams than to anything else.

The AFP and the JPC3

The Australian Federal Police lead the Joint Policing Cybercrime Coordination Centre (JPC3), which coordinates the jurisdictions on intelligence and joint task forces. It takes no reports from the public; the AFP directs victims to ReportCyber. To talk to somebody, the ASD's Australian Cyber Security Hotline runs 24/7 on 1300 CYBER1 (1300 292 371) — advice, not a police report.

What documentation to gather

• Every destination wallet address you sent to
• The transaction hash (TXID) for each payment, with date and time
• Full, uncropped screenshots of every conversation
• The exact URL of the platform, the profile, the ad and the withdrawal page
• Bank and card statements, PayID and transfer receipts, and your crypto purchase records
• Names, phone numbers, emails and social handles used to contact you
• A written timeline: first contact, each payment, last contact
• Your ReportCyber reference number and the downloaded copy of the report

Check before you pay — ASIC's investor alert list

The investor alert list, published by ASIC on moneysmart.gov.au, names companies and websites that hold no current Australian financial services or credit licence and are not allowed to offer investments in Australia. Entries are tagged Unlicensed or Imposter, and an Imposter entry names the real licensed Australian company being impersonated, with its ACN. Check it if a "broker" has quoted you a licence number: the list will tell you whose number it actually is.

Run it before you transfer. ASIC says outright that the list is not exhaustive and that "if you can't find a name on the list, it doesn't mean you can trust it."

Why ASIC is not where your case gets resolved

This is the misdirection that costs Australians the most time.

Reporting misconduct to ASIC is reasonable — cyber.gov.au sends crypto-asset scams its way, and ASIC uses reports to detect misconduct and identify patterns. What it will not do is take up your matter. Its own information sheet: ASIC "does not resolve complaints, intervene in disputes, give legal advice or act to get your money back."

A report to ASIC is a contribution to the record, not a claim.

Can I get my money back?

Sometimes. Far less often than the ads suggest.

It turns on one question: did the funds reach a service with compliance obligations — a centralised exchange, a payment processor — before they were dispersed? If they did and a report is lodged, there is a path. Through a mixer, a chain-hopping service, or a platform in a jurisdiction that does not cooperate, that path narrows to almost nothing.

If part of the money moved by bank transfer or card, that leg has the best odds and the shortest clock. On-chain, once the funds are off a regulated platform, nobody in Australia has a lever left to pull.

Nobody can quote you a percentage honestly. Anyone who does it over the phone, without having seen a single transaction, is selling you something.

Beware of "fund recovery" offers

A few weeks on, someone offers to recover it. Sometimes they say they are lawyers. Sometimes they claim contacts inside an exchange, the AFP, or ASIC itself — ASIC has published alerts on money-recovery operations forging documents in its name and on follow-up scams offering to recover lost funds.

It is the same network, or someone who bought the victim list. The tells:

• They contacted you
• Money is required before anything happens
• The outcome is guaranteed
• There are supposed insider contacts

No Australian government agency asks for an advance payment to return your money.

Why put the address on the public record

A criminal investigation moves at the speed of a criminal investigation. A public record works immediately.

Post the address, the hash and the website on Chainabuse and that entry is visible to exchange compliance teams, to investigators, and to anyone searching that address before they transfer. Chainabuse is free, open to everyone, and aggregates reports against the same address — so isolated cases become a visible pattern.

Often the person it saves is the one who searches two weeks later and finds the warning.

Frequently asked questions

1. Where do I report a crypto scam in Australia?

Lodge a cybercrime report at ReportCyber (cyber.gov.au), which refers reports to the most applicable police agency in Australia. You can also contact your state or territory police on 131 444, or 000 in an emergency, and report the scam separately to Scamwatch.

2. Is reporting to Scamwatch the same as making a police report?

No. Scamwatch is run by the ACCC through the National Anti-Scam Centre and uses reports to take down scam websites, ads and contact details. Its own reporting page directs cybercrime victims to make a police report through cyber.gov.au. Do both.

3. Can ASIC get my money back?

No. ASIC says it does not intervene or act in individual matters, and that even when it takes enforcement action it will not generally be able to recover your money. Report through ReportCyber and contact your bank and your exchange.

4. Will ReportCyber recover my money?

No. Victoria Police states plainly that ReportCyber cannot recover funds lost to cybercrime, and that if you have lost money you should contact your bank or financial institution immediately. Lodge the report anyway — it is what puts the crime in front of police.

5. What documents do I need?

Destination wallet addresses, the transaction hash for each payment with date and time, uncropped screenshots of the conversations, the platform's exact URL, bank and card statements, and a written timeline.

6. Is it worth reporting if I only lost a small amount?

Yes. These operations run at scale and the same receiving address collects from dozens of victims. A small report can be the entry that connects the rest.

7. Does reporting to Chainabuse replace the police report?

No — do both. The ReportCyber lodgement puts the crime in front of Australian police. The Chainabuse report makes the address visible to exchanges and investigators in every country the money might reach.