SMS Phishing Pages Emptied 39 Bank Accounts in Sydney

A text message, a link and a page that looked like your bank or phone company. The page was a trap, and it opened both your phone account and your bank accounts.

By Siddharth ShankarUpdated October 11, 2026

Most people have seen a text that claims their bank account has been locked or their parcel is waiting. This case shows what happens when a single person runs that kind of scam at scale: hundreds of targets, a few dozen empty accounts and a trail that investigators can follow.

What happened

The AFP, working with the NSW Police Cybercrime Squad and with Commonwealth Bank, NAB and Telstra, reported that a man from Ryde was sentenced at Sydney Local Court on Friday, January 20, 2023. The scam had started in 2018, and he was arrested on November 24, 2021. The AFP investigation began in September 2021 after information about suspicious website registrations.

He was convicted of four offences, including obtaining a benefit by deception and unauthorized access or modification of data with intent to commit a serious offence. The release lists a $1,000 recognisance order and a 13-month good behavior bond after release.

How it worked

He set up phishing webpages that lured Australians into entering personal information. He then used it to access their phone and bank accounts and to open new accounts without their knowledge. The scam targeted 450 victims, and he was linked to more than $100,000 stolen from the accounts of 39 people.

Phone and bank logins together are powerful. Access to a phone account can allow the intercepting of text codes, while access to a bank account can allow transfers. Controlling both makes each step of the fraud easier.

What was exposed

Login and personal details typed into fake web pages gave access to phone and bank accounts, and new accounts were opened in victims' names. The release does not give the specific data types, and we do not guess.

How it ended

The man was sentenced, and the banks and telco responded by adding extra security to affected accounts, which the AFP says helped protect 16,147 other Australians. The release does not say how much of the $100,000 stolen was recovered.

A timeline of the case

The scam began in 2018. The AFP investigation began in September 2021 after information about suspicious website registrations, and the arrest followed on November 24, 2021. Sentencing came on January 20, 2023, and the AFP issued its release on January 23.

The investigation started with web registrations, not victim complaints. That is a useful reminder that suspicious activity can sometimes be identified from the infrastructure criminals use, before many victims have even noticed a problem.

Key facts at a glance

• Sentencing date: January 20, 2023, Sydney Local Court
• Targets: 450 victims
• Stolen: more than $100,000 from 39 people
• Scam began: 2018; arrest November 24, 2021
• Protected by extra security: 16,147 other Australians, according to the AFP
• Offences: four, including obtaining a benefit by deception

Why this case matters

A phishing page does not have to be clever. It has to look familiar at the moment someone is distracted. The AFP release shows that the pages were registered as websites, and that suspicious registrations helped start the investigation.

The protective effect for other customers is also notable. After the case, the institutions added security that helped 16,147 other people. When one victim is identified, others who would have been next can sometimes be protected.

What you can do

What the release does not say

The release does not name the specific websites or say how the numbers were chosen. For a UK service that sold ready-made phishing pages, see LabHost.

Nothing here can be undone for the people involved, but you can prepare. See the guides on how to tell a real breach notice from a phishing message, how credential stuffing works and what to do after your email appears in a breach. You can also try our free email exposure check.