If it feels like scam calls have gotten smarter this year, that’s because they have. We’ve spent the last few months digging through reader reports, telco data and the latest Scamwatch figures, and the pattern is clear: the crude “your NBN is about to be disconnected” robocall hasn’t disappeared, but it’s being crowded out by something far more convincing. Australians are now fielding calls that clone a family member’s voice, display a legitimate-looking bank number on the screen, or arrive as a single ring designed to bait a callback. In this piece we’re breaking down exactly what’s changed, why the old advice of “just listen for the accent or the bad grammar” no longer cuts it, and what actually works to protect yourself and your family in 2026.
How scam calls have changed in 2026
The scam call of five years ago relied on volume. Call a million numbers, get a few hundred bites, and the economics worked even with a laughably fake script. That model still exists, but it’s no longer the sharp end of the threat. What’s changed is the toolkit available to the people running these operations. Cheap, accessible AI voice generation, commodity spoofing software, and stolen personal data bought off the dark web have combined to make scam calls personalised in a way they never used to be.
Where a scammer once had to guess your bank, they now often already know it, along with your name, your suburb and sometimes even a recent transaction, because that data was sitting in a breached database somewhere. Combine that with a caller ID that matches your actual bank’s real number, and a huge amount of the old suspicion just evaporates. We’ve talked before about how to spot a scam website through mismatched URLs and shonky checkout pages, but the phone channel doesn’t give you a URL to inspect. You’ve got a voice, a number, and a few seconds to decide whether to trust it.
AI voice-cloning of relatives and officials
The single biggest shift we’re seeing reported is voice cloning. It used to take a recording studio and hours of source audio to fake a voice convincingly. Now it takes a few seconds of someone’s voice, pulled from a public social media video, a podcast appearance, or even a voicemail greeting, fed into a widely available AI tool. The result is a synthetic voice good enough to fool a parent, partner or grandparent over a phone line, especially when the call opens with panic and urgency built in.
The classic version is the “family emergency” call: a voice that sounds exactly like your son or daughter, sobbing, saying they’ve been in an accident or arrested overseas and need money transferred immediately, followed by a second “police officer” or “lawyer” voice taking over the call to add pressure and legitimacy. We’re also seeing the same technique used against small businesses, with a cloned “CEO” voice instructing a bookkeeper to process an urgent invoice. The tell isn’t in the voice quality anymore, because the voice quality is often flawless. The tell is in the pressure: a demand for immediate action, secrecy, and an unusual payment method like gift cards, cryptocurrency or a wire transfer. If a call ticks those boxes, hang up and call the person back on a number you already have saved, not one the caller gives you.
Spoofed caller ID that mimics real numbers
The second big change is how convincingly scam calls now present themselves. Caller ID spoofing isn’t new, but the sophistication and scale of it in 2026 is. Scammers can now make a call appear to come from your actual bank’s fraud department, from the Australian Taxation Office, or even from a number that matches one already saved in your contacts. This is sometimes called “neighbour spoofing” when it mimics a local number to increase the odds you’ll answer, and it’s increasingly used against numbers with a recognisable 1800 or bank prefix too.
This matters because a lot of long-standing consumer advice (“check the number before you answer”) simply doesn’t hold up the way it used to. A spoofed number can pass that check and still be entirely fraudulent. Banks are responding to this by changing how they authenticate themselves: most of the big four now tell customers outright that they will never ask for a PIN, full password or one-time SMS code over the phone, and several have introduced in-app verification so you can confirm a call is genuine without giving out any information at all. If you’re ever in doubt, the safest move is to hang up and call the number printed on your card or on the bank’s official website, not any number the caller supplies or that appears on your screen.
Wangiri and missed-call scams
Not every new tactic relies on AI. “Wangiri,” a term borrowed from Japan meaning “one ring and cut,” is a much older trick that’s seen a real resurgence in Australia this year. It works on pure curiosity: your phone rings once, from an unfamiliar number, often with an international or premium-rate prefix disguised to look local, and then goes silent. The instinct to call back is strong, and that’s exactly the point. Calling back connects you to an expensive premium-rate line, and the scam operators profit from every second you stay connected, sometimes with a recorded message designed to keep you on the line as long as possible.
These campaigns are cheap to run and easy to scale, which is why they tend to arrive in bursts, a flood of missed calls from similar-looking numbers over a day or two before the campaign moves on. The advice here is simple: if you don’t recognise a number and it only rang once, don’t call it back. If you’re curious, look the number up online first, and if it’s tied to a premium or international rate you don’t recognise, leave it alone entirely.
What banks are doing differently
To their credit, Australian banks have moved a long way on this over the past couple of years, largely in response to the scale of losses being reported. Confirmation of Payee style checks, in-app call verification, and mandatory delays or extra warnings on transfers to new payees are all now standard at the major institutions. Several banks have also started running real-time scam pattern detection on transfers, flagging and sometimes pausing payments that match known scam behaviour, such as a first-time large transfer to a newly added account shortly after a phone call.
None of this is foolproof, and scammers adapt to each new defence, but it does mean that a lot of the everyday phone-based fraud that used to succeed through sheer bluff is now being intercepted before money actually moves. It also means that if your bank calls and something about the request feels off, even slightly, hanging up and calling them back on their official number is never going to cause a problem. Genuine banks expect and encourage that caution.
Practical defence: what actually works
With the caveat that no single tool stops every scam, there are a handful of concrete things that meaningfully cut your exposure:
- Turn on call screening. Most modern Android and iPhone handsets, plus your telco’s own app, offer a screening feature that answers unknown numbers with an automated prompt before your phone even rings, filtering out a huge share of robocalls and spoofed numbers.
- Register with, and check, the Australian Communications and Media Authority’s Do Not Call Register. It won’t stop scam calls (most operate outside the law entirely), but it does cut down legitimate telemarketing, which makes it easier to notice what’s genuinely suspicious.
- Use ACMA’s Number Search Register tools and your telco’s fraud-reporting channel if you’re being repeatedly targeted from a specific number, so the pattern gets flagged at the network level rather than just blocked on your own handset.
- Report every scam call you receive to Scamwatch, run by the ACCC, even if you didn’t lose money. Reporting builds the data set that identifies new tactics early and helps warn others before a wave of a particular scam peaks.
- Agree a family code word with elderly or vulnerable relatives, something never posted online or said in a recorded voicemail, that can be used to verify identity in a genuine emergency call.
- Never act on urgency alone. Every scam call, cloned voice or not, relies on you making a decision in the next thirty seconds. Hanging up and calling back on a known number costs you nothing and defeats almost every version of this fraud.
It’s also worth remembering that scam calls rarely operate in isolation anymore. The same criminal groups running voice-cloning scripts are often behind fake verification pages that try to charge you for a service that should be free, the kind of thing we’ve covered in our look at scam websites that charge you for verification, and the phone call is frequently just the first step designed to get you onto a follow-up website or SMS link to “confirm” details. Treating a suspicious call as an isolated event misses how joined-up these operations have become, which is also why we’ve been tracking the wider shift in cybersecurity threats facing Australians in 2026 as a single, connected picture rather than a list of unrelated scams.
Final thoughts
The core lesson for 2026 isn’t that Australians have become careless, it’s that the tools used against us have gotten dramatically better while the fundamentals of the con haven’t changed at all. Urgency, secrecy and an unusual payment request are still the reliable warning signs, no matter how convincing the voice on the other end sounds or how legitimate the number on your screen looks. Caller ID can be faked, a voice can be cloned, but a scammer still can’t fake the twenty seconds it takes you to hang up and call back on a number you already trust.
Build a couple of habits now, before you’re the one on the receiving end of a panicked, tearful voice that sounds exactly like someone you love. Turn on call screening, agree a family code word, and get comfortable simply hanging up on anyone who’s pushing you to act immediately. And whether or not you lose a cent, report what you see to Scamwatch. Every report makes the next person’s warning arrive a little sooner.
