ASIC's 182% Contains Growth Rates From 30% to 279%

The Australian Securities and Investments Commission said on 17 August that it removed more than 19,400 online scams in FY26, up 182% on the previous year, and warned that generative AI is being used to build entire networks of fake endorsements around investment fraud.

The release also breaks the total into three categories. Adding them up produces a smaller number than the total, and the growth rates behind the single 182% figure range from about 30% to 279%.

What the 182% is made of

ASIC gives three category figures for FY26. Phishing scam hyperlink takedowns came to 5,476. Fake investment platform takedowns came to 7,051. Cryptocurrency investment scam takedowns came to 3,106.

Adding those three gives 15,633. The stated total is more than 19,400, which leaves roughly 3,767 takedowns — about 19% of the year's work — in categories the release does not name. The release describes the overall total as including "fake websites, social media ads, phishing scams and cryptocurrency investment scams", so fake websites and social media ads are the likely remainder, but they are not given their own figures.

The arithmetic also confirms the "more than" in the headline number. ASIC gives the FY25 baseline as 6,915. A 182% increase on 6,915 implies roughly 19,500, slightly above the 19,400 that is stated, which is consistent with the total being a floor rather than a precise count.

One headline rate, three very different trends

The single most useful thing in the release is the set of category growth rates, because they do not move together.

Phishing hyperlink takedowns rose 279%. Fake investment platform takedowns rose 151%. Cryptocurrency investment scam takedowns rose by almost 30%. The overall figure of 182% sits inside a spread of roughly 249 percentage points.

The ranking is worth pausing on. Cryptocurrency investment scams are the category most associated with this kind of fraud in public discussion, and in ASIC's takedown data they are the slowest-growing of the three named categories by a wide margin. Phishing links, the least glamorous category, grew fastest.

These are takedown counts, not incident counts, so they measure what ASIC found and removed rather than what happened. A category can grow because the underlying activity grew, because detection improved, or because enforcement attention shifted. The release does not separate those effects, and neither can anyone reading it.

The $7.4 million is a narrower number than it looks

The figure most widely quoted from the release is A$7.4 million in losses. It is a specific and limited number, and it is easy to repeat as something larger than it is.

ASIC attributes it to reports made to Scamwatch, covering scams that impersonated the ten most impersonated well-known Australians in FY26. It is not the total lost to investment scams, not the total lost to deepfake scams, and not the total lost to scams ASIC took down. It is the reported loss attached to one specific impersonation set, drawn from self-reported complaints.

Scamwatch is run by the National Anti-Scam Centre, which is also the source ASIC cites for the impersonation ranking itself.

Ten entries, eleven people

The list of most impersonated public figures has ten entries: Anthony Albanese, Tom Piotrowski, Alan Kohler, Stephen Koukoulas, Jacqui Lambie and Angus Taylor, Dick Smith, Gina Rinehart, Alan Oster, Pauline Hanson and John Laws.

One entry names two people. ASIC notes that Lambie and Taylor "appear in the same scam", so the ten list positions cover eleven individuals. The detail matters only if the list is being used as a count, which it sometimes is.

The composition is also more varied than "celebrity deepfakes" suggests. It mixes serving politicians, a business commentator, a market analyst, two bank and market economists, a broadcaster and two well-known business figures. ASIC adds that scammers switch targets opportunistically as the news cycle moves, so the ranking should be read as a snapshot rather than a stable list.

The funnel ASIC describes ends in a payment

The mechanics section of the release is the part with the most operational content for anyone in payments, and it describes a sequence rather than a single fraudulent act.

A consumer sees an advertisement on a mainstream platform. The ad carries an AI-generated impersonation of a recognisable figure. It leads to a fabricated news article containing the endorsement and invented public comments. Around that sit spoof websites, fake reviews and further AI-generated video, all built so that a consumer who does the obvious check — searching the name or the brand — finds corroboration that the scammers made.

Once contact details are captured, ASIC says scammers follow up with scripted phone calls, fake investment platforms, and small profit payments made to the victim to build trust.

That last item is the one worth noting. Genuine outbound payments are being used as a persuasion device, which means part of the fraud pattern shows up as money moving to the victim before it moves away from them. ASIC's own consumer advice puts banks in the reporting loop alongside cyber.gov.au and Scamwatch, and says the money in these cases typically goes to overseas criminals and is not recovered.

Verification is the attack surface

ASIC's framing is that the checks consumers are told to perform have themselves become the target.

The release says scammers build "an online footprint of supportive news articles, positive reviews, ads and websites that work together to deceive", and that a simple online search is not sufficient. It extends the same warning to licence checks: scammers claim to hold an Australian Financial Services Licence, use another entity's licence number, or impersonate a licensed business outright.

The advice given is correspondingly narrower than "check online". ASIC directs consumers to verify the licence holder's name and number against its own professional registers, confirm the details match the business being promoted, and consult the Moneysmart Investor Alert List. The distinction is between searching for information and checking it against a register, and it is the practical core of the release.

Three years of takedowns, decomposed

ASIC says it has removed more than 33,400 scam websites, social media ads and phishing scams since launching its takedown capability three years ago.

Set against the two annual figures the release gives, the shape of that total becomes clear. Subtracting FY26's 19,400 and FY25's 6,915 leaves roughly 7,085 for the earlier period. FY26 alone accounts for about 58% of everything taken down in three years.

Whether that reflects a scam surge, a capability that has scaled, or both, the release does not say.

What the numbers do and do not measure

Established: ASIC removed more than 19,400 online scams in FY26 against 6,915 in FY25; the three named categories are 5,476 phishing hyperlinks, 7,051 fake investment platforms and 3,106 cryptocurrency investment scams, growing 279%, 151% and almost 30% respectively; more than 33,400 have been removed in three years; and A$7.4 million in losses was reported to Scamwatch in connection with the ten most impersonated public figures.

Not established: how many scams were not detected, how many consumers saw the ones that were removed, how long each stayed up before removal, what the roughly 3,767 unclassified takedowns consisted of, total losses across all investment scams, how much of the A$7.4 million was recovered, and how much of the growth is more fraud rather than more enforcement.

The defensible reading is that a regulator has published a large increase in removals, a category split that does not move in one direction, and a mechanism description in which the last step before the loss is an ordinary payment.