What the Latest Scam Report Reveals About How Risk Is Really Forming
Scams are no longer isolated incidents or purely consumer problems. The latest Targeting Scams Report, published by the National Anti Scam Centre, highlights a landscape that is complex, adaptive and increasingly difficult to disrupt.
The Australian Competition & Consumer Commission (ACCC) highlights an alarming detail from the report:
“In 2025, Australians made a combined total of 481,523 scam reports across these institutions*. Of these, 274,577 reports involved financial losses totalling $2.18 billion.”
Losses are also concentrated. The top five scam types alone account for around 60% of total losses reported. On top of this list are investment scams, followed by payment redirection scams, romance scams, phishing scams and remote access scams.
These losses are still increasing even as overall report volumes stabilised. This suggests that scams are now becoming more effective, more targeted, and more embedded in everyday digital interaction.
These risks are not random but predictable, repeatable, and increasingly aligned to how organisations already operate.
The broader message from the report is that while progress has been made through takedowns, disruption activity and cross sector collaboration, the problem is far from solved. Continued action across government, industry and organisations themselves, is not optional. It is necessary to keep pace with how quickly scam activity is evolving. As ACCC Deputy Chair Catriona Lowe said, “The Targeting Scams Report reinforces that scam prevention requires a coordinated, whole-of-ecosystem approach.”
*The report combines data from Scamwatch, ReportCyber, the Australian Financial Crimes Exchange (AFCX), IDCARE and the Australian Securities and Investments Commission (ASIC)
Nothing about this looks unusual at first
If scams are evolving at this pace, effective responses need to evolve with them.
The report makes clear that many scam losses are no longer the result of obvious security breakdowns. Instead, they emerge through trusted channels, routine decisions and the way digital processes function in practice. This is where the focus for cyber security begins to shift.
“Most of the time, nothing looks obviously wrong… and that’s what make risks hard to spot. The real risk is often sitting in the everyday decisions that no one thinks to question.” – Chris Cox, Head of Infrastructure and Security Solutions at Diamond IT
It’s easy to treat cyber security as a ‘tools’ problem. In reality, the starting point is often understanding where risk sits in everyday operations.
This includes looking closely at:
- How identity is established and trusted
- How payments and approvals are handled
- Where third party platforms intersect with internal systems
- Where assumptions replace verification
These are not abstract concerns. They are the same points where the most common and costly scam types take hold.
Where risk becomes hard to see
The challenge is that these conditions rarely sit neatly within a single system or team. They exist between systems, between roles, and between responsibilities which is why they often go unseen until they are exploited.
In these situations, a collaborative session designed to understand, discover, assess and make informed decisions around cyber risk and security becomes critical.
It shifts the focus from what controls exist to how risk actually develops. It involves examining how systems are used in practice, how decisions are made under pressure, where exceptions occur, and where accountability is unclear. From here, organisations can build a more realistic view of their exposure.
In an environment where scams are becoming more organised, scalable and increasingly supported by emerging technologies such as AI, understanding these dynamics early is what enables more effective prevention.
How Diamond IT Can Help
Understanding where risk sits is one thing, knowing what to do next is often the challenge. That’s where Cyber Risk Discovery can help.
At Diamond IT, our experts work with organisations to step back and look at how risk shows up in everyday operations: across systems, decisions and processes, not just within security tools. The goal is simple: build a clearer picture of where risk exists today, so you can make more confident decisions about what to prioritise and how to address it.
If the Targeting Scams Report has raised questions about your own environment and you’re ready to assess your current cyber security posture, talk to us at 1300 307 907, send us an email to enquiries@diamondit.com.au or fill out the form below.
