Queensland crypto scams: the scripts in use, and what to do in the first hour

What is happening right now

Queensland is not experiencing a generic, national wave of crypto fraud. It is experiencing specific, locally targeted campaigns, and the police warnings have been specific enough to name suburbs.

In January 2026 Queensland Police issued warnings to North Brisbane residents about cryptocurrency ATM scams — the pattern where a victim is telephoned, frightened, and directed to a machine in a shop. In July 2026 the Financial and Cyber Crime Group warned about a highly targeted phishing campaign using physical letters delivered to mailboxes carrying a QR code that crypto holders were encouraged to scan. And in the same month, police reported Queenslanders losing close to $1.5 million in a five-day window.

The national picture provides scale. The AFP has warned of more than $3 million lost to cryptocurrency ATM scams in a twelve-month period, and its "Tapped Out" operation targeted criminal use of crypto ATMs across the country. AUSTRAC's own analysis found that Australians aged 60 to 70 were the heaviest users of these machines and formed a large share of the victims — which is why the AU$5,000 cash cap and mandatory on-screen warnings arrived in June 2025.

There is a genuinely encouraging number in among that. ACCC Targeting Scams reporting put losses where crypto was the payment method at $221 million in 2022, and at $71.2 million by 2024. The bank caps, transfer delays and platform blocks that legitimate buyers find irritating appear to have cut those losses by roughly two thirds.

1. The authority call, ending at a machine

Someone rings claiming to be from your bank's fraud team, the ATO, a telco, or a police or "warrant" office. There is a problem: a fraudulent transaction, an unpaid debt, a compromised account. The solution requires urgency and secrecy — do not tell the bank staff, do not discuss it with family, this is a live investigation. The instruction is to withdraw cash and deposit it into a cryptocurrency ATM, "to protect it".

This is the script behind the North Brisbane warnings and behind most of the AFP's ATM loss figures. The single fact that defeats it entirely: no legitimate organisation in Australia will ever ask you to pay by crypto ATM. Not one, not ever, under any circumstances.

2. The QR-code letter

A physical letter arrives at your address, addressed to you, referencing crypto holdings and containing a QR code to scan for a security check, a migration, or a required verification. Queensland Police flagged this in July 2026 as elaborate and highly targeted. The QR code leads to a convincing page that asks for your seed phrase or wallet credentials, and once those are entered the wallet is emptied within minutes.

A seed phrase is the wallet. Anyone who has it owns the funds, and there is no recovery. No legitimate provider — hardware or software — will ever ask for it, by post, email, phone or support chat.

3. Romance into investment

Weeks or months of genuine-feeling conversation on a dating app or social platform, never quite leading to a meeting. Eventually an investment opportunity appears, presented as a personal advantage rather than a pitch. A platform, a dashboard, small early withdrawals that work perfectly, then larger deposits, then "tax" or "release fees" required before you can withdraw.

The dashboard is software. The balance is a number in a database. The withdrawals that worked were paid out of your own earlier deposits to build trust.

4. The fake platform with real-looking credentials

A trading site with a professional interface, cloned company details, a fabricated ASIC or AUSTRAC reference, and sometimes a real registered company name lifted wholesale. The tell is usually in the offer — guaranteed returns, "capital protection" on volatile assets, a signal group with an account manager who calls you. Check the AUSTRAC register directly rather than trusting a number displayed on the site, and check ASIC Moneysmart's warning list.

5. Job and task scams

An offer of remote work — product reviewing, app testing, "optimisation tasks" — where you deposit crypto to unlock higher-paying tasks and earn commission. Early small deposits genuinely pay out. The mechanism is identical to the romance variant, and it has been targeting younger Australians and students specifically.

6. Impersonated support

You post a problem in a forum, a Telegram group or a comment thread, and within minutes someone claiming to be support messages you privately. They ask you to connect your wallet to a "diagnostic" site or share a screen. Legitimate support never initiates a private message, and never needs remote access to your machine.

Why machines feature so heavily

Crypto ATMs appear in an outsized share of Australian scam losses for reasons that have nothing to do with the technology. Cash is final. A machine accepts notes from anyone who can be talked into standing in front of it, converts them into an irreversible transfer, and does not involve a bank employee who might ask what the money is for.

That is precisely why regulators moved. Since 3 June 2025, AUSTRAC has capped crypto ATM cash at AU$5,000 per customer, required scam warnings displayed on the machine, mandated enhanced customer due diligence and required stronger transaction monitoring. In August 2026 it went further, suspending Cryptolink Pty Ltd's registration for three months and taking 96 machines offline across Sydney, Melbourne and Brisbane over repeated anti-money-laundering failures — including a failure to lodge Threshold Transaction Reports for cash transactions above AU$10,000.

None of that helps if someone is standing at a machine with a phone to their ear. The warning screen is the last line of defence, and by then the victim has usually been coached to ignore it. Our ATM guide covers the mechanics if you have a legitimate reason to use one.

The first hour after a loss

Speed matters enormously in the first sixty minutes and almost not at all after twenty-four hours, because the only funds anyone can realistically stop are the ones still inside the banking system.

Who to report to, in order

People often report to only one body and assume it propagates. It does not, and each one does something different. Your bank is the only party with any chance of stopping money. ReportCyber is the front door to Australian police for cybercrime and routes your report to the right jurisdiction, which matters because most offenders are offshore and Queensland Police may need to work with the AFP. Scamwatch feeds the national dataset the ACCC publishes and regulators act on — the $221 million and $71.2 million figures on this page exist because people reported. IDCARE handles the identity consequences, which frequently outlast the financial ones.

If a licensed Australian financial firm was involved and you are unhappy with how it handled the matter, AFCA resolves those disputes free of charge. If a Queensland business was involved, Queensland Fair Trading is the consumer avenue.

The second scam: fake recovery

This deserves its own section because it targets people at their most vulnerable, and because it works. Within days or weeks of a loss — sometimes within hours — you will be contacted by someone offering to recover your crypto. They may claim to be a blockchain forensics firm, a lawyer, a "fund recovery specialist", or even a government body. They will show you a report with your own transaction hashes in it, which is trivially available on any public blockchain explorer, and present it as proof of capability.

They will then ask for an upfront fee, or for wallet access to "trace" the funds. There is no recovery. Blockchain transactions are irreversible, and no private firm can compel an offshore exchange to return funds. A meaningful share of recovery approaches come from the same networks that ran the original scam, working a list they already have.

The only legitimate paths are the ones above: your bank, police, and the regulators. All of them are free.

Protecting an older relative

Given AUSTRAC's finding that 60-to-70-year-olds are the heaviest crypto ATM users and a large share of victims, and given that Queensland Police issued suburb-level warnings to North Brisbane residents specifically, this is worth a direct conversation rather than a forwarded article.

What works, in our observation, is not warning people about crypto — most of them have no interest in crypto and that is exactly why they do not recognise the machine as unusual. What works is one simple rule, stated plainly and repeated: nobody legitimate will ever ask you to put cash into a machine, and any caller who tells you not to discuss it with family is lying. Give them permission to hang up on anyone, and make it clear that calling you to check is never an imposition.

Practically: make sure they know their bank's real phone number is on the back of their card, not in a call they received. And if they do hold crypto, make sure someone else knows it exists — a meaningful amount of Australian crypto is lost not to scams but to a death with no recovery plan.