Crypto scams are not a niche problem. The Australian Competition and Consumer Commission's (ACCC) Scamwatch data consistently ranks investment scams, of which crypto-related ones form the largest share, as the highest-loss category for Australian consumers. If you've been defrauded, or you suspect you have been, knowing exactly which regulator to contact and in what order matters. Most victims report to no one, partly because they don't know where to start and partly because they assume nothing will happen. That assumption isn't entirely wrong, but filing a report still serves three real purposes: it builds the intelligence base that regulators use for enforcement, it creates an official record you may need for tax purposes, and in some cases it triggers asset freezes before money moves offshore.
The four bodies you need to know
Australia has no single crypto fraud regulator. Jurisdiction depends on what type of scam occurred and who the bad actor is. In practice, four bodies handle the bulk of crypto-related complaints.
Scamwatch (ACCC) is the first stop for most victims. It's the ACCC's consumer-facing scam reporting platform, and it covers everything from romance-baiting investment schemes to fake exchange websites. Filing a Scamwatch report takes under ten minutes. Scamwatch doesn't investigate individual complaints or recover money, but it feeds intelligence to the National Anti-Scam Centre (NASC), which coordinates responses across agencies, including foreign law enforcement.
AUSTRAC is the relevant body when your complaint involves an Australian-registered digital currency exchange (DCE) that may have facilitated the fraud, either through lax customer onboarding, failure to freeze suspicious transactions, or outright complicity. AUSTRAC's role is anti-money-laundering compliance. It can investigate and deregister non-compliant DCEs, which carries real consequences, as losing an AUSTRAC licence effectively kills an exchange's ability to operate in Australia.
ASIC handles complaints where the scam involved unlicensed financial services or financial product misrepresentation. Fake managed fund schemes, fraudulent crypto "investment platforms" offering guaranteed returns, and unlicensed derivatives products all fall under ASIC's remit. ASIC has the power to seek court-ordered asset freezes and civil penalties, and it maintains an investor alert list of unlicensed operators which it updates regularly.
The Australian Federal Police (AFP) is the right contact when the fraud is criminal in nature and there's a reasonable prospect of identifying the perpetrators. The AFP's cybercrime reporting portal (ReportCyber) accepts crypto fraud submissions. Expect a slow response unless the loss is significant (generally AU$50,000 or more) or the scam connects to a larger operation already on the AFP's radar.
What to collect before you file anything
Evidence gathered in the first 24–48 hours is almost always better than evidence gathered a week later. Wallets get swept, websites go dark, and social media accounts disappear.
Pull together the following before you open any reporting form:
- Transaction IDs (TXIDs) for every transfer you made to the scammer's wallet
- The wallet address or addresses you sent funds to
- Screenshots of the platform, chat conversations, emails, and any promotional materials
- URLs of the scam website and any referral links
- Dates and AUD amounts of each transfer, including the exchange rate at the time (you'll need this for ATO purposes too)
- The name of the Australian or offshore exchange you used to send the funds
If you transferred from an AUSTRAC-registered exchange like CoinSpot, Swyftx, or Independent Reserve, contact that exchange's support team immediately. Some exchanges will flag the destination address internally or co-operate with law enforcement requests to trace follow-on transactions. Don't wait for the regulator to ask them; contact the exchange yourself the same day.
The ATO angle: losses from scams aren't automatically deductible
This is where many Australian victims get a second unpleasant surprise. Under current ATO guidance, a capital loss can only be claimed if you acquired a CGT asset and later disposed of it at a loss. Sending funds to a scammer and never receiving anything in return isn't a disposal in the traditional sense. The ATO's position on crypto sent to scammers sits in a grey zone, and the deductibility of those losses depends on the precise circumstances.
If you did receive some kind of token or "investment unit" from the scam platform before it collapsed, you may have a CGT event to work with. If you received nothing at all, you might be looking at a theft loss, which has different and less generous treatment. Either way, this is a question for a registered tax agent with crypto experience, not a general rule. Keep all your transaction records, because you'll need them regardless of how the ATO characterises the loss. Our guide to Australia's crypto tax rules in 2026 covers the CGT framework in more detail.
How to file with each body
Scamwatch: Go to scamwatch.gov.au, click "Report a scam", select "Investment" as the scam type, and choose "Cryptocurrency" from the sub-category list. You'll be prompted for contact details, the amount lost, and a description. You can attach evidence files. The form takes around 10 minutes.
ASIC: Use ASIC's online complaints form at asic.gov.au. Select "Misconduct or a compliance concern" and specify unlicensed financial services if applicable. ASIC publishes a reference number and updates you by email if your complaint triggers an investigation. ASIC's Moneysmart investor alert list is also worth checking to see whether the platform you dealt with was already flagged.
AUSTRAC: Go to austrac.gov.au and use the "Report suspicious matter" form if you're an industry participant. If you're a retail consumer, your best route is to contact AUSTRAC via email or phone and describe the exchange that facilitated the transfer. AUSTRAC doesn't operate a public retail complaints portal in the same way Scamwatch does, so a direct call is often the fastest path.
AFP / ReportCyber: Go to cyber.gov.au and submit via the ReportCyber portal. Provide your TXID list, the wallet addresses, and a clear timeline. If the Australian Cyber Security Centre (ACSC) identifies a pattern, they may refer the matter to the AFP's cybercrime unit.
What you can realistically expect
Recovery of lost funds through regulatory action is rare. Most crypto scam proceeds move through mixers and cross-chain bridges within hours, making on-chain tracing difficult even for agencies with blockchain analytics tools. That said, regulators do act on the intelligence. ASIC has taken action against multiple unlicensed crypto platforms in recent years. The NASC has disrupted scam infrastructure. AUSTRAC has deregistered DCEs for compliance failures tied to scam facilitation.
The realistic outcomes for most reporters are: an official record exists, the scam operation gets added to a watch list, and in the best case, a future victim is protected because the platform gets shut down or publicly flagged. That's not nothing. It's also worth tracking whether the exchange used by the scammer holds AUSTRAC registration, because exchanges operating without registration are committing a criminal offence under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, which adds another enforcement angle entirely.
If you're uncertain whether the platform you used to send funds was legitimately registered, the AUSTRAC DCE register is publicly searchable. Cross-checking before any transfer is one of the most reliable protections available, and it's directly relevant to the broader question of what ASIC expects from crypto platforms operating in Australia.
A note on private recovery services
A secondary scam industry has grown around crypto fraud victims. "Recovery firms" that promise to retrieve your stolen crypto in exchange for an upfront fee are almost universally fraudulent. ASIC and Scamwatch have both issued warnings. If anyone contacts you after a loss and offers recovery for a fee, treat that as a second scam attempt. Report it to Scamwatch too.
Filing a report won't undo the loss. But it costs almost nothing, takes under an hour across all four bodies, and contributes to a regulatory record that shapes how seriously Australian authorities treat the crypto fraud problem over time.