The use of email as a vehicle for scams has intensified in Australia, with recent figures showing substantial financial losses and a spike in compromised accounts.
The trend reflects an expanding threat landscape that is prompting insurers and brokers to reassess cyber risk and client protections.
According to the Australian Competition and Consumer Commission’s (ACCC) Scamwatch data, email surpassed all other communication channels in 2024 as the leading point of contact for scam-related activity, with around 91,000 reported cases.
By February 2025, email remained the most reported method, with nearly 18,000 cases lodged in the first two months alone. In earlier years, scammers relied more heavily on calls and text messages to target victims.
Since 2020, Australians have reported close to $300 million in losses linked to scams involving email contact.
Data shows that men accounted for 60% of these losses, with the most significant impact occurring among those aged 65 and over, who recorded about 67,000 complaints and lost $63 million. Women aged 65 and above also reported a high number of incidents, although women in the 45 to 54 age group experienced higher average losses, reporting $29 million from 19,000 cases.
Investment scams emerged as the costliest type of fraud initiated via email, accounting for nearly half of the total monetary loss across all scam categories using this contact method. These schemes frequently involve fraudsters impersonating legitimate financial institutions or investment firms.
Scamwatch suggested this high loss rate may reflect both the substantial sums involved and potential underreporting of lower-value scams. Other common scam types by financial impact include:
While investment scams involve high-dollar amounts, email is not the most common method used in those cases. Instead, most investment-related scams begin with a phone call, followed by contact through social media or forums, with email ranked third.
New South Wales recorded the highest number of investment scam reports per capita, with 141 reports per 100,000 residents, and led all states in total losses, with over $330 million reported since 2020.
Simultaneously, ransomware threats are escalating, adding to the complexity of cyber risk management.
Bitdefender’s March 2025 Threat Debrief placed Australia sixth globally among the countries most affected by ransomware in February. The report documented 962 ransomware claims that month – up from 425 in the same period last year – marking the highest monthly figure to date.
In related findings, Surfshark reported a record number of breached Australian accounts last year – approximately 47 million – placing the country 11th globally for breach volume. Since 2004, over 192 million accounts in Australia have been compromised, the highest total in the Oceania region, with more than 49 million unique email addresses affected.
