Can a scammer fake a phone number? The number on your screen is not evidence.

On Thursday, the owner of one of Australia's three big mobile networks went public with an accusation about where scam calls come from, and the figure it put on it is hard to look away from. Vodafone's owner says it analysed the scam calls on its own network over a year and found that 98 per cent of them, more than 24 million calls, arrived through a single wholesale carrier.

Among the identities used in those calls, according to Vodafone's fraud team: police stations in Western Australia, Queensland and South Australia, and the Australian Federal Police.

There is a fight going on between two companies about whose fault that is. It is a real fight and this article will set out both sides of it. But the fight is not the part that affects you. The part that affects you is simpler, older and almost never said plainly.

The number your phone shows you when it rings is not a fact about the caller. It is a piece of information set by whoever placed the call, passed along and sometimes rewritten by the networks in between, and displayed by your phone without comment.

Can a scammer fake a phone number?

Yes. Comfortably, cheaply and at scale, and the ability to do it is not a flaw somebody forgot to fix.

The number presented to you with a call is a field, set by the originating service, which travels with the call across the networks it passes through and can be overwritten along the way. There are entirely legitimate reasons to set it to something other than the line you are physically calling from. A hospital with four hundred extensions presents one switchboard number. A call centre in one state presents the local number of the business it answers for. A doctor returning your call from a mobile presents the clinic.

The same mechanism, pointed at a number that belongs to a police station, produces a call that looks like the police. Nothing in your handset checks the claim, because your handset has no way to check it. There is no equivalent, for a voice call arriving on an Australian phone, of the padlock in a browser.

Which means the oldest instruction in scam advice, the one about looking at who is calling before you decide whether to trust them, has been quietly unusable for years. Most people have never been told.

What Vodafone says it found

Here is what each company has actually said, which is worth separating carefully, because one party's analysis of its own network is not the same thing as an established fact and the regulator has already looked at part of this and reached a narrower conclusion.

TPG Telecom's figures — 22 October

TPG Telecom, which owns Vodafone, told ABC News that it analysed millions of scam calls on its network between July 2025 and July 2026 and found 98 per cent of them, more than 24 million calls, came via Symbio, a little-known internet phone company owned by its rival Aussie Broadband. TPG said one scam campaign produced over 2,400 calls in a single week in September. Vodafone's fraud team found that police stations in Western Australia, Queensland and South Australia, and the Australian Federal Police, had been impersonated in calls from Symbio's network.

Vanessa Hicks, a TPG Telecom executive, said the company wants "more urgent action to stop this activity closer to the source", and that TPG hands Aussie Broadband evidence and data on each scam campaign so it can investigate and block the bad actors. She said TPG cannot simply turn off another telco on its network, and that the challenge is that "we often have milliseconds to determine when a call comes in, if it's legitimate or if it is a scam." Asked whether the public criticism was really about commercial rivalry, she said "we are bringing this out because we're trying to protect Australians and we're trying to protect our customers." She said she was disappointed Symbio had faced no financial penalties.

These are TPG's own figures, from TPG's own analysis of its own network, published through a news organisation rather than through a regulator. They have not been independently audited and they describe one network's traffic rather than the country's.

What Aussie Broadband says

Brian Maher, the chief executive of Aussie Broadband, did not dispute that the traffic exists. His explanation is structural, and it is the most important thing in the whole story for anybody trying to understand why this is hard.

Symbio sells Australian phone numbers in bulk. It has around 500 customers who on-sell those numbers, and each of those may on-sell to thousands of users of their own. Symbio, Maher said, has no oversight of who its customers sell numbers to, which makes stopping scammers very difficult. "Where we find a persistent bad actor, then we will disconnect them." He said the company uses detection software and a team of more than 20 people and plans to invest further, that it had made "significant progress" over the past month and was working with TPG, and that as the largest wholesaler in the market it would naturally carry a higher proportion of scam calls. He said the company needs more information shared with it to solve the problem, and that it accepts TPG is frustrated.

Read that again without the corporate argument attached to it, because it is a description of the pipe your phone is plugged into. One company sells numbers in bulk to five hundred companies, who sell them on to thousands more, and nobody in that chain can see the end of it.

What the regulator says

The Australian Communications and Media Authority made checks on the police-impersonation campaign and reached a narrower conclusion than the headline. It said the "traffic was identified, notifications were passed upstream and blocking occurred", that the apparent sources were multiple overseas telcos, and that it "did not identify non-compliance by an Australian telco." It had warned Symbio in 2024 over not properly investigating scam calls and not sharing information quickly with other telcos, and said it would be "closely monitoring Symbio's compliance". The ABC reports that Symbio had also been warned in 2022 over failing to investigate and trace scam calls.

Separately, a cybercrime investigator, Dan Halpin, examined 8,000 numbers reported to his scam phone number platform and found Symbio was the carrier most often linked to suspect numbers, ahead of Telstra, which has a far larger customer base. That is a sample of what people chose to report, not a census of Australian call traffic. Optus said no single carrier consistently accounts for most scam calls. Optus and Telstra both declined to say whether Aussie Broadband-linked traffic was a major source for them.

So the honest summary is that the volume is not really in dispute, the responsibility is, and the regulator has so far found no Australian telco in breach over the specific campaign it checked, the one that impersonated police.

You did not choose the carrier that delivered the call

Last week this site made an argument about medical records: that the list of organisations holding your health history is not the list of organisations you have dealt with, because every clinic runs on bought software and consent stopped at the front desk.

This is the same shape of problem, running in the opposite direction. That one was about your data sitting somewhere you never picked. This one is about something arriving at you through somewhere you never picked.

You chose your phone company. That is the whole extent of your choice. You did not choose the wholesale carrier it buys interconnection from, or the five hundred resellers buying numbers from that wholesaler, or the thousands of end users buying from them, or the overseas telcos the regulator says the police-impersonation traffic appeared to originate with. Not one of those decisions was yours, none of them was disclosed to you, and the output of all of them is a phone ringing in your kitchen with a police station's number on it.

This is not an argument that the telcos are villains. It is an argument about where you sit. You are the last link in a chain you cannot see, cannot audit and did not consent to, and the only decision available to you happens in the four seconds after you answer.

So it is worth knowing exactly what help you have been given, and exactly where you have been given none.

Your phone will label an unverified text. It will not label a call at all.

This is the most useful thing in this article, and almost nobody knows it happened.

Since 1 July 2026, under rules made by the Australian Communications and Media Authority, an Australian business or organisation that sends text messages with its name at the top instead of a phone number has needed to register that name in order to keep it showing. Registered names, the ACMA gives AusPost, Linkt and myGov as examples, keep appearing in your messages under the name itself. Unregistered ones do not. They get labelled Unverified, and they get grouped into one thread together with other unverified messages, including possible scams. Note what that label is actually telling you: that the sender name was not registered, not that the message is a scam.

These changes will give Australians an extra layer of protection to help prevent impersonation scams.

Samantha Yorke, ACMA Authority member, media release 17/2026

So on text messages, something outside your own judgement now does part of the work. A message claiming to be from a large organisation, sitting in a thread marked Unverified, is telling you something real about itself before you have read a word of it. The ACMA's own instruction for those messages is to treat them with extra caution and "not click on any links or provide personal information", and if you are unsure, to find contact details yourself, online or on a bill, and use only those.

Now hold that next to a phone call.

There is no consumer-visible check on which number a caller may present to you. There is no label. There is no thread. Rules do govern this at the industry end: the Reducing Scam Calls code requires originating providers to send calls only with numbers that accord with the Numbering Plan, and telcos block scam calls in enormous volumes, as the figures further down show. What does not exist is any of that reaching your screen. A voice call presenting a police station's number arrives looking exactly like a voice call from a police station, and your handset offers no opinion whatsoever. The labelling that now exists for the cheaper, lower-loss channel does not exist for the expensive one.

That gap is not permanent, and the thing that may close it is already law. The Scams Prevention Framework covers banking, telecommunications and digital platforms. The ACCC says entities must be members of the Australian Financial Complaints Authority dispute resolution scheme from 1 September 2026, that most obligations start on 31 March 2027, and that AFCA will handle eligible scam complaints not resolved by a business from that date. The detailed codes are still being written by government. Until they bite, the labelling gap is the thing to carry around in your head.

What to do if a call claims to be the police, your bank or the government

Four moves. The first one is the only one that matters and it is the one people get wrong, because it sounds like the opposite of being careful.

1. End the call. You do not owe a stranger a hearing.

Scamwatch's guidance on people impersonating the Australian Federal Police, first published in September 2021 and still carried on its site, is blunt about it:

If you are contacted by someone you suspect is a scammer, end the call immediately.

Scamwatch, Scammers pretend to be the Australian Federal Police to target vulnerable people

Not argue, not test them, not keep them talking to see what they know. Every extra minute is a minute spent inside a conversation the other person has had a thousand times and you have had once.

And know the shape of the lie in advance, because it barely varies. Scamwatch records scammers claiming to be federal agents who have spotted suspicious activity on your bank account, then asking for personal details including your Medicare number, your address and your bank details, and telling you to deposit money into an "AFP account". Some send fake arrest warrants by email or social media first and then ring to demand payment by bank transfer, cryptocurrency or online vouchers. Some ask to meet in a public place and be handed cash.

The AFP will never ask for fines to be paid in cash, cryptocurrency or gift cards, will never ask you to transfer money to a bank account, and will never threaten you with arrest or demand money by phone, email or social media. If any of that is happening, the question of whether the call is genuine has already been answered.

2. Do not call that number back. This is the part that trips people.

The instinct, once you have hung up and your heart is going, is to ring the number back and find out. It is a careful-feeling instinct and it walks you straight back into the same room.

Do not call them back on the number they called you on.

Scamwatch, Scammers pretend to be the Australian Federal Police to target vulnerable people

The number that reached you proves nothing about where it goes. In the police case Scamwatch describes, the calls showed a genuine-looking AFP number and police suspected the calls came from overseas. Scamwatch's instruction is to look up the number of the AFP switchboard in your capital city yourself, and to ring that.

The same trap runs the other way too. The ACMA has cancelled 31 smartnumbers linked to scams, numbers that resembled those of mostly airlines and cruise operators, set up so that people searching for a company's customer service would believe they were calling that company directly. A number you found is only safer than a number that found you if you found it somewhere the company controls: the back of your card, a bill, the official app, or a website you typed in yourself rather than one that came up in a search result.

This is the same rule as the piece about an email that passed every authentication check, for the same reason. You cannot verify a message from inside the message. A phone call is just a message that is talking.

3. Treat an Unverified text as what it says it is

On the text side, you have been handed something real and free since July. Use it. A message from a bank, a government agency, a delivery company or a toll road that turns up in an Unverified thread is a message whose sender did not register the name it is using.

That is not proof of a scam, and some legitimate small businesses have not registered. But it is a reason to do nothing from inside the message. The ACMA's advice is to treat it with extra caution, not to click links or hand over personal information, and to go and find the organisation's real contact details yourself.

And the other half of the same lesson: a text appearing in the correct named thread, under a registered sender ID, is not a guarantee either. It means the name is registered. It does not mean the content is true.

4. Protect the number itself

One step beyond the calls you receive, there is the phone number you own, and it is worth a few minutes because it is the key to almost everything else you have.

The ACMA and Scamwatch issued a joint alert in April 2026 about mobile fraud, which warns that criminals are "committing fraud by taking control of mobile phone numbers or making unauthorised changes to phone accounts." Once somebody controls your number, they receive your verification codes and can reset your passwords, which reaches your bank, your myGov and your email. The alert notes that people who know or suspect they have been in a data breach may be at greater risk.

The warning signs are specific and easy to miss. Verification codes you did not request. Account alerts you were not expecting. And the one worth memorising: your phone suddenly losing signal, or showing SOS only, for no reason you can explain. The alert's instruction in that case is the opposite of the obvious one. Contact your bank first. Then your phone provider.

This is not theoretical, and the regulator is enforcing it. Australian providers have to confirm a customer's identity before moving that customer's number in from another provider, under an industry standard made in 2020. The ACMA said in May 2026 that businesses had paid almost $5 million in penalties over mobile number fraud in the preceding 18 months. One provider, SpinTel, paid $59,400 after scammers exploited a weakness in its systems to obtain one-time verification codes and transfer ten customers' numbers without authorisation between February and March 2025, with reported losses of over $45,000. Separately, in its quarterly report to March 2026, the ACMA recorded Lycamobile paying $376,200 after failing to carry out required identity checks on 131 occasions.

Once a scammer gets access to your mobile phone service, you're in danger.

Samantha Yorke, ACMA Authority member

Ring your own telco and ask what extra verification it can put on your account, and ask what it requires before releasing your number to anybody else. The answers vary by provider, which is exactly why it is worth asking yours rather than reading a general article about it.

Why a phone call costs more than a text

It is tempting to treat all of this as one undifferentiated flood of nuisance. The loss figures say otherwise, and they say something quite specific about which channel deserves your caution.

Scams reported to Scamwatch in calendar 2025, by how the scammer made contact. Source: ACCC National Anti-Scam Centre Targeting Scams report, published 30 March 2026

Look at the two phone channels against each other, like for like. Text message scams produced 1,603 reports involving a loss and $18.0 million gone. Phone call scams produced 2,012 reports involving a loss and $72.5 million gone. Roughly comparable numbers of people, four times the money.

Per case, that is about $36,000 lost on a phone-call scam against about $11,000 on a text, and the median phone-call loss was $3,800. Three times as costly, person for person. That is what a human voice buys: the ability to answer your objection, to adjust, to create pressure in real time, and to keep you on the line while you do the thing. A text has to get it all right first time in a hundred and sixty characters.

And the direction of travel is not symmetrical either. Text message reports to Scamwatch fell 62.4 per cent in 2025, from 77,365 to 29,058, the largest decrease of any contact method, although the losses from the texts that did land still rose, from $14.0 million to $18.0 million. Phone call losses fell too, from $107.2 million to $72.5 million. Both are improvements. The channel with the register, the label and the thread is the one that fell furthest.

How often this happens in Australia

The blocking effort is real and very large, which is worth saying before anybody concludes that nothing is being done.

Australian scam and call-blocking figures, with the source and publication date for each

Three billion blocked calls is an enormous number and it is also the reason the remaining ones are worth taking seriously. What gets through a filter that size is what was built to get through it.

Take a second, still

This is the last week of Cyber Security Action Month, and the national theme has held up all month.

Take a second. Stay secure.

Department of Home Affairs, Cyber Security Action Month stakeholder toolkit

Earlier this month we argued that the pause is not a nice habit sitting beside your real defences, it is the defence, because speed is the mechanism every scam depends on. That was the piece on why every scam needs you in a hurry.

Four weeks of stories have steadily narrowed what the second is actually for. It is not for inspecting the message, because the message can be perfect. It is not for working out which companies to trust, because the breach may be three suppliers removed from anyone you have dealt with. And it is not for studying the number on your screen, because that number is not evidence of anything.

It is for one thing. Not acting on what arrived. Hanging up, putting the phone down, and going to find the organisation yourself, by a route that existed before this call did.

Which is a small habit with an unglamorous justification: it does not require you to detect anything at all.

If you think you have been caught

Quickly, and in this order.

1. Contact your bank straight away if money has moved, and tell them it was a scam. Ask them to try to recall the payment and to stop any card involved. Minutes genuinely matter here.
2. If your phone has lost signal or shows SOS only, contact your bank first and then your phone provider, which is the order the ACMA and Scamwatch specify, because the account is the target and the number is only the key.
3. Ring IDCARE on 1800 595 160, or +61 7 3555 5900 from outside Australia. It is free, it is a registered Australian and New Zealand charity and the national identity and cyber support service, and it will work out what to do next with you rather than sell you something.
4. Change the password on your email first, then on anything that shared it, and turn on multi-factor authentication while you are in there. Prefer an authenticator app over text codes, for the reason in move four above.
5. Report it to Scamwatch at scamwatch.gov.au. It is quick, and the figures in this article exist because other people did it.

And the thing worth saying every time: being caught by one of these is not a character flaw. One of the people in Thursday's reporting was a man in Perth who took a call from someone claiming to be the AFP, saying they had seized an individual and their laptop and that his personal information was on it, and instructing him to present at Narrogin Police Station, around 200 kilometres away. He declined. The caller hung up on him. He did not detect anything; he simply refused to co-operate, which turns out to work just as well.

Nor is the alternative being sharper than the scam. A single extra letter in an email address, sent after a settlement agent's account was compromised, nearly took $1.2 million off a first-home buyer in Western Australia. Westpac, which published the case in August 2026, says what stopped it was a personal banker who noticed the email's tone was slightly different, then found the staff member it claimed to be from was on leave, then spotted the extra letter.

Nobody detects their way out of this. They just decline to act on things that arrived.

If you want to know which of your details are already circulating before you decide what to harden, that is what the identity health check in SelfCybr Protection is for.

Sources

• ABC News, Vodafone's owner accuses rival Aussie Broadband of being behind millions of scam calls to customers, 22 October 2026, for the TPG figures, both companies' statements, the ACMA's response and the Perth case
• Scamwatch, Scammers pretend to be the Australian Federal Police to target vulnerable people, published 15 September 2021 and still current, for ending the call and not calling back
• ACMA, Some text messages to look different from 1 July, media release 17/2026, for the SMS Sender ID Register and the Unverified label
• ACMA and Scamwatch, Scam alert: Watch out for mobile fraud, April 2026, for the SOS only warning sign and the bank-first instruction
• ACMA, Compliance net tightens on mobile number fraud, May 2026, for the pre-porting identity standard, the penalties and the SpinTel case
• ACMA, ACMA cancels phone numbers used in scams, for the 31 cancelled smartnumbers
• ACMA, Action on scams, spam and telemarketing: January to March 2026, for the blocking figures and the Lycamobile penalty
• ACCC National Anti-Scam Centre, Targeting Scams report, published 30 March 2026, for the losses by contact method
• ACCC, Continued action critical to combat fraud as annual scam losses exceed $2 billion, 30 March 2026
• ACCC, Scams Prevention Framework, for the sectors covered and the commencement dates
• Office of the Australian Information Commissioner, Data breach notifications increase to all-time high in 2025, 6 July 2026
• Minister for Defence, Annual Cyber Threat Report highlights persistent threat to individuals and across the Australian economy, 14 October 2025, for the Australian Signals Directorate figures
• Department of Home Affairs, Cyber Security Action Month 2026 stakeholder toolkit
• Westpac, Westpac banker's instinct saves customer from $1 million scam, 6 August 2026
• IDCARE, the national identity and cyber support service, a registered Australian and New Zealand charity