Following a spike in reports of stolen shares due to identity theft and an industry review, ASIC has updated guidance for Australian financial services (AFS) licensees about how they can reduce share sale fraud risks to their clients and business.
Share sale fraud is the fraudulent activity of a person who is not who they claim to be, selling or transferring shares that do not belong to them.
It can have devastating financial and emotional impacts on the lives of people who fall victim.
The updated Information Sheet 237 Protecting against share sale fraud (INFO 237) includes observations on share sale fraud methods by bad actors and better practices for licensee prevention and detection.
The updates reflect findings from a recent ASIC-led industry review into AFS licensees' client onboarding and verification practices, in addition to their share sale fraud detection practices.
AFS licensees that deal in securities have a critical role in preventing and detecting share sale fraud, both individually and collectively.
ASIC Commissioner Simone Constant said, 'In the last four years, ASIC analysis has identified a seven-fold increase in the number of share sale fraud reports made by market intermediaries.
'There are terrible stories out there, where in some cases entire investment portfolios are lost, and millions of dollars are involved.
'There is a tremendous emotional and financial impact for investors who fall victim.
'We're calling on market intermediaries to step up and protect their customers by strengthening their share sale fraud prevention, detection and response practices.
'Share sale fraud can happen to anyone, at any time, with unsuspecting investors having their accounts hacked, and shares sold or transferred to others.
'Vigilance is key as share sale fraud is often difficult to detect.
'Investors should review their share portfolios regularly, be alert to suspicious transaction activity, turn on multi-factor authentication, and use passphrases, not passwords for your logins.'
AFS licensee better practices for fraud prevention and detection are outlined in the updated INFO 237, and include:
- being alert to possible use of stock images, fakes, forgeries, and independently verifying their authenticity when onboarding new clients
- monitoring trading behaviour and conducting additional due diligence where trading is unusual for a client, a client makes large withdrawal requests or newly opened accounts are observed, and
- conducting further due diligence when clients add or request changes to personal information such as postal/email addresses and bank accounts, including, where possible, checking that bank accounts are held in the client's name.
Background
For further guidance on anti-scam practices, we also encourage AFS licensees to consider:
- ASIC's Report 761 Scam prevention, detection and response by the four major banks (REP 761)
- ASIC's Report 790 Anti-scam practices of banks outside the four major banks (REP 790), and
- the use of digital ID services accredited under the Digital ID Act 2024 to safely and securely verify people's identity online. For more information, see https://www.digitalidsystem.gov.au/.
ASIC has done significant recent work to help protect consumers from fraud and scams:
- Between 2021 and 2023, ASIC reviewed the banks - and what measures they had to protect their customers from scams (REP 761) and (REP 790).
- In 2024 and early 2025, ASIC looked at the superannuation industry. In January 2025, ASIC Commissioner Simone Constant wrote to superannuation trustees urging them to strengthen their anti-scam practices (ASIC calls out superannuation trustees for weak scam and fraud practices).
- Now, ASIC is supporting continued action and a co-ordinated response from market intermediaries including stockbrokers, following ASIC's fraud surveillance work last year.
ASIC recommends for investors to:
- Review your share portfolios regularly, regardless of whether they are issuer-sponsored holdings registered with share registries or held in share trading accounts with stockbrokers, so you're quicker to detect unauthorised activity.
- Be on the lookout for suspicious activity when it comes to your share registry, share trading and bank accounts.
- Use passphrases rather than simple passwords for online accounts.
- Turn on multi-factor authentication - if it's available - as this can add an extra layer of security to protect your identity.
- Lock your letterbox to prevent mail theft and check it frequently.
If you believe you've been targeted in a share sale fraud, immediate action is crucial:
- Report the suspected suspicious activity to your market intermediary (i.e., online broker) and/or share registry.
- Report your incident to the Australian Federal Police using their Report Cyber portal, and specify you're a victim of share sale fraud in your report.
- Also report the incident to the Australian Government's Scamwatch website.
- Contact IDCARE, a free government-funded service, which can help you develop a specific response plan if your identity has been compromised.
Where to go for more information
- See ASIC's Moneysmart website for a range of tips to protect yourself from identity theft.
- You can also find further information on the Government's IDMatch website.
