ASIC warns brokers about account takeovers that turn Australian shares into overseas purchases

Australia's securities regulator has urged brokers and market intermediaries to strengthen controls against account-takeover fraud after seeing compromised accounts used to sell Australian-listed shares and then rapidly purchase shares listed overseas. The warning appears in ASIC's October Market Integrity Update, Issue 179. The exact publication day is not specified on the accessible newsletter, so this is an October regulatory warning reviewed on 31 October, not a claim that a new enforcement order was issued today.[1]

The scenario is more complicated than a criminal changing withdrawal bank details. An attacker who gains access to a brokerage account may trade out of domestic positions, then use the proceeds to buy overseas securities. A risk system watching only large cash withdrawals may miss the value transfer because the transactions still appear as trades inside the customer's brokerage account. ASIC says some share-sale fraud examples might have been avoided if intermediaries had maintained stronger controls.[1]

The regulator describes a combination of warning signals: suspected phishing or social engineering, unusual logins, recent changes in contact information, rapid selling of Australian holdings, overseas stock purchases and activity inconsistent with historical behaviour. These indicators should be assessed together. A single overseas equity order may be legitimate, while the same order following an unexplained phone-number change and unfamiliar login presents a different risk profile.[1]

Signals identified by ASIC

ASIC had previously updated guidance on protecting against share-sale fraud in June 2025 following reports by intermediaries of a sevenfold increase in reported cases. That historic comparison concerns reports made by intermediaries at the time; it is not a new sevenfold increase during October 2026. The current bulletin gives a specific account-compromise pattern and repeats the importance of proactive monitoring and client verification.[1]

The operational challenge for brokers is connecting customer-authentication signals with orders, custody records and payment flows quickly enough to stop unauthorised trading. A case review needs reliable timestamps for account changes, session events, order instructions, execution, settlement and follow-up communications. Stopping a suspicious trade also creates obligations to avoid incorrectly blocking a genuine customer, so escalation, review authority and incident records matter alongside automated alerts.[1]

ASIC's account-takeover pattern is built from combined signals: an unusual login, recent contact-detail changes, rapid selling of Australian securities and subsequent purchases of overseas shares. An individual overseas order is not inherently suspicious. The regulator expects firms to combine risk factors and act in time to interrupt an unauthorised transaction, while providing clear recovery and dispute arrangements to affected clients. Detection and escalation therefore cut across authentication, trading surveillance and the account's funding history rather than depending on a single fraud rule.[1]

ASIC says it may consider regulatory action where clients suffer harm and intermediaries have failed to take reasonable steps under the law. It has not announced a universal monetary penalty or a finding that every firm reporting fraud breached its duties. The confirmed direction is a supervisory warning to improve controls across the whole transaction sequence. The test for operators is whether connected indicators trigger a timely intervention rather than simply generating multiple separate alerts.[1]

Report an error or submit an update