TL;DR - Investment platforms that look completely real - working website, Australian phone number, professional dashboard - can still be scams. The registration they claim to have might not exist. The AFSL number in their footer might belong to someone else. The quickest way to tell the difference takes about ten minutes and costs nothing. What you need to do:
A friend forwarded me a link from a group chat last month. "These guys are doing 12%," the message said, and the website loaded fast with a clean dashboard, an Australian phone number at the bottom, and an AFSL number in the footer.
I have seen enough of these to know that a phone number and a license number prove almost nothing. What proved something was the ten minutes I spent checking whether the license was real.
It is the kind of link that arrives when you are half-paying-attention. A mate forwards it from a group chat, or an ad promises "ASIC-regulated returns" in a font that looks exactly right. The pitch is calm and confident, the dashboard is slick, and the language is careful enough to feel official. That is the trap. A polished website is the easiest part of the scam to build.
This is the routine I run before any money leaves my account. It is not a full financial due-diligence process. It is the ten-minute version, the one that catches the obvious fakes and forces the genuine platforms to prove themselves.
Why a polished website and an Australian phone number are not enough
The investment platform might be legitimate. The ad you clicked to find it might not be. That is the split most people miss.
A clean website, a working phone number, a professional logo, and a license number in the footer can all be copied. Phone numbers get set up in an afternoon. License numbers get borrowed from another company and pasted into a fake site without anyone checking. The whole point of the scam is to look expensive. Looking expensive is cheap.
The other thing that gets missed: a license number on a website proves that someone has that number. It does not prove the company running the website is the someone. The number can be real, accurate, and completely misleading at the same time.
Per pickr.com.au reporting, finance scams are on the rise in Australia.
The article is a general trend piece, not a specific case study, but the pattern it describes is the one this routine is built to interrupt: a convincing pitch, a borrowed or invented license number, and a transfer that feels routine right up until the withdrawal does not work.
Check 1: Is the platform registered with ASIC?
Every Australian financial services business that takes retail money is supposed to hold an Australian Financial Services Licence, or AFSL, issued by ASIC. If the platform you are looking at is offering investments to Australians, it should be on ASIC's professional registers. If it is not, the rest of the checks become academic.
Open ASIC's professional registers search in a fresh tab. Type the platform's full business name, not the marketing name on the dashboard.
Scammers often use a trading name that sounds like a real company while the legal entity behind it is different. The register will show you the legal name, the AFSL number, the licence status, and any conditions or undertakings attached to that licence.
A few things to look at on the result page:
- The licence status should say "Current". Anything else ("Ceased", "Cancelled", "Surrendered", "In liquidation") is a hard stop.
- The name on the register should match the company actually running the platform. Similar is not the same. "Bright Path Capital Pty Ltd" and "Brightpath Capital Australia Pty Ltd" are different entities. Treat the difference as a problem until proven otherwise.
- If there are conditions, read them. A licence can be current and still restricted in ways that matter - for example, limited to wholesale clients only, or excluded from offering a particular product.
If the platform does not appear at all, that is the answer. Walk away. Genuine platforms that take retail money in Australia appear on this register. The check is free, takes about two minutes, and does not require you to give the platform any information.
Check 2: Does the AFSL number on the site belong to this platform?
This is the second check, and it is the one that catches the borrowed-license trick.
The number in the footer of the platform's website should match the number on ASIC's register, and the company name attached to that number on the register should be the company running the site. If they match, move on. If they do not, the platform is using someone else's licence, which is exactly what a scammer does when they want to look legitimate without doing the work.
You already have the register open from Check 1. The number is on the result page. Compare it character by character with the number on the platform's footer. A single digit wrong, or a letter where a number should be, is a problem. License numbers are not approximations.
The second part of this check is the one most guides skip: verifying that the company itself is contactable through a channel the salesperson did not give you.
Look up ASIC's published details for the licence holder and use those, not the phone number at the bottom of the website. If the number on the website is the only one you can find, that itself is a signal. Real licensees have public contact details that you can reach without going through the platform that wants your money.
ASIC publishes a free, searchable AFSL register at the connectonline search page, and you do not need to log in to use it. The whole check is free, takes about five minutes, and does not involve entering your own details anywhere.
Check 3: Can you actually withdraw money?
The third check is the one that exposes the platform that looks real but is not. Try to move a small amount of money out before you put a large amount in.
If the platform is genuine, a small withdrawal test should work the way it works at any bank or broker: you request it, the platform processes it, the money lands in your account within a few business days. If something else happens, that is your signal.
Scams that look like investment platforms often let you "trade" inside the platform with no problem. The moment you ask to withdraw, the platform changes character. The customer service queue grows. New fees appear. The withdrawal sits in "pending" and never completes.
The standard advice, and the right one, is to treat a blocked withdrawal as the alarm, not a customer-service delay. There is no normal reason a regulated Australian investment platform cannot process a small test withdrawal within a few business days. If yours cannot, the rest of the platform's claims become irrelevant.
You do not need to put large sums in to run this check. A small test deposit, followed quickly by a withdrawal request, tells you almost everything you need to know about how the platform will behave when the stakes are higher. The whole test takes about three minutes to set up and a few days to complete.
A note on account security vs platform security: Setting up two-factor authentication on your investment account protects your account. It does not tell you whether the platform is registered. These are two different problems, and they solve different risks.
Account security is about keeping a stranger out of an account you control. Platform security is about confirming the platform itself is real. A perfectly secured login on a fake platform still ends with a blocked withdrawal and a polite customer service team that does not exist.
My PayPal 2FA verification guide covers the account-security side for one specific platform. The ASIC checks above cover the platform-security side for any investment pitch that arrives in your inbox. You need both.
What to do if the check flags something
If any of the three checks fails - the platform is not on the ASIC register, the AFSL number does not match, or a withdrawal sits unresolved past the stated processing time - the right move is to stop, not negotiate.
Pull out what you can. If you have already transferred money and a withdrawal is being delayed or blocked, contact your bank immediately and ask whether the transfer can be recalled. Banks can sometimes recover transfers that have not yet settled, especially in the first 24 hours. After that window closes, the recovery options narrow sharply.
Report the platform to ACSC's ReportCyber. The Australian Cyber Security Centre collects these reports and uses them to map patterns across multiple reports of the same platform. One report rarely changes anything by itself. Ten reports of the same platform, especially with matching withdrawal-failure patterns, do.
For identity and financial support, IDCARE is the free Australian service that helps people put together a response after a scam.
They are not regulators and they cannot recover the money, but they can help you think through the next steps in order and avoid the common follow-on mistakes, like responding to a "recovery agent" message that is actually the same scammer running a second pass.
The general safety hygiene is covered in my broader online safety guide. The single most useful thing you can do with the routine above is to teach one other person how to run it. Most people who fall for these platforms have not been careless. They have simply never seen the check.
Your next 10 minutes: These are short jobs, not a weekend project. Run them in order.
- Open ASIC's professional registers search. Take 2 minutes. Type the platform's full legal business name. Confirm the licence is current and the company on the register is the company running the platform. Use the official ASIC register search directly, not a search engine result.
- Compare the AFSL number on the website to the one on the register. Take 5 minutes. The numbers and the company names must match exactly. If they do not, or if you cannot find the platform on the register at all, that is the answer - do not transfer.
- Verify the company's contact details through a channel you found yourself. Take 2 minutes. Look up the contact details on the register, not on the platform's website, and confirm they answer. If the only number you can find is the one the salesperson gave you, treat that as a warning, not a convenience.
- Test a small withdrawal before depositing more. Take 3 minutes to set up, then wait the stated processing window. A regulated platform will release the money within a few business days. Anything else is the alarm.
Before you transfer a cent, open the ASIC register in a second tab and type the name. It takes sixty seconds. If the license checks out and you decide to proceed, great. But make the decision after the check, not before.
By the numbers:
| Step | What it costs | What it confirms |
|---|---|---|
| ASIC register search | Free, 2 minutes | The platform's legal entity exists and holds a current AFSL |
| AFSL number match | Free, 5 minutes | The license number on the site actually belongs to this platform |
| Independent contact verification | Free, 2 minutes | The company is reachable through a channel the salesperson did not give you |
| Small withdrawal test | Free, 3 minutes to set up | The platform actually releases your money when asked |
| 10 minutes total | 4 independent checks | 1 ASIC lookup | 0 dollars spent |
The license number is the wrong proof. It only proves someone has that number. It does not prove they are the someone.
Further reading: If you want the Australian-specific background on why scam platforms look so convincing in the first place, my post on why scammers already know your information covers how the polished pitch gets assembled from data brokers, old breaches, and your public profile.
For the moment the check fails and the withdrawal sits in "pending", the natural follow-on is the pig-butchering playbook: the wrong number text that opens a very long con.
For the broader scam-prevention routine, my general online safety guide covers the rest. Australian government scam advice lives at Scamwatch, ASIC's investor guidance at Moneysmart, and the latest scam alerts at ACSC's scam alerts page.
Mathew Clark / Founder, SecureInSeconds / Currently: opening a long-overdue term deposit because ten minutes of ASIC-checking is easier than another round of "is this one real?"
