Home / Legal / Scam alert: ASIC puts investors on notice about upsurge in share theft

In the past few months, shareholders have been receiving more attention from fraudsters who have been impersonating individuals via identity theft to steal their shares. Tragically, self-funded retirees are often vulnerable with many still reliant on snail mail.

ASIC is putting self-funded retirees with substantial equity holdings on red alert – there has beena significant increase in reports of stolen shares since August 2024 from people who have had their personal identity compromised.

While the regulator’s alert is for all investors, all the research regarding scams highlights that it’s older Australians who are particularly vulnerable to this nefarious activity that brings financial loss and emotional trauma to those affected.

In this important warning from ASIC, it states how fraudsters are impersonating individuals and stealing their shares, with many victims unaware their shares have been transferred or sold until they receive a confirmation letter in the mail from a share registry or the Clearing House Electronic Subregister System (CHESS).

Australians previously affected by data breaches should be particularly alert to the increased likelihood of identity theft, given the availability of their personal information online.

Fraudulent activity using stolen identities is increasingly sophisticated, so it’s important to be vigilant and follow through with checks when you receive notifications that are unexpected or do not look correct.

How does share sale fraud work? A fraudster claiming to be Jane Citizen creates a share trading account to sell shares owned by the real Jane Citizen. The ID used to open the account is stolen or fake, with the security reference number or holder identification number for Jane Citizen’s shares illegally obtained.

A bank account may also be fraudulently opened with the name Jane Citizen to receive proceeds from the share sale.

 “It is important people know fraudsters can gather personal information not only from information available online, but also by stealing mail from letterboxes,” an ASIC spokesperson says.

“We strongly encourage all investors to be on the lookout for suspicious activity when it comes to their share registry, share trading and bank accounts, and to take steps as soon as something doesn’t look right.”

This advice is particularly pertinent to many retirees who still receive much of their correspondence via snail mail.

ASIC has detailed steps individuals need to take to protect their personal identity. Review your share portfolios regularly, regardless of whether they are issuer-sponsored holdings registered with share registries or held in share trading accounts with stockbrokers. This will allow quicker detection of unauthorised activity.

It is also prudent to regularly review your other investment accounts such as superannuation and managed funds, and always ensure your stockbroker, share registries and financial services providers have up-to-date contact details.

The regulator also suggests using passphrases rather than simple passwords for online accounts, as well as turning on multi-factor authentication, if it’s available, to add an extra layer of security to prove your identity. At a more mundane level, make sure your letterbox is locked and check it frequently.

If you receive a new bank card or correspondence that is unexpected, like an update on how your shares are held, the creation of a new account, a notification of sale of your shares or confirmation of a change in contact details, don’t ignore the correspondence.

If something is unexpected or feels wrong, act quickly. Call your stockbroker, the share registry or bank if there is activity you didn’t authorise and change your passwords. It’s important to always contact the party that sent you correspondence using the contact details from the organisation’s official website (not the email or letter that may be fraudulent).

If you do get scammed, or are targeted by a scammer, report any incidents to Scamwatch. You should also contact IDCARE, a free government-funded service, which can help to develop a specific response plan if your identity has been compromised. You can also request that credit reporting bodies place a ban on your consumer credit report so it can’t be used as part of a credit check.