The Australian customers of London-listed CMC Markets (LON: CMCX), which offers stock broker and contracts for differences (CFD) trading platform in the country, is the target of a new phishing campaign, according to MailGuard AU.

Join IG, CMC, and Robinhood at London’s leading trading industry event!

The operation targets the company’s high-net-worth customers. Emails are blocked in some cases by MailGuard.

Login Theft Attempt Hits CMC Investors

The campaign impersonates CMC Markets and TD Direct Investing. Its goal is to steal user login credentials. Recipients are sent messages that appear legitimate, often referencing tax matters or account migration. Clicking links in the emails directs users to fake login pages.

• FCA Proposes UK Equity Tape to Provide “Clearer View” of Trading Across Venues
• Retail Investors Get Private Company Investment Access via Trade Republic
• CFI Appoints Three Board Members Following 54% Third Quarter Trading Increase

Phishing Email Cites W-8BEN PMC

The phishing emails carry the subject line: “Federal Tax Residency Verification Notice — Required Renewal of W-8BEN PMC Certification.” They use branding consistent with CMC Invest and reference real financial processes, including U.S. IRS tax compliance. A detailed legal disclaimer is included to give the emails credibility.

FinanceMagnates.com contacted CMC Markets, but no comment was provided at the time of publication.

ASIC Targets Fake Investment Websites

This phishing campaign reflects a wider pattern of online scams targeting Australian investors, according to the country’s financial regulator. Australia’s securities regulator has warned of fake versions of the Moneysmart website designed to gather personal information and promote false investment schemes.

These sites copy the real layout but use different addresses and pressure users with promises of quick returns. ASIC stressed that Moneysmart never asks for personal data or payments for investments, noting a broader rise in impersonation activity and continued efforts to remove scam and phishing sites.

ASIC is taking down around 130 fraudulent investment websites each week and has removed more than 10,000 to date, including fake platforms, phishing links, and crypto scams. The regulator has increased investigations and enforcement actions, though losses remain significant, with Australians reporting AU$2.74 billion in fraud.

More than 330 fake investment websites have been removed this year alone, many misusing images of well-known Australian figures. ASIC says AI-driven tools are enabling more convincing scams. With investment scam losses reaching $945 million in 2024, the regulator is expanding enforcement and updating rules to address emerging risks.