Scammers are treating the AFL finals window like a clearance sale for anxiety, banking groups warned this week, as fake listings and bogus payment alerts target fans scrambling for seats. The Customer Owned Banking Association (COBA) said Australians have lost more than $13.8 million to buying-and-selling scams in 2026 so far, with counterfeit event tickets among the most common pitches.
COBA’s head of financial crimes and cyber resilience, Martin Latimer, urged supporters to verify sellers before transferring money, particularly when prices look sharply below market or when a stranger insists on off-platform payment. The alert coincides with preliminary finals traffic at large venues, where official inventory often sells through Ticketek or Ticketmaster depending on the ground. Melbourne Cricket Ground preliminary finals routinely sell out member allocations within minutes, pushing casual fans toward resale markets where scammers pose as desperate supporters.
How ticket fraud shows up
Fraud patterns this season mirror prior years but with sharper social-media distribution. Criminals clone club colours, reuse match-day photography, and advertise on marketplaces where buyer protection is thin. Some schemes deliver PDFs that scan at the gate; others never send a file after payment clears.
Separately, Scamwatch has flagged “fake purchase” SMS and email campaigns that claim you bought tickets or electronics you do not recognise, then push you to call a number to reverse the charge. Those callbacks route to operators who try to harvest banking credentials or install remote-access tools. Event tickets sit in the price band—often $300 to $2,000—that scammers use to trigger panic clicks.
What leagues and banks advise
The AFL publishes an authorised on-seller register for major fixtures, including club-specific codes for the 2026 grand final window. Officials consistently direct buyers to start at afl.com.au, open the match page, and follow the linked ticketing provider rather than trusting search ads.
The Australian Banking Association has similarly told members to route purchases through official platforms and to treat cryptocurrency or unusual wire requests as stop signs. Banks say they can sometimes recover faster payments if customers report within hours, but many ticket scams leave victims with no recourse once funds settle offshore.
NRL and shared patterns
COBA’s warning covers NRL finals as well, where Ticketek holds many fixtures and counterfeit grand-final packages circulate on messaging apps each September. The same fake-purchase callback scam that mentions plane tickets can cite rugby league hospitality bundles, luring recipients into voice phishing when they try to “cancel” a charge they never made.
Reporting and liability
COBA asks anyone who spots a suspicious seller to report through the National Anti-Scam Centre’s Scamwatch portal and through cyber.gov.au. Those reports feed takedown efforts, though consumer advocates note that reactive removal rarely returns money.
Unlike credit-card chargebacks on goods that never arrive, peer-to-peer bank transfers to unknown sellers are treated as authorised payments unless fraud teams can prove deception within tight timelines. That asymmetry is why regulators emphasise prevention: a $400 “bargain” grand-final seat is often a straight loss.
What fans can do tonight
Check the venue’s official ticketing partner, compare the seller’s identity to the AFL register where resale is permitted, and refuse requests to communicate only through encrypted chat apps. If a message claims you already bought tickets, contact your bank through its official app—not the phone number in the text.
Police cybercrime units have previously warned that screenshots of “confirmed transfers” can be forged as easily as tickets themselves. Victim support lines say the emotional sting is sharper when the scammer poses as another fan sharing a spare member ticket—trust built over direct messages evaporates when the barcode fails at the gate.
COBA’s figure—$13.8 million lost to buying and selling scams year-to-date—is a reminder that finals hype is a predictable attack surface, and that the safest ticket is the boring one bought through the path the league documents. Member clubs also post fraud alerts on official apps when they detect cloned social accounts—another signal to ignore DMs that bypass those channels.
