Phony AU

"Hi Mum / Hi Dad" SMS scams: the family-impersonation playbook

5 min read

"Hi Mum, this is my new number. My phone's broken and I can't access my banking. Can you transfer some money to a friend so I can pay them back later?" The Hi Mum scam (also called the family-impersonation scam) cost Australians more than $7 million in its first year and is still going strong. The good news: it's defeated by a single two-question test.

How the scam works

The setup is short and depressingly effective:

  1. The opener. An SMS arrives from a mobile number you don't recognise: "Hi Mum, this is my new number. Please save it. My phone died / I lost my phone / I dropped my phone in water and got a temporary one." The wording varies. The intent is to get you to engage at all.
  2. The pivot to WhatsApp or another chat app. "Can we chat on WhatsApp instead? It's easier on this phone." This moves the conversation off SMS (where the carrier might filter or where you might check the number on Phony) and into an encrypted app the scammer controls.
  3. The setup story. "I'm at work and I can't access my online banking. There's a problem with my password / two-factor / new phone authenticator. I really need to pay a friend / a tradie / my landlord today."
  4. The ask. "Can you transfer $X to this account number / BSB? I'll pay you back tomorrow when I'm home." Amounts typically range from $500 to $4,000: large enough to matter, small enough to be plausibly urgent.
  5. The escalation. If you hesitate, the "child" gets emotional ("Mum, I really need this, please") or invents new urgency ("the tradie is here, I need to pay him now").

Why it works

Three tricks of social engineering combine here:

Crucially, scammers don't need to know anything about the family. They send millions of "Hi Mum" SMS messages and play the responses. If you're not a parent, the message is meaningless and you ignore it; if you are, it lands.

The two-question test that defeats it

If you get a message from "your child" with a different number, ask either of these:

  1. "What's the name of [pet / sibling / specific shared memory]?" Pick something a stranger could not know and isn't on social media. Real children answer instantly.
  2. "Call me on [your own number] in two minutes." A real child can call from some phone: a friend's, a workmate's, a payphone. A scammer cannot.

If the response is "I can't call right now, the phone keeps cutting out" or "I can't remember, why are you asking weird questions", it's a scam. End the conversation.

Other red flags

What to do if you've already sent money

  1. Call your bank's after-hours fraud line immediately. If the transfer hasn't reached the destination account yet, many banks can recall it. The window is short: typically 30 minutes to an hour.
  2. Report to ReportCyber. They coordinate with banks and police.
  3. Report to Scamwatch.
  4. Contact IDCARE on 1800 595 160 if you shared identity details too.
  5. Look up the scammer's number on Phony and add a report. The number gets reused for weeks.

Talk to your parents

The single highest-leverage thing you can do about Hi Mum scams is have a thirty-second conversation with your parents (or anyone you know who's in their 60s+):

"If you ever get a text from someone claiming to be me with a new number, asking for money, call my real number first. If I can't pick up, ask a control question only the real me would know. I won't be offended."

That's it. Most victims are people who never had this conversation and didn't have a script ready when the message arrived.