Public sector

Scams that borrow your authority.

Fake refund texts, lookalike service sites, fake login portals and fake agency pages all use your name. We find them and get them taken down before the public hands over money or ID.

Book a demo Request a takedown

Impersonation watchExample feed

TimeThreatWhereStatus

08:31Fake tax refund sitesolstice-refund-claim.comWebsiteRemoved
09:02Fake toll notice text“Unpaid toll, pay today”SMSReported
09:44Fake account loginsolsticeid-verify.topWebsiteRemoved
10:15Fake agency page“Solstice Services Support”FacebookRemoved
10:52Fake fines payment pagesolstice-fines-pay.comWebsiteRemoved
11:27Staff logins for salePrivate channelTelegramChecking

96%taken down

Of the threats we pursued across all clients, January to June 2026.

The public's journey

Where scammers meet the public.

Scammers wait at every step of the public's journey. Here's where they show up and what we take down.

Text messageSolstice Services: You are owed a refund of $482.10. Confirm your details within 24 hours to receive it: solstice-refund-claim.com

The message

Fake refunds, fines and tolls.

Texts and emails use your agency’s name to promise a refund or demand a payment. They create urgency so people click before they check.

98.6%of reported ATO impersonation scams in August 2026 arrived by email.

Smishing →Phishing →

Sponsored · SearchRenew Your Licence Online | Official Servicesolstice-licence-renewal.comFast, easy renewals. Service fee applies.

Lookalike service sites.

Copies of your website and paid ads catch people searching for a service. Some charge a fee for something that’s free, others take ID details.

Lookalike domains and copied pages
Paid ads using your agency’s name
Fees for free services

Brand abuse →Scams →

WebsiteSolsticeID: Sign inEnter your username, password and the code we just sent you to continue. solsticeid-verify.top

Fake login portals.

Copied sign-in pages collect usernames, passwords and one-time codes, then use them to take over real accounts and change payment details.

Copied government login pages
Requests for one-time codes
Account takeovers and redirected payments

Phishing →Dark web →

Outstanding fine: $186.00solstice-fines-pay.comPay now to avoid a licence suspension. Card payments only.

Pay

Fake payment pages.

Fake fines, tolls and fees pages take card details. The amount is small enough that people pay without thinking twice.

Fake fines and toll notices
Fake fee and renewal payments
Card details taken and reused

Phishing →Scams →

Sam@SolsticeServices my payment still hasn’t come through??

Solstice Services Help@SolsticeSvcHelpSorry Sam! Send us your login details and date of birth and we’ll fix it now.

Get help

Fake support accounts and numbers.

Fake help accounts reply to people asking questions online, and fake phone numbers sit in search results and documents. Both ask for logins and ID.

Fake help accounts on social media
Fake phone numbers in search results
Requests for ID and logins

Social media →Vishing →

Private channelGov staff VPN + email accessFresh logins, several agencies. DM for price. Posted 2 days ago

Behind the scenes

Leaked logins and records.

Staff logins, citizen records and internal documents turn up on breach forums and in private channels, where they’re sold and used for the next attack.

Staff logins for sale
Citizen records in breach forums
Leaked internal documents

Dark and deep web →Executive impersonation →

How it works

Up and running in three steps.

solsticeservices.gov.au@SolsticeServicesSolstice Services appSolsticeIDLetter of authority ✓

Step 1

Tell us what’s yours

Share your brand names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf.

Web and domains
Social media
App stores
Messaging

Step 2

We watch around the clock

We monitor the web, social media, app stores, search ads and messaging channels for fakes. Tell us about payment runs, deadlines and new programs and we’ll watch more closely.

solstice-refund-claim.comFake refund site

Successfully suspendedEvidence and outcome in your portal

Step 3

We take them down

Every find is checked, then reported to the platform, host or registrar with evidence. You see each case and its outcome in the Unphish portal.

Our data

What we see and take down.

Our results across all clients between January and June 2026.

96%

of the threats we pursued across all clients were taken down

99%

of the phishing sites we pursued were taken down

99%

of impersonation accounts we pursued on Facebook, X and Instagram were removed

98%

of the scam websites we pursued went offline

What we took down

Phishing and malwareFake logins, payment pages43%
Social media impersonationFake pages and help accounts36%
Brand and content misuseCopied logos and content11%
OtherFraud, apps, leaked data9%

The same tactics hit every sector: copied websites, fake accounts and fake payment pages. Government names are used because people trust them and act quickly.

Where the fake accounts were

Facebook38%
X33%
Telegram16%
Instagram6%
Other7%

Share of the platform cases we pursued across all clients. Other includes app stores, LinkedIn and WhatsApp.

The bigger picture

3,265

reports of ATO impersonation scams in August 2026 alone

36%

rise in those reports on the month before

65,361

phishing reports in 2025, the most reported scam type in Australia

Sources: Australian Taxation Office scam data (August 2026, updated 25 September 2026); ACCC, Targeting Scams report on 2025 (March 2026).

Unphish figures: threats we pursued across all clients, January to June 2026. Figures are rounded.

Real or fake

What gives a fake government message away.

Fakes copy the logo and the tone. These are the details that give them away.

OfficialFake

Example based on common patterns. Solstice Services is a fictional agency.

Your Unphish portal

Every fake, and where it’s up to.

Fake sites, accounts and apps land in one threat feed. Approve a takedown in a click, then follow each case until it’s gone.

Threat FeedSolstice Services · last 30 days

Example data

Pipeline health

With you
In enforcement
Verifying
Resolved

P1
solstice-refund-claim.comFake refund site · Web
Awaiting review
P1
solsticeid-verify.topFake login portal · Web
In enforcement
P2
facebook.com/SolsticeServicesSupportFake agency page · Facebook
Suspended
P3
solstice-licence-renewal.comLookalike service site · Web
Verifying

Confidence

Illustration with example data. Solstice Services is a fictional agency.

How it works for an agency

What a takedown looks like for a scam text.

Example scenario

A fake refund campaign

Sector: Government services
Seen in: Texts, lookalike sites and a fake Facebook page
Covered: Domains, hosting, social media and phone numbers

An illustrative example based on common patterns, not a single client case.

01 · Before

The campaign

Texts promising a refund send people to lookalike sites that collect bank details and logins. A fake Facebook page backs it up, and new sites appear as fast as old ones are reported.

02 · After

What we do

We find the sites, page and numbers, link them as one campaign, and report each to the registrar, host, platform or telco with evidence. Your team sees every case and outcome in the portal.

FindSites, pages and numbers in the campaign

LinkShared hosting and patterns, one campaign

RemoveReported with evidence until they’re gone

Our results across all clients, threat by threat

Scam websites98%

of the scam websites we pursued went offline.

Lookalike service sites
Fake fee and renewal pages

Scams → Phishing sites99%

of the phishing sites we pursued were taken down.

Fake login portals
Fake refund and fine pages

Phishing → Impersonation accounts99%

of the impersonation accounts we pursued on Facebook, X and Instagram were removed.

Fake agency pages
Fake help accounts

Social media → Fake apps92%

of the fake apps and app download sites we pursued were taken down.

Copied service apps
Fake download pages

Mobile applications → Executive impersonation100%

of the executive impersonations we pursued were taken down.

Fake minister and official profiles
Fake recruiters and job ads

Executive impersonation → Compromised websites100%

of the compromised website cases we pursued were disrupted.

Scam pages hidden on hacked sites
Removed with the owner and host

Compromised websites →

Results across all Unphish clients, January to June 2026. Figures are rounded.

Who it’s for

Built for the teams who keep public services safe.

Every team sees different fakes. We find and remove them all.

Cyber security

Phishing sites and leaked staff logins aimed at your systems.

We remove

Phishing sites
Staff logins for sale
Leaked documents

Fraud and integrity

Fake payment and refund pages that take money from the public.

We remove

Fake refund sites
Fake fines pages
Payment redirection

Contact centres

Fake help accounts and numbers that reach people first.

We remove

Fake help accounts
Fake phone numbers
Fake text campaigns

Communications

Your name, logo and leaders used to mislead the public.

We remove

Fake agency pages
Fake official profiles
Scam ads

Digital services

Copies of your sites and services, with evidence for every action.

We remove

Lookalike domains
Copied service pages
Fake apps

Threats

Every threat public sector organizations face, explained.

PhishingFake logins, refunds and payment pages Smishing and vishingFake toll, fine and refund texts and calls Brand abuseLookalike service sites and domains ScamsFees for free services and fake grants Social mediaFake agency pages and help accounts VIP and executive impersonationFake officials and fake recruiters Dark and deep webStaff logins and records for sale Mobile applicationsCopied service and payment apps PiracyLeaked documents and exposed code

See all threats →

For the public

Help people spot a fake government message.

Two short notes you can adapt for your website, social pages or letters. One shows people how you really contact them. The other tells them what to do if they’ve been caught.

The copied version leaves blanks for your agency name and official details.

Solstice ServicesScam warning

How to spot a fake Solstice Services message

We won’t send you a link to log in or claim a refund by text or email.
We never ask for a fee to release a refund or payment.
Our only website is solsticeservices.gov.au.
We won’t threaten you with arrest or suspension over the phone.
If in doubt, log in yourself or call the number on our website.

Seen a fake? Report it at solsticeservices.gov.au/scams

Example

Solstice ServicesHelp and support

Think you’ve been scammed?

Call your bank straight away if you paid or shared card details.
Change your password and turn on extra sign-in security.
Contact us on our official number so we can protect your account.
Contact IDCARE if you shared ID documents.
Report it to Scamwatch to help warn others.

We’ll never ask you to pay to fix a scam.

Example

FAQ

Public sector questions, answered.

Why do scammers impersonate government agencies?

People trust government names and act quickly when told they're owed money or owe a fine. That makes refunds, fines, tolls and account warnings easy hooks. Government impersonators cost Americans $920m in reported losses in 2025, according to the FTC.

What are the most common government impersonation scams?

Fake refund and payment texts and emails, unpaid toll and fine notices, fake login pages for government accounts, lookalike sites charging fees for free services, and fake agency pages and help accounts on social media.

Can you take down sites that charge fees for free government services?

Where a site impersonates your agency, copies your content or misleads people into thinking it's official, we report it to the registrar, host and any ad platform with evidence. We'll tell you if a site falls outside what platforms will act on.

Can you remove fake agency pages and help accounts?

Yes. We report fake pages, help accounts and official profiles to the platforms they're on, including Facebook, X and Instagram. Across all clients, 99% of the impersonation accounts we pursued on those three platforms were removed.

How long does a takedown take?

It depends on the platform, host or registrar involved and how they respond. We follow every case through until it's resolved, and you can see where each one is up to in the Unphish portal.

What about the scam texts themselves?

We take down the websites the texts link to, which stops them working, and report the numbers and sender names behind them to the telcos and messaging platforms involved.

What do you need from us to get started?

Your agency and program names, official domains, social accounts and app listings, plus a letter of authority so we can act on your behalf. Then we start monitoring.

Other industries

See how scams hit other sectors.

Every industry gets targeted in its own way. Explore the threats we find and take down in each.

Airline and Transport

Fake booking sites, points scams and support accounts.

Banking and Financial Services

Fake bank sites, support lines and investment scams.

Crypto

Fake bonus sites, wallet drainers and support accounts.

Retail and E-Commerce

Fake stores, sale ads and delivery texts.

Lottery and Gambling

Fake betting sites, bonuses and VIP managers.

Fintech

Copied apps and fake payment requests.

Non-Profit Organisations

Fake appeals and donation pages.

Film and Entertainment

Fake tickets, streams and giveaways.

Solutions for the public sector

SolutionPhishing ProtectionFake logins and refund sites → SolutionDomain ProtectionLookalike service domains → SolutionSocial Media ProtectionFake agency pages and help accounts → SolutionThreat MonitoringLeaked logins and records →

See all solutions →

Try it

Real or fake?

Five messages someone might get from “Solstice Services”. The agency only uses solsticeservices.gov.au, its app and its verified accounts. Which would you trust?

The quickest check: government agencies don’t text you links to log in, pay or claim money. If in doubt, log in yourself or call the official number.

Report a fake →

See what's using your agency's name.

Book a demo and we'll show you the fake sites, accounts and messages using your name right now.

Book a demo Request a takedown