scams and security

Keep track of your account

One of the best ways to detect any unusual activity is to monitor your HESTA online account regularly. With an online account, you can:

• track your account balance
• review your transaction history
• keep your contact details up to date, and much more.

Don't have an online account yet? Register here so you can regularly check in with your super.

We’ll send you an SMS confirmation of any changes to your personal details made on your online account.

If you receive a message about a change you didn't make, contact us immediately.

Set up a passkey 

A passkey is a more secure way to sign in to your online accounts. 

Once you’ve set up your passkey, you won’t have to enter your username and password every time you want to access your account. 

Instead, you can sign in using the security features on your phone, like facial recognition, fingerprint, or screen lock (i.e. PIN or swipe pattern).

Passkeys can’t be guessed or stolen by scammers, and they allow you to access your account in one step. 

Set up your passkey.

Create a secure password

If you'd prefer to log in with a password instead of a passkey, you should set up a password or passphrase on your HESTA online account that is:

• difficult for others to guess but easy for you to remember, and is made up of a variety of letters, numbers and symbols
• unique to your HESTA online account (don’t re-use passwords from other websites or apps)
• known only to you and not shared with family or friends.

Use multi-factor authentication

HESTA online accounts protected by passwords also require multi-factor authentication (MFA) as an extra layer of security for extra peace of mind.

MFA is an additional way to protect your valuable information and accounts against unauthorised access by using more than one way — such as a password — to verify your identity.

As part of this security measure, we’ll send you a verification code every time you log in to your online account, or the first time you log in to the HESTA App.

Don’t have an online account yet? Register now so you can regularly check in with your super.

Phishing scams

Scammers use deceptive emails, text messages, phone calls, or fake websites to trick you into revealing personal information, like passwords, bank account numbers, or credit card details. Look out for suspicious sender addresses, generic greetings, and a sense of urgency.

Self-managed super fund (SMFS) scams

Scammers will often claim to be financial advisers or from an organisation like HESTA, and will encourage you to transfer your super into a new SMSF. They promise high investment returns or low fees. Sometimes, the scammer may set up the SMSF to seem legitimate, before transferring your money to an account controlled by them.

Investment scams

Scammers offer fake or non-existent investment opportunities (e.g. shares, crypto) promising high or guaranteed returns to trick you into transferring money. They often use polished websites, fake credentials, and names similar to real, licensed Australian financial firms to appear legitimate.

Romance scams

Scammers build a fake romantic or close relationship (often via dating apps or social media) to gain trust over time, then ask for money, gifts, or bank details. They may ask you to invest in a business opportunity, or request financial support for a health crisis or travel emergency.

Rebate and refund scams

Scammers may impersonate a government agency claiming you’re owed a refund, rebate, or unexpected payment. They falsely promise to transfer this money, asking for banking details or even an upfront fee.

Tax time or Australian Tax Office (ATO) scams

Scammers impersonate the ATO or other government bodies, claiming you owe money or are entitled to a refund. They use urgency or threats to pressure you into handing over payment or personal details.

Bank scams

Scammers can pose as your bank’s fraud or customer service team to convince you that your account has been compromised by suspicious transactions. They advise you to transfer your money to a new “safe” account to protect yourself from future unauthorised transactions.