OFX Data Breach: Why Payment Data Fuels Redirection Scams

The short answer: OFX disclosed in early October 2026 that an unauthorised party accessed client data, though it says client accounts and funds were not accessed. The risk to watch is follow-up fraud. Data about transfers and recipients can make a fake change of bank details look genuine, so verify the account itself rather than trusting the detail in a message.

Key takeaways

• Unauthorised access occurred on 28 September and OFX began containing it the next day.
• OFX has not said exactly what transfer and recipient data covers.
• A correct name, amount or date proves only that someone has the data.
• For the fundamentals, see our guide to payment redirection fraud.

In early October 2026, ASX-listed foreign exchange and payments company OFX disclosed that an unauthorised party had accessed client data. It has since told affected customers more about what was taken. (Cyber Daily, SMB Tech)

OFX has been clear about what has not happened. It says it has not identified unauthorised access to client accounts or funds, its systems have continued to operate normally, and none of the data accessed can be used to make a payment in the OFX platform. That is reassuring for the money held in the platform.

It is not the whole picture for the people whose data was taken.

What has OFX said?

According to the reporting, unauthorised access occurred on 28 September, and OFX identified the incident and began containing it the next day. The attacker did not reach the underlying client platform database, and it does not appear that any copies of identity documents were accessed. No group has publicly claimed responsibility. OFX has notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and other global authorities, and says its investigation is continuing as a matter of urgency.

The data that was accessed includes customer names and login handles, contact details, dates of birth, occupation information, answers to security questions, IP addresses and device information, and social media profile URLs. It also includes details of some transfers and recipients made through OFX, and details of some customer communications with OFX. Data on non-clients, such as job applicants, was accessed too. OFX has not said how many clients are affected.

Why do transfer and recipient details matter?

The part to watch is the data about transfers and recipients. OFX has not said exactly what that covers.

A payment redirection scam works when the message is believable. If the data shows who a customer pays, a criminal could write a message that matches a real relationship, referencing a genuine counterparty in the right tone. We are not saying that has happened. We are saying that this is the kind of detail that makes an approach harder to spot.

The same goes for the personal details. Dates of birth, security answers and contact details are the raw material for impersonation of the platform itself, and of its customers. OFX has warned affected customers to be alert to scams and impersonation attempts using the exposed data, to avoid links and attachments in unexpected messages, and to set up passkeys and two-step authentication.

Why do we keep seeing this pattern?

We have covered this chain before. The Quest breach and a telco insider case both put identity and account details into criminal hands. Breaches often supply material rather than money. That material can make a later payment request look right.

If your business pays or receives money through any platform that has had an incident, plan for convincing follow-up messages in the weeks and months ahead.

Before your next payment run, try our free BSB validator. It takes a few minutes and shows where your process is exposed.

Related reading: Quest Data Breach: How Stolen IDs Turn Into Payment Fraud, Telco Insider Charged Over Data Sales: The Fraud Link.

What should you do?

• Treat any request to change bank details as unverified until you have checked it, however accurate the surrounding detail looks.
• Do not rely on the detail inside a message as proof it is genuine. A correct recipient name, amount or date proves only that someone has the data.
• Verify the account itself. Check that the business is real and registered, that the person asking is who they say they are, and that the BSB and account number belong to that business. See how to verify a supplier’s bank account.
• If you are an OFX client, follow OFX’s guidance, enable passkeys and two-step authentication, and be cautious with unexpected messages that mention your transfers.

A convincing message is only as trustworthy as the account it points to. Checking ownership tests the account itself, not the story around it.

Frequently Asked Questions

Was money stolen in the OFX breach?

OFX says it has not identified unauthorised access to client accounts or funds.

Why does breached payment data matter?

Details about who a customer pays, and when, can make a later payment redirection message look accurate and trustworthy.

What should OFX clients do?

Follow OFX’s guidance, enable passkeys and two-step authentication, and treat unexpected messages about your transfers with caution.