Security and Scam Help

1. Act immediately if money or an account may be at risk

If funds have left your bank account, contact your bank immediately through the number in its official app, website or the back of your card. Ask whether it can stop, recall or trace the payment. Fast reporting can help, but neither Humi nor a bank can guarantee recovery.

If anyone is in immediate danger, call emergency services on 000. Australian users can also report cybercrime through the Australian Government’s ReportCyber service and report scams to Scamwatch.

2. Steps to secure your account

1. Use a trusted device. Close suspicious pages and disconnect any remote-access session.
2. Secure your email first. Change the password for the email account connected to Humi, review recovery details and sign out unknown sessions.
3. Change your Humi password. Use a new, unique password that you have not used on another site. Do not make the change through a link in an unexpected message.
4. Check activity. Review Humi transfers, recipients and messages, and your bank activity. Record anything you do not recognise.
5. Contact Humi. Give us your Humi account email and the relevant transfer reference, but not your password, code, PIN or complete bank details.
6. Preserve evidence. Keep screenshots, message headers, usernames, payment references, phone numbers and relevant dates. Do not continue engaging with the suspected scammer to collect more evidence.

3. Information Humi will not ask you to send

Humi support will never ask you to put any of the following in an email or support form:

• your Humi password;
• a one-time password or verification code;
• your transaction PIN;
• online-banking login details;
• a complete card number or security code; or
• an identity-document image unless Humi has directed you to an approved verification channel.

We will not ask you to install remote-access software, move money to a “safe account”, pay a fee to release frozen funds, or share a screen while you enter a password or code.

4. Verify that a Humi message is genuine

Email display names and caller information can be copied or spoofed. An email that appears to come from Humi is not proof that it is genuine.

• Open the Humi App directly or type humi.au into your browser instead of using an unexpected link.
• Check the full sender address and destination website carefully, including spelling.
• Do not approve a transfer because someone creates urgency, secrecy or fear.
• If uncertain, start a new request at the official Humi Support Centre. Do not reply to the questionable message.

5. Common warning signs

Be cautious when someone:

• promises guaranteed investment returns or asks you to send funds to access profits;
• claims to be a bank, police officer, government agency or Humi employee and demands an urgent transfer;
• asks you to receive, convert or forward money for another person;
• changes recipient bank details in an invoice or message;
• builds an online friendship or relationship and then asks for money;
• asks you to scan a QR code, install an app or share your screen to “fix” an account; or
• asks for a password, one-time code, transaction PIN or identity document through chat, email or a web form.

6. How Humi handles a security report

We prioritise reports of suspected scams, account compromise and unauthorised activity. Depending on the circumstances, Humi may restrict an account or transfer, verify your identity through an approved channel, review activity and system records, contact relevant service providers, or ask for additional information.

Security action can reduce further risk but does not guarantee that a payment can be stopped or recovered. Legal, security and privacy obligations may also limit the detail we can disclose during an investigation.

7. Everyday protection

• Use a unique password and a reputable password manager.
• Keep your phone, browser and Humi App up to date.
• Protect the email account and mobile service connected to Humi.
• Use a device lock and do not let another person enrol their access on your device.
• Review the recipient, AUD amount, fee, exchange rate and expected CNY amount before every confirmation.
• Do not use public or shared devices for sensitive transactions.

8. Security vulnerabilities and privacy incidents

If you believe you have found a security vulnerability affecting a Humi website or service, follow the contact instructions in our security.txt. Do not access, change, download or disclose another person’s data, disrupt the service, or conduct testing that could affect customers.

For a concern about the handling or exposure of personal information, select “Privacy or personal-data request” in the Support form or email compliance@humi.au.