A "Hi Mum" scam is a text or WhatsApp message claiming to come from your son or daughter on a new number after losing their phone, followed by an urgent request to pay a bill. The lost-phone pretext is the engineering: it explains the unknown number, the missing profile photo and the unfamiliar tone before you notice any of them. One call to the number you already have ends it.
Hi Mum, this is my new number — my old phone got smashed. Can you save this one?
That is the whole scam, and almost all of the engineering is in the second clause.
A broken phone explains everything a suspicious person would otherwise notice: why the number is unfamiliar, why there is no profile photograph, why the writing does not sound quite like your daughter, why they cannot take a call. Every anomaly is pre-answered before it registers as an anomaly.
Then, a few messages later, there is a bill. A locked account. A payment due today. Could you cover it, just this once, and they will pay you back on Friday.
Australia’s competition regulator issued a formal alert about it in August 2022. It is the message-based sibling of the grandparent scam, and in Canada it has been steadily taking that scam’s place.
Short, casual, and addressed to a role rather than a name — Mum, Dad. If it lands with someone who has no children, nothing is lost; the list is cheap.
The lost or damaged phone is the load-bearing element. It accounts for the strange number, the absent photo and the changed tone, and it does so before you have consciously noticed any of them.
This is a small act with a large effect. From here the messages arrive under your child’s name, in your own address book, wearing an identity you gave them.
Where it could have stopped
The message makes exactly one factual claim: that the old number no longer works. Calling the number already stored in your phone tests that claim directly, takes ten seconds, and cannot offend anybody. Both the ACCC and the Canadian Anti-Fraud Centre give this same advice, and it is the only step on this page that ends the scheme outright.
A brief exchange about nothing much — are you well, did you eat — before any request. The request that follows is a bill that must be paid today from an account they cannot access because the banking app was on the broken phone.
Bank details arrive, usually framed as belonging to somebody else: a friend, a landlord, a colleague. That framing pre-empts the obvious question of why your child’s name is not on the account.
In a meeting. The microphone is broken. Bad signal. Voice is the single thing this scheme avoids, because it is the single thing that fails immediately.
While the channel works, requests repeat. The reported totals in both Australian and Canadian data are usually accumulations, not one payment.
The pretext is pre-emptive. Most scams have to survive scrutiny. This one removes the grounds for it in the opening line, which is a different and much stronger design.
It arrives in a trusted place. Not a cold call from a withheld number — a message in the same app where your family actually talks, and after you save the contact, under your child’s own name.
The role is more reliable than the identity. The sender does not need to know your child’s name, their job or where they live. “Mum” is enough, and it is enough for millions of recipients at once.
The amount is deliberately small. A few hundred for a bill, not thousands for bail. It sits below the threshold where anybody stops to verify, and it is recoverable in a way that makes helping feel low-risk.
Voice is engineered out. The excuses look flimsy written down and do not feel flimsy in the moment, because a busy adult child who cannot talk right now is completely ordinary. And AI voice cloning is beginning to remove even that safeguard — see voice cloning.
Refusing has a social cost. Every other scam asks you to trust a stranger. This one asks you to distrust your child, and most people would rather be out a few hundred dollars than be the parent who demanded proof.
There is no single origin here, and pretending otherwise would be inventing one. What the data supports is a technique that appeared in the messaging channel around 2021 and spread through the English-speaking countries where WhatsApp is common in family use.
Australia’s regulator saw a two-month spike in mid-2022 that produced 1,150 loss reports; the same technique then settled into 9,307 reports across the first nine months of 2023. Canada’s figures show the migration rather than the arrival: text message went from 1.2% of emergency scam reports in 2021 to 17.7% in 2025, while the telephone version’s share fell.
Two things about the operators are supported by the data rather than by inference. Requests repeat while the channel works, which indicates people managing conversations rather than an automated blast. And the money is directed to third-party accounts described as belonging to friends or landlords — the mule account pattern documented across every scheme on this site.
Between 2021 and 2025 the share of Canadian emergency scam reports arriving by text message rose from 1.2% to 17.7%, while the telephone's share fell from a peak of 71% to 56%. Losses through the text channel went from C$7,300 in 2021 to C$371,504 in 2024. The scheme did not change; its delivery did, and the change carries a different victim and a different defence.
The Canadian Anti-Fraud Centre files grandparent scams under "Emergency (Jail, Accident, Hospital, Help)", and its open dataset shows a category that rose fast and then fell just as fast. Reported losses went from C$2.5 million in 2021 to C$11.6 million in 2023, then dropped to C$3.3 million in 2024 and C$1.5 million in the first nine months of 2025. It is one of the clearest examples in any national dataset of a scam category being pushed back.
The ACCC issued a formal alert on 23 August 2022 after more than 1,150 Australians lost A$2.6 million to family impersonation messages in seven months, most of them in June and July. It is the first national regulator to name and count the WhatsApp form of the emergency scam separately from the telephone one. Reports reached 9,307 in the first nine months of 2023.
Right now, before anything else. Call your child on the number already in your phone. Not the new one. If they answer, you have your answer. If it genuinely is out of service, call a sibling, a partner or a housemate. Do not use any number supplied in the message, including one offered as a callback.
A family word helps. Agree a word or a question with your household that would never appear in a message thread — not a birthday or a pet’s name, both of which are online. Use it whenever money is requested by message. It costs one conversation and it works permanently.
If you have paid.
Payments go to a UK, Australian or Canadian bank account in somebody else’s name — the account holder is usually a money mule, sometimes recruited through a fake job and sometimes a scam victim themselves.
The framing that the account belongs to a friend or a landlord does two jobs at once. It explains the mismatched name to the parent, and it means the account can serve many victims without any of them seeing a link between them.
From there the pattern is the ordinary one: a rapid onward transfer within hours, often into cryptocurrency, before the first fraud report reaches the receiving bank. The window in which a same-day report can still stop the money is measured in hours, which is why the first call matters more than the fifth.
The other half of this story
Our sibling site Clean on Paper explains whose account the money lands in — how mule networks are recruited, and why the account holder is often the only person the bank can find.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
Call the number you already have stored. That is the entire test, and it does not involve challenging anyone. If your child answers, the message was fake. If the number really is dead, you will find out from them within a day. No genuine emergency is made worse by a ten-second call.
Both are usually public. Names, family relationships and phone numbers appear in social media profiles, breached datasets and electoral or business records. Knowing them is not verification — it is the cost of entry.
Because voice is the point of failure. The excuses — a broken microphone, a meeting, bad signal — are the script's most consistent feature. AI voice cloning has begun to change this, which is why the stored-number callback matters more than hearing a familiar voice.
The same idea in a different channel. The grandparent version is a phone call and takes larger amounts from fewer people; the "Hi Mum" version is a message, reaches far more people and takes less each time. Canadian data shows the text channel growing from 1.2% to 17.7% of emergency scam reports between 2021 and 2025.
No. The pattern in both Australian and Canadian data is repeat requests while the channel works, and most totals are cumulative rather than a single payment. Stop responding, and tell your bank the account has been used for fraud.
It matters more than people expect. Once saved, the messages arrive under your child's name in your own address book, and every subsequent message carries that borrowed identity. Delete the contact as soon as you doubt it.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.