Australia Orders Super Funds to Harden Cyber Defences as AI Scams Target Retirees

If you hold superannuation in Australia, your fund just picked up a new job description: spend more on cybersecurity, and do it quickly. The country’s prudential regulator has told banks, insurers and super trustees to lift their resilience against AI-enabled cyber threats, warning that AI adoption inside financial firms is racing ahead of the systems meant to keep it safe. The push puts the spotlight on retirees, who have become prime targets for fraud that is growing more automated and more convincing.

What APRA is actually demanding

APRA laid out its position in its 2026-27 Corporate Plan, published on 20 August 2026. Supervision priorities through 2029-30 include strengthening resilience to AI-enabled cyber threats, stepping up focus on quantum computing risks, and scrutinising the industry’s concentrated reliance on common technology platforms. APRA chair John Lonsdale said the plan responds to a volatile risk environment in which geopolitical tensions and emerging technology are reshaping threats.

That was followed by a pointed letter to regulated entities. APRA said a targeted review conducted in late 2025 found AI in widespread use across banks, insurers and super trustees, but with widely varying maturity in oversight. Boards are pursuing AI-driven productivity gains but often lack the technical expertise to challenge management, and many firms rely too heavily on third-party vendors.

APRA board member Therese McCarthy Hockey put it bluntly: “The AI revolution presents tremendous opportunities for banks, insurers and superannuation trustees to deliver improved efficiency and enhanced customer services. We are already beginning to see these benefits materialise, but we cannot be blind to the risks of such powerful technology, whether in our own hands or the hands of those with malign intent.” She added that “while AI adoption is continuing apace, the systems and processes required to safely govern its use aren’t keeping up.”

The expectations are concrete. Entities must actively manage information security vulnerabilities: timely patching, hardened configurations, strong privileged access management, automated vulnerability discovery, penetration testing, and controls over agentic and autonomous workflows. Security testing has to cover AI-generated code and software components. Funds need an inventory of their AI tooling, human involvement in high-risk decisions, and staff training on AI misuse and secure practice.

Why retirees are in the crosshairs

According to reports, APRA issued a formal directive on 22 October 2026 requiring the pension system to boost investment in cybersecurity specifically to counter AI-driven crime targeting older Australians. Super funds are now expected to upgrade their security protocols against threats that are increasingly automated.

The logic is straightforward. Australia’s population is aging, and superannuation accounts hold the life savings of millions of people who are disproportionately vulnerable to digital crime. AI has made scams cheaper to run and harder to spot: personalised phishing at scale, cloned voices on phone calls, and fake portals identical to the real thing.

This is not abstract. Australian public services have been caught up in AI-driven security scares, including an incident in which an AI agent reportedly probed government websites. If AI can stumble into government systems, trustees cannot assume their own perimeters will hold.

CPS 234: the rulebook funds already had

This is not new territory. APRA’s Prudential Standard CPS 234 already governs information security management, setting requirements for how regulated entities identify, protect and monitor information assets. The latest directive extends that framework into the AI era, compelling higher spending and tighter supervision where threats are evolving fastest.

For super trustees, the checklist is getting longer. Patching has to operate at the speed of AI-accelerated threats, which APRA called out as too slow in many firms. Third-party concentration risk needs real attention: if dozens of funds rely on the same handful of platforms, one compromised vendor becomes a systemic problem. And AI inside the fund, from chatbots to back-office automation, needs named owners, documented controls and board-level understanding.

What this means for your super account

For members, the most immediate change should be better protection around the accounts themselves. Expect funds to tighten login security, improve fraud detection on transactions, and communicate more quickly when something looks wrong. APRA’s scrutiny gives trustees a strong incentive to treat a compromised member login as a serious incident rather than a customer-service hiccup.

Then there is the question of who pays. Cybersecurity is a real operating cost. Whether it flows through to fees is something members should watch on their annual statements, but APRA’s view is clear: the cost of a breach, in money and trust, is far higher.

Members can help themselves too. Turn on multi-factor authentication for your super account and check your balance and transactions regularly. Treat unsolicited calls or messages about your super with suspicion, no matter how legitimate they sound. If someone claiming to be your fund asks for your password or one-time code, hang up and call the fund on its published number.

The bigger picture

Regulators worldwide are waking up to the gap between how fast AI is being deployed inside financial firms and how slowly governance is catching up. What makes the Australian move notable is the direct link to retirees: cybersecurity spending is being framed as protection for an aging population’s savings, not just an IT budget line.

Frontier models are already changing the scale and sophistication of cyber threats, and APRA has warned that advanced systems could demand a corresponding uplift in defences. Funds that treat this as a compliance exercise will keep struggling. Those that treat it as core to looking after members’ money will be the ones members trust when the next wave of AI-driven fraud arrives.

Frequently Asked Questions

Will my super fees go up because of this?

Possibly, but there is no confirmed figure. Watch your annual statement for fee changes. APRA’s position is that the cost of prevention is far lower than the cost of a breach, both financially and in lost member trust.

Has my super fund actually been hacked?

There is no public evidence of a specific breach tied to this directive. APRA’s action is preventive, driven by a review that found AI adoption outpacing governance across banks, insurers and super trustees. The regulator wants defences raised before an incident forces the issue.

What can I do right now to protect my super?

Enable multi-factor authentication, review your balance and transactions regularly, and treat unsolicited contact about your super with scepticism. Never share passwords or one-time codes with callers, even if they sound official. When in doubt, reach your fund through its published number or app.