Two major councils in Queensland have lost over $5 million to scams involving artificial intelligence in the past year. The Gold Coast City Council reported a loss of $2.78 million due to a scam in November 2023. An internal review followed, and the Queensland Audit Office (QAO) provided security recommendations. However, nearly a year later, Noosa Council fell victim to a similar scam, losing $2.3 million. Approximately $400,000 was recovered, leaving ratepayers with a loss of $1.9 million. Noosa Mayor Frank Wilkie disclosed the incident last month, stating it occurred in December 2024. He mentioned that police advised the council not to discuss the investigation and that he was unaware of the Gold Coast Council's incident or its findings.

The Gold Coast City Council was targeted through a supplier-related fraud scheme. A scammer successfully altered the contact and bank account details of a legitimate supplier, a waste management contractor, by using written requests and phone calls to the accounts payable team. The QAO identified several internal failures, including a lack of documentation for changes made to supplier details, inadequate processes for updating bank account information, and non-compliance with the council's policies.

The Gold Coast City Council stated that it shared all findings with the QAO and the state government by April 2024. The council asserted that its procedures met industry standards and that it adopted all recommendations from the consultant. Councillors were briefed on the situation by March 2024. Reports indicate that the Noosa Council scam involved deepfake technology to impersonate council officials.

In response to the fraud, the QAO noted that the Gold Coast City Council improved its documentation processes and created a checklist to prevent future incidents. A QAO spokesperson confirmed that recommendations to enhance internal controls were communicated to all local councils and the state government in March 2024. The former local government minister was informed of the Gold Coast City Council scam in November 2023, and the state government confirmed that the council complied with regulatory reporting requirements. Current local government minister Anne Leahy encouraged councils to share information about scams within the sector.

Noosa Council announced the loss of $2.3 million on its website and Facebook page on October 13, 2025. In subsequent interviews, Cr. Wilkie stated he was unaware of the Gold Coast Council scam until October 2025. Noosa Council has not commented on whether it implemented the QAO's recommendations before the December 2024 scam. A spokesperson indicated that a follow-up report on the cyber fraud incident would be issued by December 2025.

Noosa Council Chief Executive Larry Sengstock reported that several measures recommended by the QAO have been implemented since the December 2024 attack. These measures include enhanced internal controls, a review of operating procedures, and the introduction of a third-party software system for added security against fraud.

The Noosa Council fraud is expected to be included in the Queensland Auditor-General's 2025 Local Government Report, which will be presented to the state parliament early next year. Andy Asquith, a local government scholar, emphasized the need for transparency from Noosa Council, stating that the council failed to act on the recommendations following the Gold Coast City Council scam. He noted, "That's public money that now won't be used to provide essential services. There needs to be an obligation for transparency."

Cybersecurity expert Dennis Desmond explained that these AI-driven scams are challenging to defend against. He noted that employees can be easily convinced to change bank or contact details due to spoofed emails or phone conversations. Desmond highlighted the importance of training for council staff, stating, "This is about using the human factor, which is exploiting trust, exploiting knowledge, exploiting an individual victim. They have to be able to project confidence."

The chances of recovering the stolen funds depend on international relations and the specific circumstances surrounding the fraud. Desmond remarked, "The technology is available that would facilitate tracking these types of fraud, but the majority of funds are not recovered."