Phishing Scams in Australia: How to Spot the Bait Before You Get Hooked

An email from your bank says there has been suspicious activity on your account. An Australia Post text tells you a parcel can't be delivered until you pay a small fee. Your boss sends an urgent request asking you to pay an invoice. Or perhaps a family member suddenly messages from a new phone number and needs money.

They all have one thing in common: they could be phishing scams.

Phishing is one of the most common ways cybercriminals attempt to steal passwords, banking details, personal information and money. While the technology behind cybercrime continues to evolve, phishing remains remarkably effective because it attacks something technology can't completely protect — human trust.

And modern phishing can be much harder to recognise than the badly written scam emails of years gone by.

What is Phishing?

Phishing is a form of social engineering in which a criminal pretends to be a person or organisation you trust.

The attacker might impersonate your bank, Microsoft, Australia Post, myGov, the Australian Taxation Office, a telecommunications provider, a supplier, your employer or even someone you know personally.

The message usually tries to persuade you to do something:

• click a link;

• open an attachment;

• enter a username and password;

• provide personal or banking information;

• approve a login or multi-factor authentication request;

• transfer money; or

• install software.

The common ingredient is urgency.

Your account will supposedly be suspended. A payment is overdue. A parcel can't be delivered. Someone needs money immediately. Your password is about to expire.

That urgency is deliberate. The scammer wants you to react before you have time to question what you're being told.

Five Types of Phishing Scams Australians Should Recognise

1. Spear phishing

Ordinary phishing scam campaigns in Australia can be sent to thousands of people at once. Spear phishing is different because the attacker targets a particular person.

The criminal may research you through Facebook, your employer's website, social media or information exposed in previous data breaches.

An employee might receive an email that appears to be from a manager, referring to a real project, supplier, or colleague, and because some of the information is genuine, the fraudulent request becomes much more convincing.

For Australian businesses, this scenario is particularly dangerous when criminals target employees responsible for accounts, payroll, purchasing or administration.

Example: An accounts employee receives an apparently legitimate email from a supplier advising that their bank details have changed and asking that future invoices be paid into a new account.

Never change supplier banking details based solely on an email. Verify the change independently using a telephone number you already know to be genuine.

2. Whaling

Whaling is spear phishing aimed at senior or influential people — the "big fish".

Business owners, directors, executives, finance managers and senior employees can be attractive targets because they may have access to sensitive information or authority over significant payments.

But executives aren't necessarily the only target.

A criminal might impersonate the managing director and contact an accounts employee:

"I'm in a meeting and can't talk. I need this invoice paid immediately. Please process it now and confirm when it's done."

The sender's apparent authority, combined with urgency, is intended to discourage the employee from questioning the instruction.

Businesses can reduce this risk by having payment verification procedures that apply regardless of who appears to be making the request.

3. Clone phishing

Clone phishing can be especially convincing because the fraudulent message resembles legitimate correspondence.

A criminal may copy the appearance, wording or context of a genuine email and replace a legitimate link or attachment with a malicious one.

It might look like an updated invoice, revised document, Microsoft 365 file-sharing notification or continuation of an existing business conversation.

This is why recognising the sender's name or company logo isn't enough. If an unexpected email asks you to open a document, sign in or download something, consider verifying it with the sender through another communication channel.

4. Vishing — phishing by telephone

Phishing doesn't have to arrive in your inbox.

Vishing combines "voice" and "phishing" and uses telephone calls to manipulate victims.

A caller might claim to represent your bank, telecommunications company, the ATO, a government agency or a technical support service.

A common approach is to tell you that something terrible is already happening, such as:

"We've detected fraudulent transactions on your account."

"Your computer has been compromised."

"Someone is attempting to access your internet banking."

The scammer then presents themselves as the person who can save you from the supposed emergency.

They may ask for a password, one-time security code, remote access to your computer or tell you to move money to a "safe" account.

If someone unexpectedly calls claiming there is a problem with an account, hang up and contact the organisation yourself using its official telephone number.

Never rely on the number displayed on your phone as proof of who is calling. Caller ID can be spoofed.

5. Smishing — phishing by SMS

Smishing is phishing delivered through SMS or another messaging service.

Australians regularly encounter messages claiming to be from parcel delivery companies, toll-road operators, banks, government services and other familiar organisations.

Typical examples include:

"Your parcel delivery was unsuccessful. Update your details here."

"Your toll payment is overdue. Pay immediately to avoid additional charges."

"We've detected unusual activity on your bank account. Verify your identity."

Another particularly effective scam is the "Hi Mum/Hi Dad" scam, where someone claiming to be a family member says they've lost or damaged their phone and are contacting you from a new number. Soon afterwards, they need money.

Whenever a message involves an unexpected financial request, verify the person's identity independently before sending anything.

Why Phishing is Getting Harder to Recognise

One of the most dangerous assumptions is that scam messages are easy to identify because they'll contain poor spelling and obvious grammatical mistakes.

Some still do, but many don't.

Today's criminals can produce polished emails, convincing corporate branding and highly persuasive messages. Artificial intelligence also makes it easier to create natural-sounding communications and customise scams for particular victims.

A message can look professional and still be fraudulent.

Instead of asking only "Does this look legitimate?", ask:

"Was I expecting this, and can I independently verify it?"

That is a much stronger security test.

How to Recognise a Phishing Attempt

Watch for messages that create urgency, fear or unusual pressure.

Be particularly cautious when you're unexpectedly asked to provide credentials, make a payment, change banking details, open an attachment or approve a login.

Check the actual sender's email address — not simply the display name.

Be wary of subtle differences such as additional letters, substituted characters or domains that resemble a legitimate organisation.

And be careful with links.

On a computer, hovering your mouse over a link can often reveal where it actually leads. On mobile devices, links can be harder to inspect safely.

When in doubt, don't use the link at all.

Open your browser or the organisation's official app and access your account normally.

Don't Trust a Website Simply Because it has a Padlock

The padlock symbol and https indicate that communication between your browser and the website is encrypted.

They do not prove that the website belongs to the organisation it claims to represent.

Criminals can obtain encrypted HTTPS connections for fraudulent websites too.

The website address itself — and how you arrived there — remains important.

Seven Habits that Dramatically Reduce Your Risk

Good cybersecurity doesn't require you to become a computer expert. A few habits can prevent many common attacks.

1. Don't act on unexpected urgency.

Stop and verify before clicking, paying or providing information.

2. Use unique passwords.

Don't reuse the same password across multiple services. A password manager can make unique passwords much easier to manage.

3. Enable multi-factor authentication.

MFA adds another layer of protection if your password is stolen. Where available, stronger authentication methods such as authenticator apps or passkeys can provide additional protection.

4. Keep your devices updated.

Install security updates for Windows, macOS, Android, iOS, browsers and other applications.

5. Never approve an MFA request you didn't initiate.

An unexpected authentication notification may mean someone already has your password.

6. Verify financial changes independently.

Businesses should independently confirm requests to change supplier bank details or make unusual payments.

7. Don't give unexpected callers remote access to your computer.

A legitimate organisation should not unexpectedly call and pressure you into installing remote-access software.

What Should You do if You've Been Caught by Phishing?

Act quickly.

If you've entered a password into a suspicious website, change it immediately using the genuine service. If you've reused that password elsewhere, change those passwords as well.

If money or banking information is involved, contact your financial institution immediately.

If you installed software at someone's direction or gave a stranger remote access to your computer, disconnect the device from the internet and seek professional assistance.

Businesses should also consider whether a compromised account may expose company information, customer data or other systems.

Cybercrime can be reported through the Australian Government's ReportCyber service, while Scamwatch provides information about reporting scams. Australians affected by identity theft can also seek assistance from IDCARE.

The Most Powerful Phishing Defence is a Moment of Doubt

Phishing succeeds when criminals can make us react before we think.

Technology helps, with spam filtering, endpoint security, multi-factor authentication and other cybersecurity controls that can stop many threats. But people remain an important part of the defence.

When an unexpected message asks you to click, pay, log in or disclose information, give yourself permission to stop.

Don't use the phone number in the message. Don't follow its link. Don't reply simply because the sender's name looks familiar.

Verify the request independently.

That extra thirty seconds may be all it takes to discover that the urgent problem you're being asked to solve doesn't actually exist.

And if you're uncertain whether an email, SMS, phone call or website is genuine,

Arafura Consulting & Media can help you assess it before you act.