Scams Are Getting Smarter: How Australians Can Change the Way We Spot Them

For many years, one of the simplest pieces of internet safety advice was: look for the mistakes.

A suspicious email full of spelling errors, strange grammar, an unusual logo or an awkward sentence was relatively easy to recognise. If a message supposedly came from your bank but looked as though it had been thrown together in five minutes, alarm bells started ringing.

Unfortunately, that advice is no longer enough.

Scammers are becoming considerably more sophisticated. Artificial intelligence and other readily available technologies can help criminals produce professional-looking emails and text messages, communicate convincingly in different languages and imitate the style of legitimate organisations.

The result is an uncomfortable but important reality:

A scam no longer has to look like a scam.

For older Australians, families and small business owners, recognising this change is becoming an important part of staying safe online.

Australians Are Still Losing Billions

Scams are not just a minor nuisance.

According to the National Anti-Scam Centre, combined reports to Australian scam and cybercrime organisations recorded $2.18 billion in scam losses during 2025.

Investment scams were responsible for approximately $837.7 million, followed by payment redirection scams, romance scams, phishing and remote-access scams.

Recent data reported by ANZ provides another warning. Scam activity affecting its customers increased by 18 per cent year-on-year between October 2025 and June 2026.

There is some encouraging news. ANZ reported that customer losses nevertheless fell, and more than 476,000 payments were abandoned after customers encountered warnings about mismatched payment details.

That demonstrates something important.

Scammers can become more sophisticated, but better technology combined with better human decisions can still stop them.

Artificial Intelligence has Changed the Scam Warning Signs in Australia

A poorly written email was once a useful warning.

Today, a criminal can use artificial intelligence to produce a polite, grammatically correct and convincing message in seconds.

A scam email might have:

• perfect spelling;

• professional formatting;

• a convincing explanation;

• the name of a genuine organisation;

• realistic terminology; and

• a tone remarkably similar to legitimate business correspondence.

Technology can also make it easier for scammers to communicate convincingly with people in different languages and create fake websites, advertisements, documents and investment material.

This means Australians need to change the question we ask when scammers contact us.

Instead of:

"Does this message look genuine?"

ask:

"Can I independently confirm that it is genuine?"

That is a much stronger security habit.

The Tthree Words Worth Remembering: Stop. Check. Protect.

Scamwatch promotes a very useful approach:

STOP

If somebody unexpectedly asks you for money, passwords, personal information, banking details or access to your computer, don't act immediately.

Scammers frequently manufacture urgency.

You may be told:

• your bank account has been compromised;

• your internet connection has been hacked;

• an invoice is overdue;

• your tax account has a problem;

• your computer has a virus;

• somebody has made an unauthorised purchase;

• your money needs to be transferred to a "safe account"; or

• you must act immediately to avoid a penalty.

The urgency is deliberate.

A frightened or hurried person is less likely to stop and verify the story.

CHECK

Independently verify what you have been told.

This is one of the most important distinctions in scam prevention.

Do not verify a suspicious message using the contact information contained in the suspicious message.

If someone claims to be calling from your bank, hang up and call the bank using the number on your bank card, statement or the bank's official website.

If an email apparently comes from a supplier saying its bank account details have changed, telephone a person you already know at that business using a number you already have.

If someone claims to represent a government department, find that department's official contact details independently.

The principle is simple:

Change the communication channel.

Don't allow the person who contacted you to control how their identity is verified.

PROTECT

If you discover something suspicious, act quickly.

If money has been transferred, contact your financial institution immediately.

If a password may have been compromised, change it.

If somebody has gained access to your computer, disconnect it from the internet and seek assistance.

If someone has exposed your personal identity information, you may need to take further action because the original scam may only be the beginning.

Older Australians Should Be Particularly Cautious About Remote-Access Scams

Remote-access scams deserve special attention.

They often begin with an unexpected telephone call.

The caller may claim to represent a bank, telecommunications provider, technology company or security organisation. You are told that something is wrong with your computer, internet connection or bank account.

The caller then asks you to install software that allows them to see or control your computer.

Legitimate remote-support software certainly exists, and genuine IT professionals use it every day.

The danger is giving that capability to somebody whose identity you have not independently established.

Once a criminal has remote control of a computer, they may be able to see information displayed on the screen, access files and observe or manipulate online activity.

Scamwatch has previously found Australians aged over 65 suffer particularly heavily from remote-access scams.

A very useful household rule is therefore:

Never give an unexpected caller remote access to your computer.

If your bank, internet provider or another organisation appears to be calling about a problem, end the call and contact that organisation independently.

Small Businesses Face a Different Version of the Same Problem

For a small business, scammers don't necessarily need to steal a password.

Sometimes they only need to change a number on an invoice.

Payment-redirection and false-billing scams are particularly dangerous because they exploit normal business processes.

Imagine that your business regularly receives invoices from a supplier.

One afternoon an apparently routine email arrives:

"Please note that our banking details have recently changed. All future payments should be made to the following account."

The logo is correct.

The employee's name is correct.

The invoice looks normal.

The email is well written.

None of those things proves the new bank account belongs to your supplier.

The supplier's email account may have been compromised, a similar-looking email address may have been registered, or the message may simply have been convincingly fabricated.

Introduce a bank-detail verification rule

Every small business should consider a simple financial control:

No new or changed supplier bank account should be approved solely on the basis of an email.

Verify the change independently using a trusted telephone number already held by the business.

For larger payments, consider requiring a second employee or manager to approve the change.

It adds a small inconvenience, but it can prevent a very large loss.

Don't trust Caller ID by itself

Another outdated assumption is that the telephone number appearing on your screen proves who is calling.

It doesn't.

Scammers can use techniques that make a call appear to come from a familiar or legitimate number.

The same principle applies:

The fact that your phone says "Bank" does not mean the person speaking to you works for your bank.

If the call involves money, account security, passwords or unusual instructions, end the conversation and make your own call to the organisation.

Never Give Anyone Your One-Time Security Code

A one-time password or verification code is effectively a temporary key.

If someone asks you to read them a code that has just arrived on your phone, stop.

Read the accompanying message carefully.

Banks and other services use these codes to confirm important actions.

A scammer may already have obtained your username and password and need only the verification code to complete a login or transaction.

Treat authentication codes like passwords.

They are for you, not the caller.

Be Suspicious When Somebody Wants You to Move Your Money

One particularly dangerous scam story involves convincing a victim that their bank account has been compromised.

The scammer then offers the "solution":

Move the money to another account where it will supposedly be safe.

The new account belongs to the criminal.

A bank, police officer or government agency should not require you to transfer your savings to a stranger's "safe account" to protect them from criminals.

If somebody gives you instructions to move money because your account is supposedly under attack, stop and independently contact your bank.

Investment Scams Remain Extraordinarily Costly

Investment scams continue to cause enormous losses in Australia. They can be particularly convincing because criminals may create professional websites, investment dashboards, documents and advertisements.

Some schemes even display fictitious investment growth, giving victims the impression that their money is producing excellent returns.

A small withdrawal may initially be permitted to build confidence.

The problems appear when the victim tries to withdraw a substantial amount.

Suddenly there may be "taxes", "verification fees", "insurance", "liquidity requirements" or other invented obstacles requiring yet another payment.

Be particularly cautious about investments introduced through:

• unsolicited telephone calls;

• social media advertisements;

• messaging applications;

• new online acquaintances;

• celebrity endorsements; or

• promises of unusually high returns with little risk.

A professional-looking website is not proof that an investment company exists.

Romance and Friendship Scams Deserve Attention Too

The latest ANZ data highlighted romance and friendship scams as a rapidly growing area of loss.

These crimes are particularly cruel because the scammer does not begin by asking for money.

They begin by establishing trust.

Communication may continue for weeks or months before an emergency, investment opportunity or financial problem suddenly appears.

This is why discussing scams without embarrassment is so important.

A person caught in a sophisticated scam is not necessarily careless or technologically inexperienced. Modern scams are deliberately designed to manipulate normal human qualities such as trust, concern, fear, affection and helpfulness.

Families should make scam conversations normal.

If an older parent or relative receives something unusual, encourage them to ask someone else before acting.

Small Businesses Should Create a "Permission to Stop"

Cybersecurity isn't only about antivirus software and firewalls.

It is also about workplace culture.

Employees should have explicit permission to delay a payment or question an unusual request without fearing that they will be criticised for holding things up.

Consider telling staff:

If something involving money, passwords or confidential information feels unusual, stop and verify it. You will never be criticised for checking.

That single policy can be remarkably powerful.

Criminals exploit employees who believe they must comply quickly with requests that appear to come from managers, suppliers or customers.

Five Practical Rules for Households and Businesses

If remembering every scam technique seems impossible, don't try.

Remember these principles instead.

1. Unexpected contact deserves caution.

A phone call, text or email arriving unexpectedly should never automatically be trusted.

2. Urgency is a warning sign.

Pressure to act immediately is often intended to prevent you from thinking or checking.

http://check.New

3. Verify independently.

Use contact information you obtained yourself, not the telephone number or link supplied by the person asking you to trust them.

4. Protect your credentials.

Passwords, PINs and authentication codes should not be handed to callers.

5. Money changes deserve a second check.

New bank accounts, changed supplier details, unusual payments and requests to transfer money should always receive additional scrutiny.

What Should You Do if You Think You've Been Scammed?

Speed matters.

If money may have been transferred to a scammer, contact your bank or financial institution immediately and explain what happened.

If passwords have been disclosed, change them promptly, particularly your email password, because access to an email account can allow criminals to reset passwords for other services.

If remote-access software has been installed at somebody else's request, stop using the computer, turn it off, and ask an IT professional to investigate.Not only will they identify and remove the software, but they can often learn some information about the scammer. You can then provide those details to your banking institution.

Be alert to another danger as well: recovery scams.

People who have already lost money may later find someone claiming they can recover it for a fee. That person may simply be another scammer.

The Most Important Change is How We Think About Trust

Modern technology is making scams more polished.

That means our security habits must evolve too.

We can no longer assume that poor grammar identifies a criminal, that a professional email identifies a legitimate business, or that the telephone number displayed on our screen identifies the person calling.

Instead, practise independent verification.

Stop.

Check.

Then act.

For households, it can prevent the loss of a lifetime's savings.

For small businesses, it can prevent a single fraudulent invoice or compromised account from becoming a major financial incident.

And if you're ever uncertain about an unexpected request involving your computer, accounts or personal information, don't be afraid to stop and seek a second

opinion before doing anything.

---

Arafura Consulting & Media

Helping Territorians use technology safely and confidently.