Phishing Scams

Phishing is when scammers pretend to be a trusted organisation (like your bank, Australia Post, MyGov, a telco, or even your workplace) to trick you into clicking a link, opening an attachment, or handing over personal details. These messages often look convincing because they copy logos, colours, and wording from real brands. A common real-world example is an email or SMS claiming “Your parcel is awaiting delivery — pay a small fee” and linking to a look-alike Australia Post page that asks for your name, address, and card details.

Another frequent example is a message that appears to be from MyGov or the ATO saying you’re eligible for a refund, or that your account will be suspended unless you “confirm your identity”. The link might take you to a fake login page designed to capture your username, password, and even verification codes. Scammers also target workplaces with “invoice” or “shared document” emails (for example, a fake Microsoft 365 or Google Drive notification) that leads to a sign-in page asking you to re-enter your email and password.

To protect yourself, slow down and verify before you click. Check the sender’s address carefully (phishing emails often use slightly wrong domains like myg0v or extra words), hover over links to see where they really go, and never enter passwords from a link in a message. Instead, type the official website into your browser or use the organisation’s app. If you’re unsure, contact the organisation using a number from their official website — not the message. If you think you’ve already clicked or entered details, change your password immediately, enable multi-factor authentication, and contact your bank or IT support as soon as possible.