Personal cyber security handbook

Be aware of current cyber security threats by staying across official government advice, such as the Australian Signals Directorates’ cyber.gov.au, and by talking with family, friends and colleagues.

Scams are one of the most common ways cybercriminals compromise devices, online accounts or personal information. Scammers will try to trick you into opening malicious links or attachments or providing them with information. This can put your devices and accounts at risk. Always stop and think before you open any links or attachments from email, text messages, websites and social media.

How scams work

Knowing how to spot common scams and how they work can help you avoid them. Most scams follow a similar pattern, typically including these phases:

Contact

You receive an unexpected message, call or offer.

Manipulation

The scammer pressures you to act quickly.

Payment or data theft

The scammer tries to get you to transfer money, share personal details, provide them with a verification code, install software, or click malicious links or QR codes.

Common scam tactics

Scammers might change their stories often, but their goal is the same: to steal money or information. Be aware of the following types of scam tactics.

Impersonation scams

A scammer pretends to be from a trusted organisation, such as a bank, government agency, delivery company or utility provider. They may spoof phone numbers or sender IDs to make the message look real.

Investment and cryptocurrency scams

You are offered high or guaranteed returns. The offer may involve cryptocurrency, trading platforms or "insider" opportunities. These scams often have real websites and testimonials behind them to appear authentic.

Romance and relationship scams

A scammer builds a relationship with you online, then asks for money, gifts or financial help. They may claim to work overseas or in remote locations.

Remote access scams

Someone claims to be from technical support and asks you to install software or give them remote access to your device.

Jobs and employment scams

You are offered easy online work or paid tasks. You may be asked to pay fees upfront or use your own money before being "reimbursed".

Deepfake scams

Scammers may use AI to copy a person’s voice or create convincing messages and videos. The term ‘deepfake’ is associated to this tactic. An example could be a phone call that sounds like a family member asking for urgent financial help.

AI chatbot scams

In online buying and selling, scammers may use chatbots to pose as fake buyers or sellers. They use quick, friendly messages to gain trust and push the deal forward. They might send fake payment links, claim they paid too much by mistake, or say you must pay extra fees before the item can be released.

SMS scams

Scammers often use familiar business or brand names to make their messages look real. Don’t trust a message just because it looks genuine. Avoid clicking links and contact the organisation directly if you’re unsure.

As part of the Australian Government’s efforts to reduce scams, businesses can register their branded sender IDs (the name shown at the top of an SMS, such as AusPost, StarTrack or myGov) with the Australian Communications and Media Authority (ACMA). Verified organisations can display their name when sending messages like delivery updates or security codes. Messages from senders that haven’t been verified may show as ‘unverified’, which can help you spot suspicious messages.

Phishing

Phishing is when cybercriminals pretend to be a trusted person or organisation to trick you into giving them information. They may send you fake emails or messages and pretend to be from a trusted organisation such as a bank or government service. They may try to steal your online banking logins, credit card details or passwords. They may try to gain access to your accounts by requesting you scan a QR code, share account registration PINs or account verification codes. This can lead to financial loss or identity theft.

Phishing messages can be sent through:

• email
• text message
• social media
• instant messaging platforms
• phone calls.

Warning signs of phishing

Phishing messages can be difficult to detect. Look out for these common warning signs:

• Unexpected emails, texts, messages or phone calls.
• Pressure to act quickly or urgently.
• Requests for passwords, authentication codes or personal information.
• Suspicious links, attachments or QR codes you weren’t expecting.
• Caller IDs that look real but may be fake.
• Strange or misspelled email addresses.
• Generic greetings like 'Dear customer' and poor spelling, grammar or layout in messages.
• Callers asking you to skip normal security steps.
• Threats or warnings of serious consequences if you do not act.
• Messages that seem too good to be true.
• Voices that sound unusual or too perfect (possible voice cloning).

What you can do about phishing

Taking a moment to stop and check before you act can help keep your information and accounts secure.

• Be careful with messages and calls: Don’t click links, scan QR codes, or download files you weren’t expecting.
• Use trusted sources: Go directly to official websites or use known phone numbers instead of links in messages.
• Don’t share personal details: Never give out passwords, authentication codes or banking details.
• Use strong security: Set strong passwords and turn on multi-factor authentication.
• Keep devices and software updated: Install updates and security patches regularly.
• Check before you act: If something feels urgent or unusual, stop and verify it.
• Protect your accounts: Contact your bank or service provider if you think your details are at risk.