Why Scams Work
Scams are not clever, they are patient. Criminals send the same message to hundreds of thousands of people. Most people ignore it. A few click. A few of those click quickly, without thinking. That is all the scammer needs.
The feeling scammers are after is not stupidity, it is hurry. They want you to act now, before you think. Almost every scam uses one of three emotional levers:
Fear. "Your account has been compromised." "You have been fined." "Your parcel could not be delivered."
Greed or hope. "You have won." "Claim your refund." "Unclaimed super waiting."
Love or trust. "Hi Mum, I have lost my phone, this is my new number." "I saw your profile and..."
The scammer's job is to rush you. Your job is to slow down. That is the whole fight, in one sentence.
The Five Tells
Five warning signs. If a message has one, be careful. If it has two or more, it is almost certainly a scam.
1. Urgency
"Act within 24 hours or your account will be closed." "Pay now to avoid a court summons." Real organisations give you time. Real banks do not threaten to close your account in an hour by text. Urgency is the single most reliable tell.
2. A link you were not expecting
A text with a tracking link. An email asking you to "verify" by clicking. A "reset your password" message you did not ask for. If you did not ask for it, do not click it. Go to the service's website by typing the address yourself, or by opening the app you already have installed.
3. Asking for something a real organisation would not
Your password. Your full card details including the CVV. Payment in gift cards. Payment by bank transfer to a new account. Remote access to your computer. No real bank, tax office, Centrelink, Telstra or delivery company will ever ask for these. Gift cards as payment, in particular, is a scam every single time.
4. An address or number that is almost right
An email from "service@paypa1.com" (note the number 1 instead of the letter l). A text from "Australia Post" with an unusual overseas-looking number. A link that says "mygov-update.net" instead of "my.gov.au". The details are nearly right, which is the point. Zoom in. Check the exact spelling.
5. Something is off, and you cannot say exactly why
The language is slightly stiff, or too friendly. It addresses you as "Dear customer" when your bank usually uses your name. Your cousin "has had an emergency and really needs money". Trust the feeling. If something is slightly off, slow down. Ask someone. Call the organisation directly using a number you already have.
The Scams Going Around Right Now
What Australians are losing money to, roughly in order of how common they are.
The missed-parcel text
A text from "Australia Post" or "StarTrack" saying you have a parcel waiting; click here to reschedule or pay a small fee. The link takes you to a fake website that either steals your card or installs spyware.
What to do. If you are expecting a parcel, open the real Australia Post app or website yourself. Ignore the text.
The "Hi Mum" scam
A WhatsApp or text from an unknown number: "Hi Mum, I have broken my phone, this is my new number, can you send $800 for the replacement." It sounds like your kid in trouble. It is not.
What to do. Before you send any money, call your actual child on the number you already have for them. If they do not answer, call someone who would know where they are.
The fake bank call
Someone calls saying they are from your bank's fraud team. They have "detected suspicious activity". They need you to move money to a "safe account", or read out a code that was just texted to you. The code is the one that lets them into your real account.
What to do. Hang up. Call your bank back on the number on the back of your card. Never share a code with anyone who called you.
Romance scams
Someone online, often on Facebook, a dating app or Instagram, builds a relationship over weeks or months. Eventually they need money, for a medical emergency, a visa, an investment, or to come and visit. They always have a reason they cannot video call.
What to do. Insist on a video call before sending any money, ever. If they always have a reason to avoid it, they are not real. A trusted friend's reality-check is worth more than any romance you have only ever typed to.
Investment scams and "crypto opportunities"
A message, often on Facebook or WhatsApp, inviting you to an exclusive investment group or a trader who makes guaranteed returns. Starts small. Asks for more. Shows you a fake dashboard with your "profits". When you try to withdraw, there are fees, delays, and eventually nothing.
What to do. Check any investment firm on the ASIC Investor Alert List before putting a cent in. Guaranteed returns do not exist.
Tax and MyGov scams
An email or text about a tax refund you can claim, or a debt you must pay immediately, with a link to "log in to MyGov". The link is fake and captures your details.
What to do. Never click a link in an email or text from "MyGov" or "ATO". Open the MyGov app or type the address yourself.
The fake job offer
A message out of the blue, often on LinkedIn or Indeed, offering a well-paid remote job. They ask for your details upfront, or you need to buy equipment with your own money to be reimbursed. You will not be.
What to do. Real jobs do not require you to pay anything to get started. Real employers interview you before making an offer. If it starts with money, walk away.
How AI Makes It Worse
Scams used to be easier to spot. The old tells, broken English, obvious grammar mistakes, strange phrasing, are mostly gone, because scammers use AI to write their messages now.
What AI has changed:
- Scam emails are now in perfect English, or perfect whatever-language-you-prefer.
- Voice scams can clone a family member's voice from a 10-second sample on Facebook.
- Fake customer-service chats can hold long, convincing conversations.
- Romance-scam photos and videos can be generated on demand.
The old rule "bad English means scam" is dead. The new rule is "unexpected plus urgent means scam".
What has not changed. Scams still rely on urgency, on asking for things real organisations do not ask for, and on links you were not expecting. Those three remain the best tells regardless of how good the writing is.
How Scammers Fake It with AI: Workshop PresentationBrowser slide deckHow to Verify Without Clicking
The single most useful habit: when in doubt, do not click the thing in front of you. Go to the source yourself.
- Banking: open the app you already have installed, or type your bank's address yourself. Never click a link from a text or email.
- MyGov and government: open the MyGov app, or type my.gov.au directly. Government agencies never send you a login link by text.
- Delivery companies: open the Australia Post app or the courier's website directly. Legitimate tracking lives there, not in a random text.
- A phone call from a "service": hang up. Call back on a number you find yourself, from your own records, the back of a card, or the company's real website.
- A message from a friend asking for money: call them, by voice not text, on the number you already have. If that number does not work, call someone who would know where they are.
If you are not sure about a message, you can paste it into an AI chatbot and ask: "Does this look like a scam to you? What are the warning signs?" The AI has seen tens of thousands of scam examples and is usually accurate. Just do not paste your actual account numbers in with it.
If You Have Already Clicked
First: do not panic, and do not feel stupid. Scams are designed by full-time professionals to catch people. You are not the first and you will not be the last. What matters is what you do in the next few hours. In order:
- If you entered a password. Change that password right now on the real site. Also change it anywhere else you used the same password; this is why reusing passwords is dangerous (more on that in "Staying Safe").
- If you entered bank or card details. Call your bank on the number on the back of your card. Ask them to block the card and watch the account. They have dealt with this a thousand times.
- If you sent money. Call your bank straight away. If the transfer is recent enough they may be able to recall it. Speed matters; minutes can be the difference.
- If you installed software they asked for, or gave remote access. Disconnect from the internet, shut down the computer, and get it looked at by someone you trust. If it is a work computer, tell your IT team immediately.
- If you gave your Medicare, tax file number or ID details. Contact IDCARE (1800 595 160), a free government-funded service that helps you recover from identity theft.
Report it even if you are embarrassed. Every hour you wait, money moves further away. Your bank and IDCARE have seen every version of this; they will not judge, and they can sometimes recover money that has already been sent.
Where to Report
Reporting a scam does not always get your money back, but it helps authorities warn others and catch the people behind it. Keep this list handy.
- Scamwatch (ACCC), for any scam, whether you lost money or not. The main Australian reporting channel.
- ReportCyber (cyber.gov.au), if you have been hacked, had money stolen, or had your identity used. Goes to the AFP and state police.
- IDCARE (1800 595 160), if your personal details have been compromised. Free case workers who help you fix the damage.
- Scamwatch First Nations Infoline (1300 303 143), a dedicated line to report a scam and get help; the page also has scam resources made for community.
- Your bank, for anything involving bank details, transfers or cards. First call if money is involved.
- eSafety Commissioner, for online abuse, image-based abuse, or social media issues.
- The platform itself. Facebook, Instagram, WhatsApp and Gmail all have "report" buttons. Use them; you are helping the next person.
Two free, plain-language booklets worth printing and passing on: The Little Book of Scams, First Nations edition (National Anti-Scam Centre) and The Little Black Book of Scams, Easy Read. And for a plain-English page on any scam type, the NT Consumer Affairs scams pages cover them A to Z.
Try It Yourself
Run a real message past an AI
Take a scam message you have received (most of us have one sitting in a text or email). Paste it into an AI chatbot and ask: "Is this a scam? Point out the warning signs." Compare what the AI flags with the five tells above. Then delete the message. Do not paste in any of your own account numbers or personal details.
Glossary
- Phishing
- A fake message (email, text or call) pretending to be from someone you trust, designed to trick you into handing over passwords, money or details.
- Smishing
- Phishing by SMS text message.
- Scam
- Any dishonest scheme to take your money or information.
- Two-factor code / one-time code
- A short number texted or shown in an app to confirm it is really you logging in. Never read it out to anyone who calls you.
- Remote access
- Letting someone control your computer over the internet. Real organisations do not ask for this out of the blue.
- Spyware / malware
- Harmful software that can be installed when you click a bad link, used to steal information or money.
- Gift-card payment
- Being asked to pay a "bill" or "fine" in gift cards. This is a scam every time.