Phishing and scam emails are among the most common ways criminals attempt to steal sensitive information, including login details, personal identification, and financial data. These emails are designed to look legitimate but usually contain subtle warning signs. Understanding how to identify them is an important step in protecting yourself and your digital assets.
Common signs of phishing emails
1. Suspicious sender details
Scam emails often come from addresses that appear unusual, with extra numbers, letters, or domains that don’t match the organisation’s official address. Always check the sender’s email carefully.
2. Urgent or threatening language
Criminals rely on creating a sense of urgency. Subject lines or messages that claim “your account will be locked” or “immediate action required” are designed to pressure you into reacting without thinking.
3. Unexpected attachments or links
Phishing emails may include links directing you to fake websites or attachments that contain malware. Hover over links to preview the URL and only open attachments you are expecting from trusted sources.
4. Requests for sensitive information
Legitimate organisations will never ask you to provide passwords, personal identification numbers (PINs), or account logins via email. Any such request should be treated as a red flag.
5. Poor spelling and formatting
Many scam emails contain grammatical errors, unusual formatting, or inconsistent branding. While some may appear polished, these errors are often a giveaway.
How to protect yourself
- Verify before clicking: If you receive an email that seems suspicious, verify its authenticity by contacting the organisation directly using official contact details.
- Enable security features: Use multi-factor authentication (MFA) to add an extra layer of protection. Even if criminals obtain your password, MFA can block unauthorised access.
- Keep software updated: Ensure your email client, browser, and antivirus software are up to date to reduce the risk of malware.
- Report phishing attempts: Forward suspicious emails to report@phishing.gov.au or your email provider’s reporting service.
What to do if you’ve clicked a scam link
If you believe you’ve fallen victim to a phishing scam:
- Change your passwords immediately for any affected accounts.
- Contact your bank or financial institution if payment details may have been compromised.
- Monitor your accounts for unauthorised transactions or activity.
- Report the incident to the Australian Cyber Security Centre (ACSC) through ReportCyber.
