7 · Scams and fraud
Most scam advice is a list of things to watch for. That puts the whole load on you noticing something in the exact moment a stranger is working hard to stop you thinking clearly — and it dates quickly, because the stories change every few months.
So this section runs backwards, in the order that actually protects a household: set up the defences that keep working on a bad day, learn the pattern underneath every version, and know the procedure if something got through. The full treatment is in the companion guide Scams and Fraud: A Household Guide; what follows is the working core of it.
A note on blame. Being deceived is not a failure of intelligence. These are organised operations with scripts, training and a professional understanding of how people behave under pressure. The households most at risk are the ones certain it could never happen to them.
Part One — Set up your defences
Half an hour of admin now does more than any amount of vigilance later, because vigilance is precisely the thing that fails when you are tired, distracted or genuinely fooled.
Lock down your email first
Your email account is the master key. Anyone who controls it can reset the password on almost everything else you own, including your banking. Give it a password you use nowhere else, and switch on two-factor authentication. Do this before anything else on the list.
Make your accounts harder to drain
Ring your bank on the number printed on your card and ask for each of these. None of them costs anything.
| Ask your bank for | Why it matters |
|---|---|
| Alerts on every transaction, not just large ones | You find out in seconds rather than at the next statement |
| A lower daily transfer limit than the default | Defaults are often far higher than a household ever needs |
| A hold or extra check on payments to new payees | Buys back the minutes a scammer is trying to take from you |
| A credit card for online purchases, not the debit card | Credit card money is the bank’s until you pay the bill, which makes a dispute far easier |
Put a ban on your credit file
A credit ban stops lenders looking at your credit report, so nobody can open an account in your name. It is free and does not affect the cards and loans you already hold. Request it through one bureau — Equifax at equifax.com.au, or Experian at experian.com.au, which also handles illion — and ask them to pass it on.
This is the one item that is not a one-off job. A credit ban runs 21 days from the request. The credit reporting body must tell you at least five business days before it ends, and if you do nothing it lifts by itself. An extension — usually up to twelve months — has to be asked for. So write the date in, not just a tick, and diary the extension before the twenty-one days are up. The app does this arithmetic for you and says so when the ban has lapsed.
Agree on a family verification question
Voice cloning is cheap and quick; a few seconds of someone speaking in a video online is enough raw material to fake a distressed phone call. Decide as a household on one question a caller must answer before anyone sends money in an emergency, with an answer written down nowhere online.
Two honest caveats, because the idea is often oversold. Under real stress, people forget the arrangement — treat it as a backup, not a firewall. And a convincing caller will say they are too panicked to remember; that refusal is itself the answer.
The rule underneath it: hang up and ring the person back on the number already in your phone. If the story is true you will reach them, or somebody who knows where they are. If it is not, you have lost nothing at all.
Part Two — The pattern underneath every scam
Named scams change constantly. The mechanics do not. Look for these six things and you will catch versions nobody has warned you about yet.
| Signal | What it sounds like |
|---|---|
| ① You did not start the contact | The call, text, email or friend request arrived at you |
| ② Manufactured urgency | A deadline measured in minutes or hours |
| ③ Pressure to stay quiet | “Don’t discuss this with anyone”, “this is confidential” |
| ④ Payment that cannot be recalled | Gift cards, crypto, wire transfers, a bank account you have never paid before |
| ⑤ A code or an install | They want a verification code read out, or software put on your device |
| ⑥ Returns without risk | Guaranteed profits, prizes you never entered for, work with no interview |
One of these means slow down. Two means stop.
On the phone
Someone claiming to be from your bank’s fraud team says your account is compromised and the money must be moved somewhere safe. No bank will ever ask you to do this. The safe account belongs to the criminal. Caller ID can be faked, so your bank’s name on the screen proves nothing. The same script runs with the tax office, a government department or the police — real agencies write to you, and none of them take payment in gift cards.
By text, email or message
Parcel delivery problems, unpaid tolls, overdue bills, accounts about to be suspended. The message always carries a link and the link always leads to a convincing copy of a login page. Do not tap links in messages you were not expecting — open the app, or type the address yourself.
Two catch careful people in particular. Verification codes: anyone asking you to read out a code that was just texted to you is taking over an account. There is no legitimate version of that request, ever. Changed payment details: an invoice from a business you genuinely deal with, carrying new bank details — ring them on a number you had before the invoice arrived. This one costs tradespeople, small businesses and households buying a home enormous sums.
On your screen
Alarming pop-ups warn of a virus, usually with a phone number and often hard to close. The number reaches someone who asks to connect to your computer using remote-access software. Once in, they can see your banking and move money while you watch. Microsoft, Apple and your internet provider will not ring you about a problem on your computer.
Through a relationship
Warm, attentive, consistent, and always unable to meet in person or appear on video. The current version blends romance with investing: after weeks of friendship they mention a trading or crypto platform, the balance on the site climbs beautifully, small withdrawals work at first, and then they stop. The length of the build-up is the method, not evidence against it.
Through money and work
- Job and task offers that arrive unsolicited, pay well for simple repetitive work, then ask you to deposit your own funds to unlock earnings.
- Marketplace buyers who overpay, send a “seller verification” link, or want to move the payment off the platform.
- Online shops with prices well below everyone else’s, advertised through social media, that take payment and never ship.
- Recovery offers — someone contacts a victim promising to retrieve the money for an upfront fee. People who have already lost money are the most heavily targeted group there is.
Sentences worth having ready
You owe a stranger nothing and you do not need to explain yourself. Short works better than reasoned, because there is nothing in it to argue with. “I don’t take financial calls — I’ll ring the number on my card.” “I don’t give codes to anyone. Goodbye.” “I don’t send money to people I haven’t met.” “I need to check with my family first.” Then hang up. Say them out loud once — a sentence you have never spoken is not available to you at nine at night when someone is shouting.
Part Three — If something got through
Speed matters more than anything else here, and more than getting the order exactly right.
Within the hour
| ✓ | Do this now |
|---|---|
| ☐ | Ring your bank on the number on your card. Ask them to stop or recall the payment and freeze the account. Some transfers can still be caught |
| ☐ | Change your email password, then your banking password. Email first — it is the account that controls the others |
| ☐ | If anyone connected to your device, disconnect it from the internet, uninstall the remote-access software and run a security scan. Assume anything typed while they watched is known to them |
| ☐ | If you paid by gift card, ring the card issuer with the numbers and the receipts. Occasionally the balance is still sitting there |
Within the day
| ✓ | Then do this |
|---|---|
| ☐ | Report it to Scamwatch at scamwatch.gov.au. This is what tells authorities which scams are running right now |
| ☐ | Make a police report through ReportCyber at cyber.gov.au if money was lost. A Scamwatch report is not a police report, and you may need the reference number later |
| ☐ | Ring IDCARE on 1800 595 160 if personal documents or ID were exposed. Free, Australian, and they will build you a specific response plan |
| ☐ | Place a ban on your credit file — see Part One |
| ☐ | Tell someone. Not only for support — your details are now on a list, and the follow-up approach is often the one that does the real damage |
Expect a second attempt. Anyone who has been scammed once should treat every later contact about it — especially anyone offering to recover the money for a fee — as part of the same operation. Scamwatch, ReportCyber and IDCARE never charge, and never ring first offering to recover money.
Helping someone who is in the middle of one
This is the hardest situation in the whole subject, and most guides skip it. Someone being scammed has usually been coached to distrust the exact people trying to help. They may defend the scammer, hide transactions, or become angry when questioned, and confronting them head-on tends to push them further in.
- Ask questions rather than making accusations. “What happens if you ask to withdraw some of it?” opens a door that “you’re being scammed” closes.
- Focus on one concrete, checkable thing rather than arguing about the whole story.
- Involve their bank. Australian banks have staff trained for this and can slow a transaction down without it becoming a family argument.
- Do not lead with shame. The single biggest reason people lose more than they had to is that they could not face telling anyone early.
Your household setup page
Fill this in once. The app carries the same list on its Scams and fraud tab with a date against each job, so the dates age by themselves and you can see next year which have gone stale.
| ✓ | Setup task | Done on |
|---|---|---|
| ☐ | Unique password + two-factor on our main email | |
| ☐ | Transaction alerts switched on with the bank | |
| ☐ | Daily transfer limit lowered to a sensible number | |
| ☐ | Credit card used for online purchases, not the debit card | |
| ☐ | Credit ban placed with Equifax and Experian — 21 days unless extended | |
| ☐ | Family verification question agreed and practised | |
| ☐ | Everyone in the household has read Part Two |
One thing the app will not hold, deliberately: your verification question and its answer. Their whole value is that they exist in two people’s heads and nowhere else — least of all on a computer that a remote-access scam is designed to reach. The app records that you agreed one and said it out loud, and nothing more. The same goes for account numbers and passwords: neither this page nor that tab should ever carry them.
Where to go: Scamwatch (scamwatch.gov.au) to report a scam and read current alerts · ReportCyber (cyber.gov.au) for the official police report · IDCARE (1800 595 160) for identity theft support · your bank, on the number on your card, to stop and recall payments · AFCA (afca.org.au) to complain about how a bank responded.