Phishing texts, emails and DMs — anatomy of a lure

Phishing is a fake message — text, email, DM, even a QR code — that imitates someone you trust to steal your login, your card details or your identity. It’s the most common scam in Australia because it’s cheap to send a million lures and only needs a handful of bites.

The four parts of every lure

1. 1

   The costume

   A trusted name: Australia Post, myGov, your bank, Telstra, Linkt, Netflix, the ATO. Logos and sender names are trivial to fake — never trust the costume.

2. 2

   The hook

   A reason you must act: a missed delivery, an unpaid toll, a tax refund, a suspended account, a suspicious login. Hooks target routine life admin so they feel plausible.

3. 3

   The pressure

   A deadline — “within 24 hours” — to stop you checking. Sometimes the opposite: a small, low-stakes ask (“pay $2.20 redelivery fee”) designed to harvest your full card details.

4. 4

   The trap

   A link to a pixel-perfect fake site, or an attachment that installs malware. The fake site’s only job is to collect what you type.

How to check a link safely

• On a computer, hover over the link to preview the real address. On a phone, press and hold the link (don’t tap) to preview it.
• Read the domain from right to left: the part just before the first single slash is what matters. “auspost-tracking.info” is not Australia Post. “my.gov.au” is real; “mygov-refund.com” is not.
• When in doubt, don’t click. Open the official app or type the address yourself.

If you clicked or entered details

1. 1

   Entered a password?

   Change it now — on the real site or app — and anywhere else you reused it. Turn on two-factor authentication.

2. 2

   Entered card or bank details?

   Call your bank using the number on your card. Ask them to watch or replace the card.

3. 3

   Downloaded or opened an attachment?

   Run a security scan. If the device behaves oddly afterwards, get it checked before banking on it.

4. 4

   Report it

   Forward scam texts to 7226 (SCAM) — the free national reporting number — then delete. Report the scam to Scamwatch.