Phishing

You’ve seen these. A text from your toll road about an unpaid trip. An email from the ATO about a refund. A myGov alert asking you to confirm your details. Each one links to a page that looks right, and exists to collect your login, your card number or a payment.

Phishing borrows trust you’ve already given someone else, then adds urgency — pay today, your account is locked — so you act before you think. Texts are now as common as email (sometimes called smishing), and AI has cleaned up the spelling mistakes that used to give them away. The ones that catch careful people are the boring ones: a shared document, a missed delivery, a voicemail waiting.

Why it matters: for a business, a stolen email login is the expensive one. Your inbox can reset almost every other password you have, and it’s often how business email compromise starts. ASD received over 84,700 cybercrime reports in 2024–25 — about one every six minutes.

What to do: never act on the link. If the ATO, your bank or a supplier really needs something, go to them directly — type the address yourself or open their app. Turn on two-factor authentication everywhere, and passkeys where you can, because a passkey won’t work on a fake site. Report scam messages to Scamwatch at scamwatch.gov.au.