How to spot and avoid phishing emails in Australia

Phishing emails are designed to look like ordinary messages from a bank, delivery company, government department, employer, or familiar online service. Their purpose is to persuade you to reveal a password, approve a payment, open malicious software, or hand over personal details. A message may appear polished and relevant while still being a carefully constructed scam.

Learning how to identify and avoid common phishing emails is less about memorising one visual clue and more about slowing down at the right moment. Australians receive scam messages through email, SMS and social media every day, often timed around real events such as tax time, parcel deliveries, power bills, or a recent online purchase.

Why phishing emails remain convincing

Scammers succeed because their messages are built around situations people recognise. An email may claim to be from Australia Post about an undelivered parcel, the Australian Taxation Office about a refund, or a bank warning about suspicious activity. If the recipient is waiting for a delivery or expecting a tax notice, the message feels immediately plausible.

Many attacks rely on urgency rather than technical sophistication. A subject line might say that an account will close within hours, a payment has failed, or an identity check is overdue. The pressure discourages careful thought and encourages the recipient to click before checking the sender or contacting the organisation directly.

Personal information gathered from data breaches and public social media profiles can make scam emails more believable. A criminal may know your name, suburb, workplace, or the brand of your bank. These details are useful for creating trust, but they do not prove that the email is genuine.

Warning signs worth checking

A suspicious email often contains several small inconsistencies. One unusual feature does not always prove fraud, particularly when legitimate organisations use automated systems, but a combination of warning signs deserves attention.

• A request for passwords, one-time codes, full card numbers, or a copy of identification
• Pressure to act immediately, keep the matter secret, or avoid contacting support
• An unexpected refund, prize, invoice, account suspension, or security alert
• A sender address that uses extra words, unusual spelling, or a lookalike domain
• Links that lead somewhere different from the text displayed in the message
• Attachments you were not expecting, especially compressed files or documents asking you to enable content

Pay close attention to the language and formatting. Awkward grammar, unusual greetings, inconsistent logos, and a tone that does not match previous correspondence can indicate a fake. Professional criminals may produce fluent messages, though, so perfect spelling is not evidence of legitimacy.

A genuine business can make mistakes, and a scammer can copy branding accurately. Treat the email as untrusted until the request has been verified through a separate channel. Avoid using the phone number, link, or reply address supplied in the suspicious message.

Inspect the sender and destination

The visible sender name is easy to imitate. An email may display “CommBank Security” while the underlying address belongs to an unrelated domain. On a computer, hover over the sender address or expand the message details. On a phone, tap the name carefully to reveal the full address without opening any links.

Look for subtle changes such as a different top-level domain, extra hyphens, swapped letters, or a long address containing a legitimate brand name somewhere in the middle. For example, an address ending in a random domain is not made trustworthy by including the words “ato” or “auspost” before the symbol.

Links deserve the same scrutiny. Hovering over a link on a desktop can reveal its destination, while mobile users may be able to press and hold it to preview the address. Be cautious with shortened links, unexpected login pages, and sites that ask for several categories of personal information at once.

A secure padlock in the browser does not establish that a site is genuine. It only indicates that the connection is encrypted. Instead of following an email link, open the organisation’s official app or type its known web address manually. Use a saved bookmark created before the message arrived.

Verify requests through trusted channels

When an email asks you to transfer money, change bank details, approve a login, or share sensitive information, pause and verify it independently. Contact the organisation using a phone number from an official statement, its verified app, or a website you locate separately. Do not reply to the suspicious email, since the sender may control the conversation.

Businesses should confirm changes to supplier bank accounts through a second channel, such as a known phone number or an established contact. This matters particularly for small firms in Sydney, Melbourne, Brisbane and regional communities, where invoices and payment requests may be handled quickly by a small finance team.

Personal messages can require a similar pause. If an email appears to come from a friend asking for money or private information, contact them using a normal phone number or an existing chat. A calm, direct check is useful when a suspicious message creates difficult conversations, especially if the sender claims to be someone you know.

Government agencies and reputable companies generally provide ways to verify a notice without demanding secrets by email. The ATO and myGov may send notifications, but you should sign in through the official service rather than through an unsolicited link. Never provide a one-time banking code to someone who telephones or emails asking you to “confirm” a transaction.

Handle links, attachments and QR codes carefully

Malicious content can arrive in several forms. A document may contain a fake invoice, a spreadsheet may ask you to enable macros, and a QR code may send you to a fraudulent login page. Treat these elements as potential entry points, even when the surrounding message seems ordinary.

• Do not open unexpected attachments simply to see what they contain
• Avoid enabling macros, editing permissions, or security exceptions in emailed documents
• Check a QR code destination before entering credentials or payment details
• Download software and updates through the official app store or the provider’s known website
• Be wary of password-protected archives when the password is supplied in the same email

Scammers often exploit familiar Australian routines. A fake Australia Post message may claim a small redelivery fee, while a counterfeit toll notice may request immediate payment. A QR code on a printed letter, parking notice, or email can be just as dangerous as a conventional hyperlink.

If you opened an attachment or entered information, disconnect from the internet if malware may be running and contact your bank quickly if financial details were exposed. Change compromised passwords from a clean device, beginning with email because access to that account can enable password resets elsewhere.

Respond quickly after a suspicious message

If you have clicked a link but entered no information, close the page and run security updates and a reputable malware scan. Check browser extensions and recent downloads for anything unfamiliar. Do not assume that nothing happened simply because the page disappeared or looked blank.

If you supplied a password, change it immediately on the real service and anywhere else that reused the same password. Enable multifactor authentication, preferably with an authenticator app or security key where available. Review account activity, forwarding rules, recovery details, and logged-in devices for changes you did not make.

Contact your bank through its official number if a card, account, payment, or one-time code was involved. Australian consumers can report scams to Scamwatch, while cybercrime incidents can be reported through ReportCyber. Reporting may help identify patterns and warn others, even when the money cannot be recovered.

Preserve evidence before deleting the message. Keep screenshots, the full email headers if available, payment records, telephone numbers, and website addresses. If a work account was involved, notify your employer’s IT or security team promptly so other staff and customers can be protected.

Build safer email habits

Good security habits reduce the chance that a rushed moment becomes a serious incident. Use a unique, strong password for your main email account and store passwords in a reputable password manager. Your email account deserves particular protection because it is often the recovery route for banking, shopping, and government services.

Separate everyday browsing from sensitive transactions. Use the official banking app or a manually entered website for payments, and avoid completing financial tasks on public Wi-Fi. Australians who manage bills, Medicare records, myGov services, or online shopping from a phone should keep the operating system and apps updated.

• Set up multifactor authentication on email, banking, shopping, and social accounts
• Turn on transaction alerts and login notifications wherever they are offered
• Keep backups of important files, with at least one copy separated from the main device
• Review privacy settings so public posts reveal less about routines and relationships
• Teach family members how to pause, verify, and report suspicious messages

Workplaces can reinforce these habits through short, practical training rather than frightening staff with technical jargon. Employees should know how to report a suspected phishing email without embarrassment or punishment. Clear payment approval procedures, password managers, email filtering, and regular software updates provide layers of protection.

Australian privacy and consumer protections offer useful context, but they do not remove personal risk. The Privacy Act 1988 governs how many organisations handle personal information, while the Spam Act 2003 restricts certain unsolicited commercial messages. Neither law makes every email safe. Careful verification remains essential, particularly when an email involves money, identity documents, or access to an important account.

Make caution part of the routine

A reliable response to an unexpected email can be reduced to three actions: stop, inspect, and verify. Stop before clicking or replying. Inspect the sender, language, request, destination and attachment. Verify the message using an official channel that you found independently.

The same approach works whether the email arrives during a busy commute in Melbourne, while arranging a delivery in Perth, or during a hectic tax period in Canberra. Familiar branding and local references can make a scam feel authentic, but independent verification breaks the pressure created by the message.

Phishing prevention is most effective when it becomes an everyday habit rather than a response reserved for obvious scams. Keep sensitive information out of email, question unexpected urgency, and treat every request for credentials or payment as something that needs separate confirmation. A few seconds of deliberate checking can prevent weeks of account recovery, financial loss, and identity protection work.