Scams and cybercrime

What is a threat of arrest scam?

Scammers will impersonate government agencies or organisations, claiming people owe money or need to make a payment. They often use threats of arrest, deportation or harm if they do not agree to pay.

Variations of this scam include:

• The scammer claims to be from an international law enforcement agency or the Department of Immigration claiming that there is an issue with your visa.
• Scammers pretend to be from the Australian Tax Office (ATO) and inform the person they have a tax debt that needs to be paid immediately.
• Automated telephone calls claiming a person’s tax file number has been suspended due to money laundering or criminal activity and there is a legal case against their name.

Contact from the scammer is usually initiated through text message, email or by phone. The caller ID of a phone call is often manipulated to appear as it is coming from a legitimate source.

Red flags

• The caller ID displays the name of the organisation and not an ‘unknown’ or ‘private’ number.
• In order to ‘fix’ the issue, the scammer may use threats, demands or requests for money.
• Scammers often ask for payments through unusual methods such as cryptocurrencies, international money transfers and gift cards.
• Scammers will attempt to manipulate or coerce their victims into complying with their demands.
• The scammer will often want you to stay on the phone while you follow their instructions.
• The scammer may ask for personal information to assist with visa issues, such as passport number, date of birth etc.

Protect yourself

• Do not trust caller ID.
• Hang up and do not engage with the caller.
• Do not provide bank details or send money or gift cards.
• Never click on links provided within emails or text messages.
• Don’t be pressured by the scammer, hang up and don’t respond.
• Verify the identity and story of the caller by calling the relevant organisation using a publicly known phone number. Don’t use any contact details provided by the caller.
• If you are concerned for your safety, contact the police.
• If the scam is sent by email, don’t open any attachments, click on links or download files.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.
• If the scam is impersonating an existing business or organisation, advise the organisation.
• If you provided information that you believe compromises your ATO details, advise the ATO immediately.

Support and resources

Seek help if this happens to you. It’s not your fault and you are not alone.

• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner – www.esafety.gov.au
• Victims of Crime SA – www.voc.sa.gov.au
• Lifeline – 13 11 14 or www.lifeline.org.au
• Kids Helpline – 1800 55 1800 or https://kidshelpline.com.au
• IDCare – 1800 595 160 or www.idcare.org

Listen to a threat of arrest scam here

What is a romance or relationship scam?

Scammers create phony profiles on dating websites and other online applications with the intention of building fake relationships with people. The scammers often continue the communication over an extended period of time and go to great lengths to build trust and convince them the relationship or connection is genuine. As people become more emotionally invested in the relationship, the scammer creates reasons as to why they need money. These monetary requests often initially start small and increase with time.

Red flags

• Professes strong feelings or love quickly.
• Request to move communications off platform.
• They make excuses for not being able to meet or video call.
• Attempt to isolate people from family and friends, so as to avoid being detected.
• Requests for money increase and the person can become more aggressive and demanding.
• Unrealistic stories and explanations.
• Their profile has little personal information or few friends.

Protect yourself

• Be careful what information you share with others online as scammers may use this information to target you.
• Never send money, bank details or identity documents to anyone you have only met online.
• Don’t be pressured into making decisions or sending information quickly. Scammers will often try to make it appear urgent.
• Search the scammer’s name online to see if the results are included in any previous scams.
• Conduct a reverse image search on pictures provided by the person, to see if they have been stolen from other sources online.
• Act quickly and report if you believe you're a victim.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police at ReportCyber or attend your local police station.
• Offences against victims under 18 years can also be reported to the Australian Centre to Counter Child Exploitation.
• If the scammer has shared any intimate images online without your consent, report this to the online platform to have them removed.
• Contact the eSafety Commissioner to assist in having images removed if the platform failed to take down the content.

Support and resources

Seek help if this happens to you. It’s not your fault and you're not alone.

• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner – www.esafety.gov.au
• Australian Centre to Counter Child Exploitation - www.accce.gov.au
• Victims of Crime SA – www.voc.sa.gov.au
• Lifeline – 13 11 14 or www.lifeline.org.au
• Kids Helpline – 1800 55 1800 or https://kidshelpline.com.au
• IDCare – 1800 595 160 or www.idcare.org

What is sextortion?

A form of online blackmail where an offender manipulates or coerces someone into sending intimate images or videos and then threatens to disseminate them unless a payment is made.

Other variations of sextortion include:

• The scammer records the victim when they are on a live stream.
• The victim’s face is super imposed onto a body in an explicit image.
• The scammer claims they have found intimate images or hacked your device or web cam to obtain images.

As contact from the scammer is usually initiated through social media, the scammer often has access to images and the person's contact list, making it easier for them to perpetrate the scam.

Red flags

• Unsolicited contact often on social media or dating websites.
• It happens quickly. The person quickly becomes overly friendly or affectionate.
• Request for explicit content. This often happens after the scammer has sent intimate photos of “themselves” first.
• Reluctant to video chat or meet in person.
• Threats, demands or request for money.
• Pressure and manipulation. Scammers will attempt to manipulate or coerce people into complying with their demands.

Protect yourself

• Be cautious when communicating with unknown people online.
• Do not send intimate images or videos.
• Do not pay money to the scammer.
• Cease communication and collect evidence – photos, screenshots, times and dates, phone numbers, account handles and URLs.
• Act quickly and report if you believe you are a victim.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.
• Offences against victims under 18 years can also be reported to the Australian Centre to Counter Child Exploitation.
• If the scammer has shared any intimate images online without your consent, report this to the online platform to have them removed.
• Contact the eSafety Commissioner to assist in having images removed if the platform failed to take down the content.

Support and resources

Seek help if this happens to you. It’s not your fault and you are not alone.

• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner - www.esafety.gov.au
• Victims of Crime SA - www.voc.sa.gov.au
• Lifeline - 13 11 14 or www.lifeline.org.au
• Kids Helpline - 1800 55 1800 or https://kidshelpline.com.au
• IDCare - 1800 595 160 or www.idcare.org

Watch our video to learn more about sextortion.

What is a remote access scam?

Scammers make unsolicited calls impersonating well known businesses such as telecommunication companies and banks. They will try to convince people that there are technical or security problems with their device, internet or bank account and they can “help”. They will ask the person to install an application or software onto their device, which will allow them remote access to "fix the problem".

Once the software is installed, the scammer can:

• Install malicious software that will lock up your system, then demand money for payment to remove the malware (see ransomware).
• Install key logging software, then get you to check all your bank accounts obtaining your log in and password credentials.
• Steal private information and credentials.

Red flags

• Unexpected contact from a person claiming to be from a large telecommunication company or a technical support service provider.
• Request for you to install a program to prove to you something is wrong with your device or to assist them in fixing the problem for you.
• Pressure you to install a program. Scammers will attempt to manipulate you into complying with their demands.
• The caller is very persistent and may become abusive.

Protect yourself

• Hang up from the scammer.
• Never install anything at the request of an unsolicited caller.
• Never give an unsolicited caller remote access to your computer.
• Protect your computer or device with regularly updated anti-virus and anti-spyware software, and a good firewall. Research first and only purchase software from a source that you know and trust.
• Act quickly, remove any installed software and run a scan of your device.
• Report if you believe you may be a victim.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police immediately via ReportCyber or attend your local police station.

Support and resources

• If you have given remote access to your computer or believe your computer security has been compromised, seek help or advice from a qualified and reputable IT professional.
• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner - www.esafety.gov.au
• Victims of Crime SA - www.voc.sa.gov.au
• Lifeline - 13 11 14 or www.lifeline.org.au
• Kids Helpline - 1800 55 1800 or https://kidshelpline.com.au
• IDCare - 1800 595 160 or www.idcare.org

What is an investment scam?

Scammers contact people offering “investment opportunities” that promise high returns with little or no risk. The investment opportunities often involve investing money or buying cryptocurrency. Scammers use convincing marketing techniques via fake websites, social media, email and phone calls to appear legitimate and convince people to act fast and invest. In some cases, people may receive some returns after their initial investment, which entices them to invest more. When the investor attempts to gain access to their money or cryptocurrency, they will realise their investment is gone or they’re unable to access it. The scammer will usually cease all communication with the investor.

Investment scams can present in a variety of forms. To read more about common investment scam types, please see the National Anti-Scam Centre – Scamwatch website.

Red flags

• Celebrity endorsements via social media for the investment.
• Testimonials with unrealistic promises of big returns.
• Online only contacts start talking to you about investing.
• There is a pressure to act quickly or miss out.
• Being asked to promote the scheme to friends or family.
• Offers to assist in setting up a cryptocurrency wallet.
• Newly registered domain for existing companies.
• An offer to buy shares or cryptocurrency well below market value.
• If it sounds too good to be true, it probably is!

Protect yourself

• Don’t be pressured into making decisions or sending information quickly. Scammers will often try to make it appear urgent.
• It’s important to seek legal or financial advice from a financial advisor registered with ASIC.
• Check the International Organisation of Securities Commission’s investor alerts, to ensure the company or website is not named.
• Check the contact details provided to you are the same as the company’s publicly listed contact.
• Check the website URL for established companies, ensure they match. Scammers will often have only a slight variation in the URL, so fake websites are less likely to be identified.
• Check the date the domain was registered. Newer websites for established companies is red flag.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.
• If the scam is impersonating an existing business or organisation, advise the organisation.

Support and resources

Seek help if this happens to you. It’s not your fault and you are not alone.

• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner – www.esafety.gov.au
• Victims of Crime SA – www.voc.sa.gov.au
• Lifeline – 13 11 14 or www.lifeline.org.au
• Kids Helpline – 1800 55 1800 or https://kidshelpline.com.au
• IDCare – 1800 595 160 or www.idcare.org

Watch our video on investment scams here.

What are employment scams?

Scammers will advertise and offer jobs via text or emails, asking people to contact them if they are interested. The jobs appear high paying, with not a lot of effort involved. The scammer will pretend to be from a recruitment agency or other high-profile company, and often ask for money so those interested can start their job, or so they can receive their earnings.

Scammers will trick “employees” by paying small amounts at first for tasks or jobs completed.  The tasks become larger and require the victim to pay money to release funds owed.

Scammers launder money, often from other victims and get the victim of the employment scam act as a “money mule”, laundering money, by sending and receiving funds for the scammers, making it harder to track the funds.

Red flags:

• Receiving a job offer over SMS, or other apps.
• Sounds too good to be true.
• You're required to send them copies of your ID.
• There is no interview.
• You are told you need to pay money so you can earn money.
• The job may involve tasks such as, receiving and transferring money, receiving or sending packages for someone else, completing small jobs or tasks as proof, buying/selling cryptocurrency.

Protect yourself:

• Do not reply to unsolicited messages offering jobs.
• Do your research prior to accepting any job offer, if it sounds too good to be true it probably is.
• No legitimate job will make you pay money so you can get your earnings.
• Act quickly and report if you believe you're a victim.
• Never send any identity documents. Employment agencies typically want to see the original, not copies or photos of your ID.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.
• If the scam is impersonating an existing business or organisation, advise the organisation.

Support and resources

Seek help if this happens to you. It’s not your fault and you are not alone.

• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner – www.esafety.gov.au
• Victims of Crime SA – www.voc.sa.gov.au
• Lifeline – 13 11 14 or www.lifeline.org.au
• Kids Helpline – 1800 55 1800 or https://kidshelpline.com.au
• IDCare – 1800 595 160 or www.idcare.org

Find out more about how this scam works from the National Anti-Scam Centre - Scamwatch.

What is business email compromise (BEC)?

BEC scams occur when cybercriminals compromise legitimate business or personal email accounts through social engineering or computer intrusion, to manipulate people into transferring them money or private information. These types of scams affect both businesses and customers.

Intrusions occur often when a user/employee clicks on a suspicious link containing malware that can lead to unauthorised access or installation of unauthorised software.

Social engineering occurs when someone is manipulated by a scammer into doing what they want. They use pressure tactics such as making it appear urgent and/or pretending to be another employee within the company.

The most common example of BEC is false billing, Cybercriminals gain access to email accounts and alter legitimate invoices, substituting the payee’s account details with their own.

Malicious software can infiltrate an email system and detect keywords to automatically change invoices almost instantly after being sent.

Red flags

• Notification that the account details have changed.
• Invoices have different reference or payment numbers.
• Unusual email requests for payment or private information from another person within the business or organisation.

Prevention advice

• Double check payment details with an organisation before making any significant payments.
• Be suspicious. Contact the business on a known, reputable number to clarify the change in their bank details.
• Asking for clarification, forwarding an email to your IT department, or checking with a colleague is better than transferring thousands of dollars to the wrong person.
• If something doesn't feel right, it probably isn't. Encourage employees to trust their instincts and ask “Would my CEO or manager actually tell me to do this?” or “Why isn't this supplier submitting an invoice through our portal?”
• Slow down. Scammers often time their attacks around the busiest periods of the day for good reason. If an employee is quickly going through emails, they are less likely to pause and consider whether a particular request is suspicious.
• Protect your computer or device with regularly updated anti-virus and anti-spyware software, and a good firewall. Research first and only purchase software from a source that you know and trust.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.
• Ensure all parties involved are aware as they may require a qualified IT professional to check the security of their accounts and devices.

Support and resources

Seek help if this happens to you. It’s not your fault and you are not alone.

• Talk to friends and family.
• If you believe that your computer security has been compromised, seek help or advice from a qualified and reputable IT professional.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner - www.esafety.gov.au
• Victims of Crime SA - www.voc.sa.gov.au
• Lifeline - 13 11 14 or www.lifeline.org.au
• Kids Helpline - 1800 55 1800 or https://kidshelpline.com.au
• IDCare - 1800 595 160 or www.idcare.org

What is ransomware?

Ransomware is malicious software (malware) that allows scammers access to your device or computer. Once installed, scammers have access to lock up your device and encrypt your data, holding it to ransom. Scammers will demand money, gift cards or cryptocurrency in return for unlocking your device or unencrypting your data.

Malware can automatically be installed on your device after the user has;

• Opened emails from people they don’t know.
• Clicked on suspicious links.
• Visited suspicious websites.
• Allowed remote access into their device to a scammer.

Red flags

• A popup screen tells you that you have been hacked and requests payment.
• There is often a timer to put pressure on you to pay quickly.
• Your device appears locked and you are unable to use it normally.
• Files look different and may have different names.
• Files may require a password.

Protect yourself

• Do not pay scammers. Payment does not guarantee they will unlock your device.
• Never click on unknown links or open unknown documents.
• Do not visit unsafe or suspicious websites.
• Do not download from unsafe or suspicious websites.
• Do not open suspicious emails.
• Other scammers will often advertise on the internet an ability to help by calling a number or installing another program, however they are also scammers.
• If affected take your device to a reputable IT professional.
• Regularly back up important data.
• Protect your computer or device with regularly updated anti-virus and anti-spyware software, and a good firewall. Research first and only purchase software from a source that you know and trust.
• Act quickly and report if you believe you are a victim.

Report

• If you have lost money or believe your bank account details have been compromised, contact your bank immediately.
• Report to police via ReportCyber or attend your local police station.

Support and resources

• If you believe that your computer security has been compromised, seek help or advice from a qualified and reputable IT professional.
• Talk to friends and family.
• Australian Cyber Security Centre - www.cyber.gov.au
• National Anti-Scam Centre - Scamwatch - www.scamwatch.gov.au
• eSafety Commissioner – www.esafety.gov.au
• Victims of Crime SA – www.voc.sa.gov.au
• Lifeline – 13 11 14 or www.lifeline.org.au
• Kids Helpline – 1800 55 1800 or https://kidshelpline.com.au
• IDCare – 1800 595 160 or www.idcare.org

Find out more about how this scam works from the Australian Cyber Security Centre.

Strong passwords or passphrases are one of the strongest measures you can use to secure online accounts.

Tips

• Where possible, use a passphrase. Passphrases are a mix of random words, usually 4 or more. They are long, unpredictable and harder to be cracked.
• Consider adding numbers, capital letters and symbols.
• Do not use identifying or easily obtainable information within your password or passphrase - eg. children or pet's names, year of birth and names.
• Do not use the same password across multiple online accounts.
• Use a trusted password manager to help keep track of your passwords.

For further information on creating secure passphrases, visit the Australian Cyber Security Centre.

Multi-factor authentication (MFA) is a security measure that requires two or more proofs of identity to grant you access, such as a password followed by a code sent to your mobile phone.

MFA helps to protect you against cybercriminals who use previously stolen passwords from one website and try to reuse them to gain access to more online accounts.

To learn more about multi-factor authentication, visit the Australian Cyber Security Centre.

Ensure your device's software is always up to date as cybercriminals, malicious programs and computer viruses can exploit weaknesses in software.

Software developers release regular updates for their products to fix any security concerns and improve functionality. Turning on automatic software updates ensures your software is updated as soon as they become available.

To learn how to update your device, visit the Australian Cyber Security Centre.

Our devices contain lots of personal and important data. This data can be lost through hardware or software failures, theft or viruses. Regularly creating a backup of this important information will help you to recover it in the event that it is damaged, lost or destroyed.

To learn more about backing up data on your device, visit the Australian Cyber Security Centre.

Caller ID spoofing allows scammers and cybercriminals to deliberately hide their phone number and display a different phone number on the receiver's phone.

Scammers will often use this tactic to trick people into answering calls they might otherwise not answer. For example, scammers may alter their details to appear as if 'Adelaide Police Station' is calling your mobile phone.

If you are unsure, hang up and call the person or organisation back on a publicly known phone number to check.

To learn more about caller ID spoofing, visit IDCare.