The scams costing Australians millions and how to protect yourself

A major energy retailer’s data breach. Tax-time impersonators cashing in on EOFY stress. Fake delivery mix-ups targeting customers, restaurants and workers alike. This year’s scam landscape has moved well beyond the clumsy email phishing of the past. These days, a scam message might reference your real account details, arrive at exactly the moment you’re expecting a tax notice, or mimic an app you use every week.

The good news? Once you know what to look for, most of these scams share the same tell-tale signs. Here’s what’s circulating right now, the red flags to watch for, and exactly what to do if you’ve been caught out.

What are some of the newest scams in Australia?

Scams are always evolving and often use current events to target vulnerable Aussies. Here’s what’s circulating right now, the red flags to watch for, and what to do if you’ve been caught out.

1. Origin Energy data breach

Origin Energy, Australia’s largest energy retailer, has confirmed a security breach in July that exposed the personal details of 900,000 current and former customers. This puts victims at risk not just of fraud, but of highly targeted scams built around their own personal information. Origin is urging affected customers to be cautious of unsolicited calls, texts, or emails, and to get in touch with them directly through official Origin channels before sharing information or taking action.

The red flags:

• Offers to help you: Scammers may pose as a business  offering to recover your data or money after a breach. Before handing over any personal information, verify they’re legitimate by contacting your provider directly. If it really was them, they’ll confirm it. If it wasn’t, report the scammer’s contact details to Scamwatch.
• Messages referencing specific payment details: Origin will never quote your specific card details in a bill or message.  If you get something like “Your Credit Card ending in 1234 has been suspended due to suspicious activity. Click here to verify,” don’t respond.
• Contact via an unfamiliar channel: If Origin has only ever emailed you and get a text claiming to be from them, be cautious. Origin has a dedicated scam safety page to help customers work out whether a message claiming to be from them is genuinely them.

2. Tax time schemes

Tax time is one of the busiest times of the year for scammers. In June alone, the Australian Taxation Office (ATO) received over 1,500 reports of scammers attempting to impersonate ATO officials. Typically, scammers were trying to get people to hand over personal details or money under the guise of an unpaid tax bill or a problem with their tax account

The red flags:

• You haven’t submitted your tax yet: If you haven’t lodged your return or spoken to your tax agent this year, a message about your tax bill is likely fake.
• Pressure or urgency: Messages urging you to log in to your MyGov account, hand over personal details or make an urgent payment to the ATO, are a red flag. Scammers use tax deadlines to rush people into acting before they think it through. Contact the ATO directly to check.
• Links to click: The ATO has said it will never email you a link unless it’s told you beforehand to expect one.

3. Food delivery tricks

Scammers are targeting food delivery customers, restaurants and delivery workers by impersonating services like DoorDash and Uber Eats, or even posing as a restaurant or customer. They typically  make contact about a fake order, refund, cancellation, or payment problem, then ask for your account login, personal information or bank account details, claiming they’ll sort it out or compensate you.

The red flags:

• Claims of fraudulent activity: Some customers are getting fake messages saying a charge has been blocked and to log in to their account to confirm. Go directly through the delivery app to check if this is true.
• Requests for codes, passwords, logins or banking information: Scammers will claim to be able to help you if you provide them details. Never hand over personal data or log in details if you haven’t initiated contact.
• Requests for verification codes, passwords or banking details: No delivery platform needs these to resolve an order issue. Never hand them over, especially if you didn’t initiate the contact.

4. Superannuation and investment scams

Investment scams are Australia’s top cause of financial loss, with scammers using fake emails and websites to dupe Aussies into handing over their cash. 

Typically, scammers will pose as a financial advisor and will convince people to move their super into a fake Self Managed Super Fund (SMSF) or invest money in cryptocurrency, promising high returns. 

If you receive an offer like this that feels too good to be true, it likely is. Always speak to a trusted financial advisor before making any decisions about your super or investments. 

The red flags

• Offers to unlock super early: You need to meet strict conditions to access your super before you retire or meet preservation age (60 years old for anyone born after June 30, 1964), so unsolicited emails offering early access are most likely fake.  
• AI-deepfakes of trusted figures: Scammers use artificial intelligence (AI) to create ‘deepfake’ videos of celebrities and finance experts to promote fake investment opportunities. Watch the person’s mouth carefully while they’re speaking and look for glitches where the movements of the person’s mouth and the audio don’t match up. 

5. Fake event and ticketing listings

Fake ticket listings for major concerts, sports events and festivals are profitable for scammers, who exploit the hype around these events to lure buyers away from official sites. They may use stolen or edited images as ‘proof’ to trick you into paying for a ticket that doesn’t exist.

The red flags:

• Pressure for non-secure payments: Be extremely wary if a seller pushes you to pay via cryptocurrency, gift cards, or a direct bank transfer. Only buy through official sellers like Ticketek or Ticketmaster, or authorised fan-to-fan marketplaces like Tixel.
• The hacked friend ruse: Scammers often hack legitimate social media accounts to post ticket offers to that person’s friends. If a friend is selling tickets on social media, contact them by some other means to confirm it’s really them.
• No physical address or council approval: If you are shopping for tickets to a local event found through social media, make sure there is a physical address listed and council approval. Vendors cannot sell tickets to an event if there is no approval. 

How can you protect yourself?

The idea of hackers and scammers can be scary, but there are effective ways to protect yourself and your assets.

• Never give personal information: If you receive a call from a telco, bank, or other service provider asking for personal details or login information, don’t hand it over.
• Screen calls and emails for scams: Most smartphones can screen calls or emails and identify if it is likely a scam. You may need to set this up through your device’s settings.
• Check the URL: Check shopping URLs via the ICANN Lookup tool. If the website claims to be an established brand but was only registered a month ago, it’s possibly a scam.
• No text verification, no deal: With the new SMS laws introduced on 1 July, scammers won’t be able to spoof a company name where the sender ID appears and messages will appear ‘unverified’.
• Check with the sender yourself: Contact whoever is claiming to have contacted you using a publicly listed phone number or official website, instead of the details provided in a message.

What can you do if you’ve been scammed?

If you’ve been scammed, there are steps you can take to potentially minimise the fallout:

• Contact your bank: This is the first step you should take if you believe there has been money lost in the scam. The faster you act, the more likely your bank is able to freeze your account or even reverse a transaction before the money is gone for good.
• Secure your personal information: Your data is often just as valuable as your money. Contact IDCARE, Australia’s national identity support service, to ensure your data is safe.
• Lock your accounts: To make it harder for scammers to grab your data, change passwords for any compromised accounts and turn on Two-Factor authentication.
• Report it to Scamwatch: Reporting what has happened to the ACCC via Scamwatch helps shut down and track scam networks so no one else falls victim.