How to spot phishing and scam emails

Last updated: 4 November 2026

A paper envelope with a postage stamp and a round tag showing an @ symbol.

Phishing is when scammers send fake emails or texts, often pretending to be a company or government agency you know, to get your details or your money. Here's what to look for and what to do.

1. What they're after

The Australian Cyber Security Centre (ACSC) says phishing messages try to steal things like online banking logins, card details and passwords. They may also ask you to scan a QR code to link a device, or to share a PIN or verification code. Some are highly targeted at one person, which the ACSC calls spear-phishing.

2. Red flags

It's pretending to be someone you trust. A bank, a delivery company, a government department or your boss.
It wants you to log in through a link. The ACSC advises not clicking account sign-in links received by SMS or email.
Pressure to act quickly or urgently. The ACSC lists this as a common warning sign.
It asks for a code. No genuine organisation needs your one-time code or an approval for a sign-in you didn't start.
The sender doesn't quite match. The display name can say anything. Check the actual email address. The ACSC warns about email addresses that look wrong or slightly misspelled.
Requests to change bank details or make an unusual payment. Treat these as suspicious until you've checked another way.
A QR code asking you to link a device or sign in.

None of these is proof on its own, and some scams look very polished. If something feels off, check before you act.

3. Check it the safe way

Don't use the links, phone numbers or reply address in the message. Go to the organisation's official website yourself, or use its official app, and contact it from there. That's the ACSC's advice too.

4. If you haven't clicked

Don't reply, click or open attachments.
Report it to Scamwatch, run by the National Anti-Scam Centre.
Tell your email provider (or your phone company, for a text) so it can help block similar messages.
At work, tell your IT person.

5. If you clicked, paid or shared details

The ACSC suggests these steps: - Lost money? Contact your bank or card provider straight away. - Shared details? Change the passwords on any affected accounts, starting with email and banking, and anywhere you reused that password. - Report it to the ACSC through ReportCyber. Reports go to the relevant police. - Contact other services that use your identity documents, such as the ATO or Services Australia, if those details were shared.

IDCARE is Australia's national identity and cyber support service. It helps people who've had their identity stolen or been scammed, and lists its helpline and web request form on its own site.

6. Make yourself a harder target

Turn on two-factor authentication for your important accounts (see our guide), use a different password for each one, and keep your phone and computer updated.

The short version

Phishing pretends to be someone you trust to get your details or money.
Never log in through a link in a message. Go to the official site yourself.
Never share a one-time code.
Report scams to Scamwatch. If you've lost money, call your bank first, then use ReportCyber.
IDCARE can help if your identity has been stolen.

We don't recommend any paid products in this guide. If you're shown a security service, check the provider's own site for current prices and plans.