Online Scams in Australia: Spot Them, Stop Them, Report Them

A text says your parcel is held up. An email says your bank account is locked. A caller says your computer has a virus. Scams arrive in many forms, and they work because they feel urgent and real. This guide covers how much Australians are losing, the warning signs, the official Stop. Check. Protect. steps from Scamwatch, and what to do if you think you've been scammed. Every figure comes from the National Anti-Scam Centre, Scamwatch, Moneysmart or the OAIC, checked on 30 October 2026.

SecureCheck.com.au is an independent guide operated by Dominet BV. This page is general information, not legal or technical advice for your situation. We don't sell VPNs or security software. No link on this site is an affiliate link right now. We may earn a commission from VPN or security companies in future when a reader buys through a link on this site. If that happens we'll label those links and explain it in our affiliate disclosure, and it won't change the facts we publish. Facts were checked on official and company websites on 30 October 2026. Read our general information notice.

How much Australians lose to scams

The National Anti-Scam Centre's Targeting Scams Report 2025, published in March 2026, found:

Losses rose 7.8% on 2024 even though the number of reports fell by 2.3%. People aged 65 and over accounted for 26.5% of losses. The report says losses were still 29.7% below the 2022 peak of $3.1 billion.

The same report notes that the Scams Prevention Framework Act was passed in February 2025.

Moneysmart, run by ASIC, says ASIC removed 11,964 phishing and investment scam websites in 2025, an average of 32 a day, and more than 1,100 scam ads.

Warning signs

Scams change, but they tend to share a few features. Be wary when:

• You're rushed. Scamwatch says scammers create a sense of urgency so you act before you think.
• You're asked to pay in an unusual way. Moneysmart lists requests to pay by gift card or cryptocurrency as a warning sign.
• The contact came to you. A message, call or ad you didn't ask for, especially with a link or a request for details.
• It's too good to be true. A big return on an investment, a prize you didn't enter, or a bargain far below the usual price.
• You're asked to keep it secret or not to check with anyone.
• The details are a little off. A sender address, phone number or website that's close to a real one but not quite right.

None of these proves a scam on its own. Together, they're a reason to stop. A real bank, government agency or delivery company can wait while you check. If the person on the other end won't let you hang up and call back, treat that as an answer in itself.

Stop. Check. Protect.

Scamwatch sums up its advice in three steps.

Stop

Take a moment before you give money or personal information to anyone. Scammers create urgency. It's fine to say no, hang up or delete a suspicious message.

Check

Make sure the person or organisation is real. Contact them using details you find yourself on their official website or app, not the details in the message. Research investment offers through official sources such as ASIC. Get a second opinion from someone you trust.

Protect

Act quickly if something feels wrong:

• Contact your bank straight away if money was taken or you shared financial details.
• Contact IDCARE for support with identity recovery.
• Report the scam to Scamwatch.
• Report to police through cyber.gov.au.
• Change your passwords.
• Watch your bank statements and credit reports.
• Tell the organisation that was impersonated, and report the scam to the platform where it happened.

If you think you've been scammed

Speed matters most when money has left your account. A practical order:

1. Call your bank using the number on your card or the bank's official website or app. Tell them what happened and ask what they can do.
2. Secure your accounts. Change passwords, starting with email, because email is often how other accounts are reset. Turn on multi-factor authentication.
3. Get identity support from IDCARE if you shared identity documents or personal details.
4. Report it to Scamwatch, and to police through cyber.gov.au.
5. Keep records of messages, account numbers, dates and amounts. They help your bank and police.
6. Be wary of anyone offering to get your money back, especially if they contact you first or ask for a fee. Check them the same way: through official details you find yourself.

You're not alone if this happens. Hundreds of thousands of reports each year show how common it is, and reporting helps others avoid the same scam.

Data breaches and scams

When a company you deal with has a data breach, scammers sometimes use the stolen details to make their messages more convincing.

Under the Notifiable Data Breaches scheme, an organisation or agency covered by the Privacy Act must tell affected people and the OAIC when a breach is likely to cause serious harm. The notice must recommend steps people should take. Examples the OAIC gives include a lost or stolen device holding personal information, a hacked database, and personal information sent to the wrong person.

If you receive a breach notice, follow its steps. Then be extra careful with messages that mention the breach, because scammers can pose as the company. Contact the company through its official website or app, not through a link in a message.

Can a VPN protect you from scams?

Not really. A VPN encrypts your connection and can hide your activity from others on the same network. The Australian Cyber Security Centre's remote working tips are clear that a VPN won't protect you from malware, phishing or flaws in your software.

Most scams work by persuading you to do something: click a link, pay an invoice, share a code. A VPN can't stop that. The steps that help more are:

• Multi-factor authentication on email, banking and social media, which Moneysmart lists among its tips.
• Slowing down when a message is urgent.
• Checking contacts yourself using official details.
• Keeping devices updated.

A VPN is still useful on public Wi-Fi. Our public Wi-Fi guide and what a VPN is explain where it fits.

A ten-minute account check

You don't need special software to make yourself a harder target. Set aside ten minutes and work through this list:

• Email first. Your email account is often the key to resetting everything else. Give it a long, unique password and turn on multi-factor authentication.
• Banking and super. Turn on multi-factor authentication and any transaction alerts your bank's app offers, so you notice an unexpected payment quickly.
• Social media. Turn on multi-factor authentication and check which devices are signed in. Sign out any you don't recognise.
• Passwords you've reused. Change any password you use on more than one site, starting with the accounts that hold money or personal details.
• Updates. Install pending updates on your phone, computer and browser.
• Saved contacts. Save your bank's official number in your phone from its website or card, so you have a trusted number ready if a message ever worries you.

Repeat the check every few months, or after any breach notice.

Talking to family about scams

People aged 65 and over accounted for 26.5% of reported losses in 2025. A short, calm conversation with older relatives can help. Share the Stop. Check. Protect. steps, agree that it's always fine to hang up and call back on a known number, and offer to be the second opinion Scamwatch suggests. Make it easy to ask without feeling embarrassed.

Frequently asked questions

How much did Australians lose to scams in 2025?

The National Anti-Scam Centre reported $2.18 billion in losses in 2025, up 7.8% on $2.03 billion in 2024.

Where do I report a scam in Australia?

Scamwatch takes scam reports. Scamwatch also says to report to police through cyber.gov.au and to tell the organisation that was impersonated.

What should I do first if I've been scammed?

Contact your bank straight away if money was taken or you shared financial details. Then change your passwords and report the scam.

Is paying by gift card a sign of a scam?

Moneysmart lists requests to pay by gift card or cryptocurrency as a warning sign.

Does a VPN stop phishing?

No. The ACSC says a VPN won't protect you from malware, phishing or software flaws.

What is IDCARE?

Scamwatch points people to IDCARE for support with recovering from identity theft or misuse.