Scam emails

How to spot a scam email before it costs you.

Most scam emails want one of four things: a payment, a password, a file opened or a quick reply. Learn to spot the ask, check it somewhere other than the email, and you stop nearly all of them. Here is what to look for, the Australian versions doing the rounds, and what to do if you already clicked.

Loss figures from the ACCC's 2025 scam data, released 30 March 2026.

Get help with a suspicious email Check an email now 07 3114 2808

Ten warning signs
Australian examples
If you already clicked

Reviewed by Blake Bath, General Manager, on 30 October 2026.

A clinic receptionist frowns at an email on her screen, hand resting on the mouse, as a patient waits in the reception area behind her. — **The one rule**Never confirm a request using anything in the email. Use a number or website you already had.

What scams want

Four things a scam email asks you to do.

Spot the ask first. The disguise changes, the ask does not.

Pay, or pay somewhere new

A fake invoice, or a real supplier's invoice with new bank details. Australians reported A$166.8 million lost to payment redirection scams in 2025.

New bank details
Urgent due date
Looks like a real supplier

Before you click

Three checks that take ten seconds.

Check the address, not the nameThe display name can say anything. Look at the address after the @. A lookalike might add a letter, a hyphen or a different ending, such as .com instead of .gov.au.
Hover, do not clickOn a computer, rest the mouse on a link and check the real website it goes to. On a phone, do not open link previews. Go to the app or website yourself instead.
Check the request somewhere elseLog in to the real website yourself or ring a number you already had. One real link in an email does not make the other links in it safe.

Doing the rounds

Australian organisations scammers pretend to be.

ASICFake renewal and fee notices. ASIC also warns about real companies sending official-looking renewal notices that are not from ASIC. Check what is due by logging in to ASIC yourself.
The ATORefunds waiting, debts overdue, accounts suspended. Log in through myGov rather than following a link.
Australia Post and couriersA small redelivery fee to capture card details.
myGov and Services AustraliaAccount problems or payments waiting, with a link to a fake myGov sign-in page.
Your own suppliersAn invoice with new bank details, sometimes sent from the supplier's real, hacked mailbox.
Microsoft 365A shared document, voicemail or password expiry notice that leads to a fake sign-in page.

If you already clicked

What to do if you already clicked.

Tell IT now, and be exactClicked only, entered a password, approved an MFA prompt, opened a file or paid. Each needs a different response.
If you entered a passwordChange it from a different device, and have IT sign you out everywhere and check for new mailbox rules.
If you opened a fileDisconnect the computer from the network and leave it on for IT to check.
If you paidCall your bank straight away on a number you trust. Some payments can be recalled if you move quickly.
Report itReport it internally, then to Scamwatch, and through ReportCyber if money or data was lost.

For owners

Do not rely on staff catching every one.

Training helps, but the defences that matter most do not depend on someone spotting a scam on a busy afternoon. A rule that every bank detail change is confirmed by phone stops payment redirection. Phishing-resistant MFA, such as passkeys, stops most stolen passwords being useful. Email filtering and SPF, DKIM and DMARC on your domain cut what reaches the inbox and stop scammers sending as you.

Email takeover is the most reported cybercrime against Australian businesses in ASD's latest figures, and business email compromise with money lost is next. Make it easy to report: a Report button in Outlook and a team that thanks people for false alarms.

Layers that work

Five layers that stop scam emails.

Step 1Filtering
Catch most scams before they reach anyone.
Step 2Domain protection
SPF, DKIM and DMARC so scammers cannot send as you.
Step 3Strong sign-in
MFA everywhere, phishing-resistant for admins and finance.
Step 4Payment rule
Every bank detail change confirmed by phone.
Step 5Short training
Real examples, a Report button and no blame.

Related guides

Spotting them is step one. Stopping them is the rest.

The controls that sit behind good judgement.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about scam emails.

How can I tell if an email is a scam?

Look at what it wants you to do. Scam emails nearly always push you to pay, sign in, open a file or change bank details, usually in a hurry. Check the address after the @ sign, hover over links without clicking, and confirm any request through the organisation's own website or a phone number you already had.

The email came from a real supplier's address. Can I trust it?

Not for payments. Attackers take over real mailboxes and then send fake invoices from them. That is why any change of bank details is confirmed by phone on a number you already had, never one from the email.

I clicked the link. What now?

Tell IT straight away and say exactly what happened: clicked only, entered a password, approved an MFA prompt, opened a file or paid. If you entered a password, it needs changing and your sessions need signing out. If money went, call your bank now.

Is an email from @asic.gov.au always genuine?

The right domain is a good sign, not proof. ASIC says its emails come from @asic.gov.au, and that other companies send official-looking renewal notices that are not from ASIC. Check what is due by logging in to ASIC yourself.

Where do I report a scam email?

Inside the business, use Outlook's Report button or forward it to IT. You can also report it to Scamwatch, and report cybercrime with losses through ReportCyber at cyber.gov.au.

Next step