Families often treat the phone’s display as evidence. The name looks like the bank. The number looks familiar. The text lands in the same conversation as last week’s genuine alert. Australia’s cyber security agency is clear that this is not enough.
The Australian Cyber Security Centre (ACSC) says scammers use authority, urgency, emotion, scarcity and current events. They pretend to be from trusted places such as banks or government, tell you to act quickly, and push you toward a link, a callback number, or a one-time code. The ACSC advice is to go to a trusted source: visit the official website, log in to your own account, or call a verified phone number. Do not use the links or contact details in the message.
Why the same text thread can still be fake
On its Learn about scams page, the ACSC describes a household banking scam that started with a rideshare text asking someone to update card details. Later, a text that appeared to be from the bank warned that scammers were trying to take money and told him to call the bank’s security team. Because the warning appeared in the same thread as other bank messages, he had no reason to doubt it. The ACSC notes he was unaware that scammers could disguise their number as a real business. He was then told to open a new account and move money “to protect it”. Days later, most of the savings were gone.
That is the point for a family, not a rare edge case. A familiar thread can be borrowed. A displayed number can be disguised. A calm “security officer” can still be the person who created the emergency.
eSafety Commissioner guidance on online scams makes the same household point in another form: scammers impersonate banks, government agencies and delivery services, including Australia Post, and use emails, texts, calls and fake websites. Familiar branding is a costume, not a credential.
A two-minute household check
- Stop talking. Hang up, leave the chat, or lock the phone. You do not owe the caller a debate.
- Do not use anything in the message. That includes the phone number, the “secure” link, the QR code, and the person who says they will stay on the line while you “check”.
- Open a path you already trust. Use the number on the back of the card, the app you installed yourself, or the organisation’s official website typed by you — not a search result that appeared after the scare.
- Ask one question: “Did you just contact me?” If the answer is no, treat the first contact as hostile even if it sounded helpful.
- If money, a password or a one-time code already left the house, follow the recovery steps below before you tidy up the story.
The ACSC also says banks and government agencies will not ask for your password. If they do, treat it as a scam. Warning signs it lists include unverified messages, misspelled addresses, “Dear customer” instead of your name, messy formatting, a web address that is slightly wrong (for example .com instead of .gov), and unexpected links or files.
If something already happened
The ACSC Recover from scams page splits the next hour by what is at risk.
- If money moved: report the transaction to your bank or financial institution immediately, then submit a report to the ACSC and to the platform that delivered the contact.
- If personal information may have been stolen: contact the financial institution to secure accounts, change passwords on key personal, social and financial accounts, contact services that use your identity documents such as the Australian Taxation Office or Services Australia, and consider a credit-reporting check through a service such as IDCARE.
- If you did not hand over details or money: still report it, change passwords where the contact touched an account, and watch for follow-up scams that pretend to be the bank “helping you recover”.
Report online scams to the National Anti-Scam Centre through Scamwatch. Report cyber incidents through the ACSC’s report page. If a scammer is impersonating an Australian business, the ACSC also points households to the fair-trading body in their state or territory.
What this is not asking you to do
This is not a demand to distrust every bank SMS forever. Genuine alerts exist. The habit is narrower: do not complete the requested action along the path the unexpected message provided. Look the organisation up yourself, then decide.
It is also not a reason to shame anyone who nearly fell for it. The ACSC case study exists because the thread looked real. Pressure is the product. Pausing is the defence.
If your household wants one calm system for scams, account protection, safer devices and recovery, The Family Cyber Safety Handbook brings those habits together in plain language. For this issue, the most important habit is still the simplest one: hang up, then look it up yourself.
The Handbook is also available on Amazon.
Common questions
If the text is in my real bank conversation, isn’t that proof?
No. The ACSC’s published case study is exactly this: a fake bank warning appearing in the same thread as other bank messages after scammers disguised their number.
Can I call the number in the message if I stay cautious?
Do not. The ACSC says to use a verified number from a trusted source, not contact details supplied in the message.
What if the caller says hanging up will let a fraud through?
That urgency is one of the tricks the ACSC lists. End the call. Check through the number on your card or in the official app.