Phishing emails are fake messages built to look like they come from an official source or someone you know. You can usually spot one by checking four things: who really sent it, where its links go, what it asks you to do, and how much pressure it puts on you. If an email wants your password, payment or ID, or rushes you to act, don’t use its links. Check through the official app or website instead.
In Australia, these scams often borrow trusted names such as Australia Post, the ATO, myGov and the major banks. They’re also harder to catch than they used to be, because scammers now write clean, convincing messages that often lack the obvious typos of the past. This guide covers seven signs to look for, common Australian examples, and what to do whether you’ve only received a suspicious email or you’ve already clicked.
What is a phishing email?
A phishing email is a message that pretends to come from a trusted organisation or person, such as a bank, Australia Post, the ATO or your boss, to trick you into giving away information, money or access. The goal is usually one of three things: stealing your login details, getting you to pay, or getting you to install malware.
Phishing is a form of social engineering, which means it targets people, not software. The same tricks now appear in other channels too:
- Smishing: Phishing by SMS, such as a fake toll or parcel text.
- Quishing: Phishing through a QR code that leads to a fake website.
- Vishing: Phishing by phone call.
- Spear phishing: A targeted email written for a specific person or business.
How to spot a phishing email: 7 signs
No single sign proves an email is fake, and modern scam emails can look polished. Look for a combination, and use this quick test: Sender, Link, Ask, Pressure. If two or more look wrong, stop.
1. The sender’s address doesn’t match the organisation
Scammers can set any display name they like, so an email can say “Commonwealth Bank” while the real address behind it belongs to someone else. Always check the full address, not just the name.
Watch for:
- Look-alike domains with extra words, swapped letters or added numbers
- A sender address that doesn’t match the name in the signature
- A free email account (such as Gmail) claiming to be a company
- Australian businesses that normally use a .au address suddenly writing from something else
A .au ending isn’t proof an email is real, and a missing one doesn’t prove it’s fake, but a mismatch between who the email claims to be and where it came from is a strong warning.
2. The link goes somewhere unexpected
On a computer, hover over a link to preview the real destination. On a phone, press and hold the link. If the address doesn’t match the organisation, or it’s a shortened link you can’t read, don’t open it.
Don’t rely on the padlock or “https” alone. Scam websites can use HTTPS too. Fake login pages are designed to look exactly like the real thing, so the safest habit is to open the official app or type the website address yourself.
3. It asks for sensitive information or payment
Legitimate organisations don’t ask you to send passwords, PINs, card numbers or identity documents by email. Be suspicious of any message that asks you to “confirm your details”, “update your payment method” or pay a small fee to release a parcel or refund.
4. It creates urgency, fear or a too-good-to-be-true reward
Phishing works by rushing you. Common pressure lines include:
- Your account will be closed or suspended
- We’ve detected suspicious activity or a login attempt
- You have an unpaid bill, fine or toll
- You’re owed a refund, prize or voucher
If a message makes you feel panicked or excited, pause. That reaction is exactly what the scammer wants.
5. There’s an unexpected attachment or a request to change settings
Be wary of invoices, “secure documents” or ZIP and HTML files you weren’t expecting, even from someone you know, because their account may have been hijacked. Never enable macros, install an app or change security settings because an email tells you to.
6. The greeting or details are generic or slightly off
Greetings like “Dear customer” or no name at all can be a clue, but they’re not conclusive, because some scam emails use your real name from a data leak. Check whether the email mentions details that match your actual account, order or relationship with the sender.
7. Something feels off (but don’t rely on typos)
Poor spelling and grammar used to be a giveaway. Today, scammers can use AI tools and templates to produce clean, professional messages. Treat typos as a bonus warning, not a safety test. Trust your instincts if the timing, tone or request doesn’t fit how that organisation normally contacts you.
Quick Comparison: Genuine Email vs Phishing Email
| Check | Genuine email | Phishing email |
| Sender | Real address from the organisation’s domain | Look-alike domain or mismatched address |
| Links | Lead to the official site | Lead to a different or disguised address |
| Request | Directs you to sign in through the app or site | Asks you to send or confirm details by email or link |
| Tone | Calm, specific to your account | Urgent, threatening or too good to be true |
| Attachments | Expected and explained | Unexpected or asks you to enable something |
Common phishing emails in Australia
Scammers copy the brands Australians already deal with every day. The safest response to all of these is the same: don’t use the link or phone number in the message. Go to the official app, website or the number on your card or bill.
| Scam type | What it claims | What to check |
| Parcel or delivery (Australia Post, DHL) | A parcel is held or needs a redelivery fee | Look up the tracking number on the carrier’s official site |
| Government or tax (ATO, myGov) | A refund is waiting or your account has a problem | Sign in through the official site or app, not the email |
| Bank security alert | Your account is locked or a payment is pending | Call the number on your card or use your banking app |
| Toll road or utility bill | You have an unpaid toll or overdue bill | Check your account with the toll operator or provider directly |
| Real estate or rental | A payment, document or bond request from an “agent” | Contact the agency using details from its official website |
| Payment and streaming services (PayPal, Netflix) | A payment failed or your account is on hold | Sign in directly and check your account status |
| Fake invoice or boss request | An urgent payment or bank detail change | Confirm by phone with the person or supplier |
What to do if you get a phishing email
- Don’t click, reply or open attachments. Replying confirms your address is active.
- Verify independently. Open the organisation’s official app or website, or call a number you already trust, and check whether there’s a real issue.
- Report it. Report scam emails to Scamwatch, run by the ACCC’s National Anti-Scam Centre. You can also use the “report phishing” option in your email app, and tell the organisation being impersonated.
- Delete it, and block the sender. If it landed on a work account, report it to your IT or security team first.
What to do if you’ve clicked a link or shared details
Acting quickly limits the damage. Match your situation below.
| What happened | What to do |
| You only clicked a link | Close the page, don’t enter anything, and run a security scan on your device |
| You entered a password | Change it right away from a device you trust, change it anywhere else you reused it, and turn on multi-factor authentication |
| You shared card or bank details | Contact your bank or card provider immediately using the number on your card and ask them to secure your account |
| You shared ID details (licence, passport, Medicare) | Contact IDCARE, Australia’s national identity and cyber support service, and ask about protecting your identity |
| You opened an attachment | Disconnect from the internet, run a full security scan, and get IT help if it’s a work device |
| It happened on a work account or device | Tell your IT or security team straight away |
If you lost money or personal information, also report it to the Australian Cyber Security Centre through ReportCyber. Keep the email, screenshots and any transaction details as evidence.
How to protect yourself from phishing
- Turn on multi-factor authentication on email, banking and social accounts. Where available, use passkeys, which are much harder to phish than passwords. Never read out or forward a one-time code.
- Use a password manager. It won’t autofill your login on a fake website, which is a useful warning.
- Keep devices and apps updated, and use reputable security software.
- Slow down. Treat unexpected messages with urgency as suspect by default.
- Use official channels. Bookmark your bank and government sites, and use official apps for sensitive tasks.
Conclusion
Spotting a phishing email comes down to slowing down and checking before you act. Use the Sender, Link, Ask, Pressure test, and remember that no single sign is proof. A mismatched address, an unexpected link, a request for sensitive details or a demand to act now should each make you stop.
If something looks wrong, don’t reply or click. Go to the official app or website, report the message to Scamwatch, and delete it. If you’ve already clicked or shared details, change your passwords, call your bank on a number you trust, and report it to ReportCyber. Acting quickly limits the damage, and reporting helps protect other people
Frequently asked questions
Can I get phished just by opening an email?
Usually the danger comes from what you do next, such as clicking a link, opening an attachment or replying with details. Simply viewing an email is far less risky, but it’s still best not to open suspicious messages, and to turn off automatic image loading if your email app allows it.
Should I report a phishing email if I didn’t click it?
Yes. Reports help Scamwatch, email providers and the impersonated organisations warn others and block the scam. It takes a minute and doesn’t require you to have lost anything.
How can I check whether a link is safe?
Hover over it (or press and hold on mobile) to see the real address, and ask whether it matches the organisation. When in doubt, don’t use the link at all. Open the official app or type the website address yourself.
Are phishing emails always badly written?
No. Many are well written and use real logos and branding. Don’t rely on spelling errors. Look at the sender, the link, what’s being asked and the pressure to act.
What’s the difference between phishing and spam?
Spam is unwanted bulk email, usually advertising. Phishing is a scam designed to steal information, money or access. Some spam is also phishing, so treat unexpected links and requests with caution either way.
