How to protect yourself from scams

Even the most financially sophisticated people can be scammed. Take the case of Joanna, a 60-year-old tech executive who sits on a couple of ASX-listed company boards.

Joanna bought a car online. She had been looking for a while and a good deal popped up on a reputable website. In a series of convincing emails with the car's owner, it all sounded legitimate. It wasn't until Joanna sent the money to the owner's bank account that she realised she had been tricked. She had handed over her money, but she wasn't going to get a car.

In hindsight, Joanna says she was busy and in a hurry, which made her susceptible to being fleeced. But it is what happened after she paid her money that made it worse. All websites recommend you contact your bank if you have been scammed.

So, Joanna did just that to try to stop the transaction. But she couldn't get through to her bank or the car owner's bank. She sat on hold for long periods over four days, for what she estimates to be about eight hours, trying to resolve the issue, knowing it was unlikely the money was still in her account.

She emailed her bank but the scammer's bank didn't have an email address for sending through an alert. In fact, it was a subsidiary of her own bank. Then she tried to contact other key people at the bank through LinkedIn.

In the meantime, her research uncovered that the fraudster seemed to have scammed about 300 people around the world. He used the same scam, selling cars that didn't exist. Most likely he was part of an organised racket.

Joanna wrote to the banks: "Why would anyone have to try so hard to get help and to notify banks of a scam. We would like to try to recover the funds and stop activity on the scammer's side.

Their account at the bank, suggests the Know Your Customer is problematic."

Know Your Customer is a series of identification checks to prove a customer's identity. Joanna had wrongly assumed that the scammer had been thoroughly checked out and found to be a legitimate person.

When she did hear back from the bank, the email said, among other things: "Scams target people of all backgrounds, ages and income levels across Australia. There's no one group of people who are more likely to become a victim of a scam, all of us may be vulnerable to a scam at some time."

Joanna was sent some links to the Australian Competition and Consumer Commission (ACCC), the Australian Securities and Investments Commission (ASIC) and the Australian Financial Complaints Authority (AFCA), an independent external dispute resolution body approved by ASIC.

Joanna is just one of many Australians who have been scammed. In fact, research commissioned by the ACCC shows that scams are out of control, with 96% of the population exposed to a scam in the five years to 2021.

Half of the survey's respondents were contacted weekly or daily by scammers, a figure expected to rise given current cybersecurity concerns, says Delia Rickard, deputy chair of the ACCC. "We know scammers are relentlessly targeting Australians," she says.

Scamwatch, an ACCC service that has been running for two decades, says if you've lost money to a scam or given out your personal details to a scammer, you're unlikely to get your money back.

There are no laws for banks to refund any money to customers who have been scammed.

Being cheated is so devastating for some people, particularly with the rising cost of living, that the ACCC recommends consumers contact a counselling service or support service such as Lifeline, Beyond Blue or MensLine Australia to deal with the anxiety and depression that can arise from being scammed.

$2 billion and counting

The figures from Scamwatch represent only a fraction of frauds, with the ACCC estimating that only 13% of victims file a report.

Over the past 12 months, Australians have lost at least $2 billion to scams, according to Stephen Jones, the assistant federal treasurer and minister for financial services. He says the total cost of scams to the economy could have been around $30 billion last year alone - and it's getting worse.

In September and October 2022, Australia experienced its two worst cyberattacks so far within three weeks of each other: first Optus and then Medibank.

In October, National Australian Bank said its digital channels are subject to at least 50 million attempted cyberattacks a month. The Australian Taxation Office has recorded three million a month.

"Those scammers can use that data to pretend to be a business that you've already got a relationship with and use that to trick you into sending money or to steal your identity," says Alan Kirkland, CEO of Choice, the consumer organisation.

This threat is relentless, it is huge and it is only getting bigger, says Clare O'Neil, federal minister for home affairs and minister for cybersecurity.

Scamming is a big part of organised groups that sell stolen identity information to other criminal networks. When a person has their identity stolen, they may experience repeated victimisation. In this way, organised crime groups can use fraudulent identities to cause considerable financial loss.

Regulators and banks act

While individuals can take steps to disrupt and prevent scams, regulators need to escalate their efforts.

Australia's cybersecurity strategy was launched at the end of 2022. It is a collaboration between the Australian Federal Police and the Australian Signals Directorate in setting up a group of 100 specialists. In a separate move, the October budget allocated $12.6 million over four years to combat scams and online fraud. The ACCC has been tasked with setting up a national anti-scams centre to collaborate with other agencies to fight fraud.

Financial institutions such as Westpac have upped their fraud protection. It has 540 financial crime specialists to help detect scams, in a fraud prevention centre occupying eight floors.

Jones estimates losses from scams in 2023 will at least double to $4 billion. Particularly watch out for investment scams, payment redirection scams, and dating and romance scams. These were the three scams with the biggest losses in 2021, according to the ACCC, costing Australians $701 million, $227 million and $142 million, respectively.

"Cybercriminals have capitalised on the data breach by impersonating government departments and businesses to carry out identity theft and remote access scams," says Rickard.

Threats to people's lives, or claims they will be arrested, are common, with 32,000 cases reported. Phishing and identity theft scams are even more widespread, with 93,000 reports. False billing and online shopping scams are also common, with 21,000 and 20,000 complaints, respectively.

Increased education is one way to avoid being scammed. "We want Australians to know what to look for, so they don't get caught out," says Rickard.

You can subscribe to the ACCC's alert emails through its website so you are up to date with the sorts of scams currently circulating.

While reporting your case to Scamwatch isn't going to retrieve your money, it will help regulators and get the message out to other consumers.

Vulnerable targets

While everyone is exposed to scams, vulnerable people  are deliberately targeted and are reporting high and increasing losses. Indigenous Australians, the aged, people from culturally and linguistically diverse communities and people with a disability are losing far more than ever before.

Older Australians, for example, are seen by scammers as less internet and computer savvy. They are targeted in rebate and inheritance scams as well as lottery windfalls. If older people are looking for a romantic partner through dating websites, apps or social media, the scammers pretend to be prospective companions, appealing to people's emotional triggers.

Older people are also susceptible to promises of quick and guaranteed returns from investments with little risk.

One of the most alarming scams involves cryptocurrency, which is becoming the preferred payment method across all types of scams as it is hard to trace.

Half of scams are through phone calls and another 23% are through text messages, while 14% are emails.

Watch out for the red flags

There are some simple red flags that can help protect you from scammers, as well as precautions you can take.

• Dangerous links 

Be on the lookout for anyone who sends you emails and messages with links in them. "Just don't click on those links," says Delia Rickard, deputy chair of the ACCC. "Anyone who's asking for your personal details, your banking details, they're going to be a scammer. Stay well away from them."

Be suspicious of requests for money, even if they sound or look official. The ACCC says government departments will never contact you asking for money upfront in order to claim a rebate.

"If somebody wants remote access to your computer, that's another surefire sign that it's a scam," says Rickard.

• Think before you act  

It is best to take your time before giving money or personal information to anyone. Scammers will offer to help you or ask you to verify who you are.

They will pretend to be from organisations you know and trust, such as a business you deal with, the police, a government or fraud service.

• If necessary, seek advice  

Ask yourself if the message or call could be fake. If you are unsure, ask a trusted friend or family member what they would do.

Only contact businesses or governments using contact information from their official website or through their secure apps. If you're in doubt, say no, hang up or delete.

• Spread the word

Act quickly if something feels wrong. Contact your bank immediately if you lose money or personal information, or if you notice unusual activity on your cards or accounts. Seek help from organisations like IDCARE and report online crime to ReportCyber. Help others by reporting scams to Scamwatch.

• Build extra security

Scamwatch recommends making your accounts as safe as your home. Set up extra steps on your accounts to stop people getting in. Add more steps to show who you are when you log into your online services and apps.

This is called multi-factor authentication. It could be a code sent to your phone, a token or secret question. Your face or fingerprint or voice can also be the key to let you into your accounts. Ask your banks and service providers how to add more checks so no one can pretend to be you.  And don't forget to tell them if you have been caught in a data breach.

Warning bells should be ringing if you are asked for an unusual payment method, including preloaded debit cards, gift cards, iTunes cards or virtual currency such as Bitcoin.
Verify the identity of the person by calling the relevant organisation directly. Find it through an independent source such as an online search. Don't use the contact details provided in a message sent to you.

Always do your own research before you invest money and check that the company or scheme is licensed on ASIC's Moneysmart website. Be wary of people you meet on social media or online dating sites who after just a few contacts profess strong feelings for you and try to move you away from the site and communicate on chat or email.

Be suspicious of unexpected emails or letters advising you how to claim an inheritance or competition prize. Never give out your personal details and seek advice from an independent professional.

• Freeze your credit details

When Michael had his identity stolen, the scammer applied for credit cards from a range of financial institutions in his name and then maxed them out. One way to stop scammers borrowing money in your name is to go to the credit agencies and put a ban on them disclosing any information.

There are three credit reporting agencies operating in Australia: Equifax, illion and Experian. A freeze on the agency disclosing any information should make it impossible for a bank to issue a new card in your name, for example. But it won't impact your existing credit card or loan arrangements.

For more information, refer to idcare.org. It is an online process, and you are asked to give a reason. In the current climate, with so many records being compromised, almost everyone is genuinely concerned that their identity may have been stolen.

Each agency will ask if you want them to let the other two know about your ban. Alternatively, it is reasonably straightforward to deal with each agency independently. At first the ban is imposed for a few weeks. Once in place you can apply to extend it for a year. For a couple, you each need to go through the process to be safe.

Who pays the highest price

Men lose twice as much money to investment scams as women. In 2021, men reported losing $118.4 million and women $58.1 million.

Losses increase with age. People aged 65 and over made the most reports about being scammed: some 46,286 scams and $82 million lost.

Indigenous Australians reported 4958 scams, with $4.8 million lost. Younger indigenous people lost more money than older people.

People from culturally and linguistically diverse (CALD) communities made 14,060 reports and lost $42 million, which was an 88% increase compared to 2020. The median loss for people from CALD communities was higher than for the overall median - $1200 versus $845. Scams over mobile apps resulted in the most losses for CALD communities largely due to the "Hope Business" app, an investment scam that promised users that they could earn more money if they transferred their money onto an app and completed certain tasks. Often as soon as they deposited their money, it was withdrawn by the scammers.

People with a disability reported 15,387 scams, with $19.6 million in losses. This was almost double the reports and losses reported in 2020.

Get stories like this in our newsletters.