Got a text or email you're not sure about? How to check if it's a scam

If we sent you this link, you’ve had a text, an email or a website you’re not sure about, and you were right to stop. Don’t tap the link, ring the number or reply until you’ve checked it the way this page shows. If you’ve already clicked, typed in a password or paid, go straight to what to do if you clicked a link or paid, and once the bank knows, we can have your phone or computer checked at home after a scam message.

This page is about messages and websites. A phone call from someone saying they’re from Telstra or NBN is its own trick, and how the fake technician call works covers it.

How can you tell if a message is a scam?

A scam message wants you to act before you think: tap a link, ring a number, log in, pay or send your details, because something is wrong or about to go wrong. Scamwatch, the government’s scam service run by the ACCC, lists the usual stories: a hacked account, fraud, a payment or delivery problem, or a fine or a cut-off on the way.

Any one of these signs is reason enough to stop and check. Each is on Scamwatch’s pages or those of the ACMA, the government’s communications regulator.

Warning signs in a text, email or website

What you see	Why it's a warning sign
Act now, today, or within hours	Scamwatch lists urgency as a sign, and the ACMA lists pressure to act quickly
A link to tap, or a number to ring	Scamwatch's advice is not to click links in messages, and not to reply to a number the message gives you
A request to log in or confirm your details	Scamwatch lists it. Never share a password or a one-time code with anyone who contacts you out of the blue
An odd way to pay: a new bank account, PayID, gift cards or cryptocurrency	The ACMA lists unusual payment requests like these
"Dear customer" instead of your name	Scamwatch lists an email or text that doesn't use your proper name
A sender address that doesn't match the company	Scamwatch lists it, including a big company or government agency writing from a free email address such as Gmail or Yahoo
A website address slightly different to normal	Scamwatch lists it, and says to watch for small changes in a sender's name or number, such as extra dots or numbers
An unknown number saying it's your son, daughter or a friend on a new phone	Scamwatch and the ACMA both list it, usually followed by a request for money
"Unverified" where the sender's name should be	The ACMA says an Unverified text may be a scam

A logo proves nothing: Scamwatch says scam messages often copy official logos, branding and language. Spelling doesn’t settle it either. IDCARE, the national identity and cyber support service, warns that you can no longer rely on spelling or grammar mistakes, or on a different number than usual, to spot a fake text.

What do scam texts and emails look like? Four examples

The four below are examples we made up from the warning signs above. They’re not real messages, and they name no company. Tap one to see its warning signs marked, then what to do.

Examples we made up from the warning signs Scamwatch, the ACMA and IDCARE list. Not real messages.

A delivery text A toll text An account locked email A Hi Mum message

A delivery text

Example

Unverified¹

Your parcel couldn't be delivered. Pay the redelivery fee³ today² to rebook: link⁴

1. Sign: the sender's name isn't registered. The ACMA says an Unverified text may be a scam.
2. Sign: it rushes you. Scamwatch lists pressure to act now.
3. Sign: a payment for a delivery. Australia Post says it doesn't send texts or emails asking for card or personal details.
4. This is what they want you to tap. Scamwatch's advice: don't click links in messages.

What to do

Don't tap it. Check the delivery in the courier's own app or website. Then report the text to Scamwatch and delete it.

A toll text

Example

a mobile number¹

You have an unpaid toll. Pay now³ to avoid a fine²: link⁴

1. Sign: a plain mobile number. The ACMA says the sender register doesn't cover these, so treat unknown numbers with caution.
2. Sign: a threatened fine, a warning sign Scamwatch lists.
3. Sign: Scamwatch says real toll providers won't demand urgent payment through a text message link.
4. This is what they want you to tap. Linkt, for one, says it doesn't ask for payment details through links in texts.

What to do

Don't tap it. Log in to your toll account in its app, or type its web address yourself, and check there.

An account locked email

Example

Account Security, from a free email address¹

Dear Customer²,

We've locked your account after unusual activity. Log in within 24 hours³ to unlock it.

Log in now⁴

1. Sign: a company writing from a free email address. Scamwatch lists this.
2. Sign: it doesn't use your name, a sign Scamwatch lists.
3. Sign: it rushes you.
4. This is what they want you to click. CommBank, for one, says it won't ask you to log on using a link from an email or text.

What to do

Don't click it. Open the bank's or company's app, or type its address yourself, and look there.

A Hi Mum message

Example

a mobile number, in a messaging app¹

Hi Mum, it's me². I've broken my phone and this is my new number³. Can you pay a bill for me today?⁴

1. Sign: an unknown number saying it's family, a sign Scamwatch lists.
2. Sign: Scamwatch says some of these messages simply say it's me.
3. This is the number they want you to trust. Ring the number already saved in your phone instead.
4. Sign: a sudden request for money. Scamwatch and the ACMA both list it.

What to do

Don't reply to the new number. Ring them on the number you already have, or ask a question only they would know. Never send money until you're sure who it's going to.

Four common scam messages, and what to do instead

The example	What to do instead
A delivery text: your parcel couldn't be delivered, pay a fee at a link	Check the delivery in the courier's own app or website
A toll text: you have an unpaid toll, pay now to avoid a fine	Log in to your toll account in its app, or type its address yourself
An email: your account is locked, log in within 24 hours	Open the company's app, or type its address yourself, and look there
A "Hi Mum" message: I've broken my phone, this is my new number, can you pay a bill?	Ring them on the number already saved in your phone

If your account really is locked, the official way back into an Apple or Microsoft account starts on the company’s own site, never from a link in a message.

How do you check a message without clicking it?

Go around the message, never through it. Find the company yourself, in its own app, by typing its web address, or on a phone number from its website, your card or your bill, and see whether the message is true there.

1. 1

   Don't tap, reply or ring

   Telstra's scam advice is not to reply to a text from a number you can't identify, even to unsubscribe.

2. 2

   Open the app, or type the address yourself

   If it says it's from your bank, the post, the tax office or a toll road, open that company's own app, or type its web address into the browser, and log in there. myGov, for one, says it only asks you to sign in through its official app or by typing my.gov.au.

3. 3

   Ring a number you found yourself

   Use the number on the company's website, the back of your card or a bill, never the one in the message. If a caller left a number on your voicemail, the ACMA suggests checking it matches the one on the company's website.

4. 4

   For family, ring the number you already have

   If you can't reach them, try another way, or ask a question only they could answer. Scamwatch's advice is never to send money unless you're absolutely sure who it's going to.

5. 5

   Still not sure? Search the words

   Scamwatch suggests searching for the exact wording of the message, the phone number, the email address or the company's name, together with the word scam.

What does “Unverified” mean on a text?

It means the name at the top of the text hasn’t been registered, and the text may be a scam. Since 1 July 2026, a text that shows an organisation’s name as the sender, such as ATO, AusPost or myGov, needs that name registered on the ACMA’s SMS Sender ID Register. Texts from unregistered names show as “Unverified”, grouped in one thread with other unverified messages, including possible scams.

The ACMA says an Unverified text may also come from a real organisation that hasn’t registered yet, so check it the way above. The rules don’t cover texts from ordinary phone numbers, or messaging apps such as WhatsApp, iMessage and Facebook Messenger, where the ACMA says scam messages can still arrive. The ACMA’s page on texts from businesses and the Unverified label (opens in a new tab) explains it.

How do you check an email or a website?

Look at the sender’s address and the website’s address, not the name or the logo.

• The sender’s address. Scamwatch lists a well-known company or government agency writing from a free email address, such as Gmail or Yahoo. It also warns that scammers can fake a real company’s address, so a correct-looking address isn’t proof on its own.
• Attachments. Don’t open an attachment or download an app you weren’t expecting. Scamwatch warns that they can install harmful software.
• The website’s address. Scamwatch lists an address that’s slightly different to normal, and suggests reaching companies through a secure, verified app or portal rather than through search results.
• A pop-up saying your computer is infected. An urgent warning that asks you to click a link is on Scamwatch’s list. Don’t click it or ring its number; open the program it names yourself to check. Is the antivirus already on your computer working? shows how to check. If the computer still seems wrong, find out whether it’s the computer or the internet.

On accounts that offer one, a passkey means a fake sign-in page gets nothing, because there’s no password to type into it.

Which companies do scammers copy, and what do they say?

Scammers copy the names people trust. Scamwatch’s page on phishing scams (opens in a new tab) names myGov, Services Australia, Centrelink, the ATO, your bank, toll road companies, friends and family, and businesses you regularly deal with. IDCARE adds parcel delivery, phone and internet companies, and online shops.

Here is what some of the most copied say on their own scam pages. By their own account, a message asking for something on this list isn’t from them.

What the copied companies say on their own scam pages

Company	What its own page says	How to check instead
Australia Post	It won't text or email asking for card or personal details or your password, or ring out of the blue asking you to pay for an undelivered item	The AusPost app or its Help & Support portal
The ATO	It doesn't send an unsolicited text with a link in it, and doesn't threaten arrest or legal action by email or text	Sign in to myGov yourself, or ring the ATO on 1800 008 540
myGov	It only asks you to sign in through the official app or by typing my.gov.au, and won't ask you to reply with personal information or your sign-in details	Open the myGov app, or type my.gov.au
Linkt (toll roads)	It doesn't ask you to click a link in a text to confirm personal or financial details, or to give payment details through a link in a text	Log in to your account in the Linkt app or on its website
Your bank (CommBank as one example)	CommBank says it won't ask you to log on using a link from an email or text, move money to a "safe" account, or download remote access software	Open the bank's app, or ring the number on your card

Scamwatch says the same of banks and government in general: banks won’t ask you to download software, move money to a “secure” account or hand cash to a courier, and government bodies won’t text or email you a link to log in to services like myGov.

What to do if you clicked a link, replied or paid

Ring your bank first, then change your passwords from another device, then get help and report it.

1. 1

   Stop, and send nothing more

   Don't reply, don't send more money or details, and ignore follow-up messages. If you tapped a link on your phone, IDCARE suggests disconnecting the phone from the internet.

2. 2

   Ring your bank now

   Use the number on your card or the bank's own website, from a different phone if you can, as IDCARE suggests. Ask them to stop any payments and add extra security to your accounts.

3. 3

   Change your passwords

   On a phone or computer you trust, change the passwords for your banking, email, government and shopping accounts. IDCARE says to change any passwords saved in your browser too. Turn on two-step sign-in where you can.

4. 4

   Ring IDCARE for free help

   IDCARE helps you make a plan to limit the damage, free, on 1800 595 160. Ring them if you gave out licence, Medicare, passport, tax file number, banking or account details, or let someone onto your device.

5. 5

   If myGov is involved

   Change your myGov password, and ring the Services Australia Scams and Identity Theft Helpdesk on 1800 941 126, Monday to Friday, 8 am to 5 pm AEDT.

If you typed a password into the page and the account is now acting strangely, what to do if you think you’ve been hacked has each company’s recovery steps.

A password manager on your phone makes a different strong password for every site, so one leak opens only one account.

IDCARE’s fact sheet on scam texts (opens in a new tab) has the full checklist for a phone, and is worth printing for a parent.

If you installed an app because a message or a caller told you to, Scamwatch’s advice is to have a qualified technician remove it. That’s what our home visit to check and clean up a phone or computer after a scam is for. If you’re worried someone got into the modem itself, a home network case where the owner feared exactly that shows which signs have ordinary explanations.

How do you report a scam in Australia?

Report it to Scamwatch with the report a scam form (opens in a new tab), even if you didn’t lose anything. If you lost money or gave out bank details, ring your bank first. Scamwatch says reports help it warn people about new scams and get scam websites taken down.

• A scam text. The ACMA’s advice is to report scam texts to Scamwatch, and if money or personal details may have been stolen, to tell your bank and your phone company straight away.
• The company it pretended to be. Australia Post, the ATO and myGov each give a reporting address on their scam pages, CommBank takes reports in its app, and Linkt has a report a scam page. Report the message the way that page asks, then delete it.
• Money or personal information stolen. Scamwatch’s report page points cybercrime, such as stolen money or personal information, or extortion, to a police report on cyber.gov.au.
• Someone in danger. Call 000.

When to call us, and when you don’t need to

If you didn’t tap, reply or pay, you don’t need anyone. Report the message and delete it.

If you tapped a link, typed in a password or paid, your bank and IDCARE come first; a technician can’t stop a payment. After that, if an app was installed or you’re not sure what got onto the phone or computer, our home tech support visit checks and cleans up the device in front of you, switches on the updates and backups, and sits beside you while you change your passwords. You type them in yourself; we never sign in as you. We don’t do hardware repair, data recovery or remote support: we come to the house.

Not sure which you need? Send us a message, or ring us on 02 9188 1577.