Module 7 of StartCloud's Cyber Hygiene for Staff learning pathway, in five short units with a knowledge check: why a work account is often reached through a personal one, the Australian scams people actually meet (fake myGov and ATO messages, parcel delivery texts, toll and infringement notices, bank impersonation calls), marketplace and payment scams, and the habit of never acting on a message that creates urgency.
The Scams That Come After You Personally
Why the back door runs through your personal life
Everything in this pathway so far has been about work. This module is about you, at home, on the couch, with your own phone in your hand. Not because your employer wants a say in your Saturday, but because the two are joined up whether we like it or not.
Criminals are practical. If the work systems are well defended, they go around the side, and the side is usually your personal life. Same person, same phone, same handful of passwords, far fewer defences. There are three bridges they walk across most often.
The password you use for a shopping site is often a close cousin of the one you use at work. When that shopping site gets breached, the password lands on a list, and software tries it everywhere. Nobody picked you. A machine just worked through the list and your name happened to be on it.
Your personal email is where password resets land, including for anything work-adjacent you signed up for with it. Someone sitting quietly inside that inbox can reset their way into a surprising amount, and you would not see a thing until it was well underway.
Date of birth, licence number, address history, your employer's name. Individually harmless. Collected together, they are enough for someone to open accounts in your name, or to ring your workplace sounding exactly like a person who belongs there.
Nobody is auditing your online shopping. The point is simpler and kinder than that. The habits in this module protect your own money and your own name first, and your workplace gets the benefit for free. If you only ever use one thing from this whole pathway at home, make it the pause in the last unit.
These four turn up in Australian phones constantly. None of them are clever. They are just well aimed, and they arrive while you are cooking dinner or driving home with the kids in the back.
One genuinely useful change to know about: since 1 July 2026, businesses and organisations sending you a text should be using a registered sender ID, so their name shows instead of a phone number. Messages from unregistered senders are flagged as "Unverified" on your phone. It is not a magic shield, but an unverified message asking you to click something deserves a very hard look.
The fake myGov or ATO message
A refund is waiting, a payment has failed, your account has been suspended, there is a discrepancy in your return. It arrives by text or email, it looks the part, and it turns up thickest around tax time when half the country is expecting to hear from the ATO anyway. Scamwatch is blunt about the tell: the ATO will never send you an unsolicited message with a link asking you to sign in.
- A link asking you to sign in to myGov is the whole scam, every time
- Sign in the way you always do, through the app or by typing the address yourself
- Real sender addresses end in .gov.au, and lookalikes are cheap to buy
- To check whether contact was genuine, ring the ATO on 1800 008 540
The parcel that could not be delivered
"Your package is held at our depot, a small fee is required for redelivery." Most of us have something on the way most weeks, so the message lands in fertile ground. The fee is tiny on purpose, because the point was never the fee. The point is your card details, typed into a page that looks like a courier and belongs to somebody else.
- Track the parcel in the courier's own app or website, never through the link
- A real tracking number works when you type it in yourself
- Genuine couriers do not chase small redelivery fees by text
- If you were not expecting a parcel at all, that is the answer
The unpaid toll and the mystery infringement
An unpaid toll from a trip you might have taken, or a fine with an official-looking reference number and a deadline that has apparently almost passed. These work on a very Australian instinct: nobody wants a small admin problem quietly turning into a bigger one, so people pay first and think later.
- Log in to your toll account directly and see whether anything is actually owing
- Real infringements come with a proper notice and an official channel to check it
- Threatened extra charges and short deadlines are pressure, not process
- Sending a screenshot to a family group chat is a fine first step
The call from your bank's fraud team
This one is the most expensive and the hardest to sit through. A calm, professional voice says suspicious transactions are happening right now and your money needs moving to a safe account. They may already know your name and where you bank. Caller ID can be faked, so the number on your screen proves nothing at all.
- No bank will ever ask you to move money to a safe account
- No bank needs your password, PIN or a one-time code read out loud
- Hang up, wait a moment, then ring the number on the back of your card
- Being kept on the line is the trick, so ending the call is the defence
Something official, something owing, something urgent, and a link or a phone number helpfully provided so you never have to look anything up. That last part is the giveaway. A real organisation is perfectly happy for you to reach them your own way, because they are who they say they are.
Buying and selling privately is a very Australian pastime, and it is also a scam playground, because both sides are strangers and the money moves before anyone has met. Four plays cover most of it.
You are selling a pram on Marketplace. The buyer sends a receipt showing they paid too much and asks you to refund the extra. The receipt is a picture, the payment never arrives or gets reversed later, and the refund you sent was real money. Anyone asking you to send money back before the original payment has genuinely cleared in your account is running this play.
A buyer cannot collect in person, but they have a courier all sorted, and there is just a small charge you need to cover first, refunded on delivery of course. There is no courier. This one is aimed at sellers rather than buyers, which is exactly why it catches people who consider themselves careful shoppers.
A rental that photographs beautifully, concert tickets for a sold-out show, a puppy with a very cute video. The seller cannot meet, the price is a bit good, and they want a bank transfer to hold it. Bank transfers are close to cash: once it is gone, getting it back is difficult.
A buyer asks you to prove you are a real person by reading out a code they have just sent you. That code is a one-time password for an account being set up or taken over in your name. Codes are for you, never for the person on the other end of the chat. Nobody legitimate has ever needed one.
Keep the conversation on the platform, because the moment someone moves you to a private text thread they have moved you away from anything that could help later. Check the money has genuinely landed in your own account before you hand over goods or refund anything. And never read a code out to anybody, for any reason, however reasonable the reason sounds.
A note on romance and investment scams, since they belong in the same family. They run for weeks or months and rely on a real relationship forming first, which is why they hurt so much and why the losses can be so large. The warning sign is the same one as everywhere else in this module: a person you have never met in the flesh eventually needs money moved, and there is always a good reason why it has to be now.
Here is the whole module in one habit. Never act on a message that is trying to rush you. Not once, not for the ATO, not for the bank, not for the courier, not for the lovely person on Marketplace. Urgency is the one ingredient every scam in this module shares, because thinking is the thing they cannot afford to let you do.
Scamwatch teaches it as three words, and they are worth borrowing: stop, check, protect.
- Stop when a message creates urgency. That feeling is the attack, not the problem
- Check it your own way: the official app, the number on your card, a phone call to the real person
- Take thirty seconds to say it out loud to someone. Scams rarely survive being described
- Protect what got exposed: change the password, ring the bank, ask for help early
- Do not click the link, tap the button or ring the number the message gave you
- Do not read out a one-time code, ever, to anybody
- Do not move money to a safe account, because there is no such thing
- Do not stay quiet out of embarrassment. That only ever helps the scammer
Money involved, ring your bank straight away. myGov or Centrelink details given away, ring Services Australia's Scams and Identity Theft Helpdesk on 1800 941 126. Personal details out in the wild, IDCARE offer free help working out what to do next. And report it to Scamwatch either way, because that report is what warns the next person. If it touched anything to do with work, tell your IT support too, however unrelated it feels.
Accountants get done by fake invoices. Police officers get done by fake police calls. Being caught out says nothing about your intelligence and everything about the fact that you were busy at the wrong moment. If it happens to someone you know, the useful response is help, not a lecture.
- scamwatch.gov.au: Text or SMS scams, including registered sender IDs and the Unverified label
- scamwatch.gov.au: ATO and myGov impersonation scams
- scamwatch.gov.au: Report a scam to the National Anti-Scam Centre
- cyber.gov.au: Recognise and report scams
- servicesaustralia.gov.au: Scams and identity theft, including the Scams and Identity Theft Helpdesk
- idcare.org: IDCARE, free support if your identity has been misused
Scams change costume constantly, and phone numbers and reporting channels do get updated, so the links above are the ones to trust. Details were current at the time of writing (August 2026).
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. A text says your myGov account is suspended and gives you a link to sign in and fix it. What is going on?
2. Someone calls saying they are from your bank's fraud team and your money must be moved to a safe account right now. What do you do?
3. You are selling a bike online. The buyer asks you to read out a code they have just sent to your phone, to prove you are a real seller. What is the code actually for?
4. Why does a scam aimed at your personal life matter to your employer?
5. What single feeling should make you slow right down, whatever the message claims to be about?