Five Practical Ways to Recognise a Phishing Email
Phishing emails are designed to look ordinary while pushing you towards a harmful action. A message may appear to come from your bank, a delivery company, a government department, a workplace or a familiar online shop. Its real aim is often to steal passwords, payment details, identity information or access to business systems.
Australian households receive plenty of legitimate digital notices, from Australia Post tracking updates and energy bills to Medicare messages and online banking alerts. That makes fraudulent emails harder to dismiss at a glance. A careful check of the sender, wording, links and request can reveal most warning signs before any damage is done.
Check Who Really Sent The Message
The sender name shown in an inbox is easy to copy. “ATO,” “CommBank” or “Australia Post” may appear as the display name even when the underlying address belongs to an unrelated account. Expand the sender details and inspect the complete email address, including the domain after the @ symbol.
A genuine organisation usually sends messages from a domain associated with its official website. A scammer may use a free Gmail or Outlook address, a misspelled domain, or a lookalike that changes one character. Addresses such as secure-ato-help.com or auspost-delivery-alert.net should be treated cautiously. A familiar brand name inside a longer domain does not make the address authentic.
Be careful with compromised accounts as well. An email from a real-looking address can still be fraudulent if that account has been hacked. If the message is unusual for the supposed sender, verify it through a separate channel. Use a phone number from an official website, bank card or previous statement rather than a number included in the suspicious email.
Look For Pressure And Unusual Requests
Phishing relies heavily on urgency. The message may claim that a bank account will be locked within hours, a parcel cannot be delivered, a tax refund is waiting, or a streaming subscription will be cancelled today. The pressure is intended to stop you from checking the facts.
Urgent language is especially common during busy periods such as Christmas deliveries, tax time and major online sales. Australians may receive fake messages referring to an Australia Post parcel, an overdue toll notice in Sydney or Melbourne, or a payment problem with a well-known retailer. The local detail can make a scam seem convincing, but it does not prove that the email is genuine.
Pay attention to requests that do not fit normal business practice. A bank should not ask you to email a password, PIN or one-time security code. A government department is unlikely to demand payment through cryptocurrency, gift cards or an unusual overseas account. Requests to “confirm” full identity details, banking information or a login code deserve independent verification.
Inspect Links Before Opening Them
A link can display reassuring words while leading somewhere completely different. On a computer, hover over it without clicking to reveal the destination. On a phone or tablet, press and hold the link if the device allows it, then inspect the preview carefully. Avoid opening links when the destination is hidden or unclear.
Look at the domain rather than the words before it. In ato.gov.au.example.com, the important domain is example.com, not ato.gov.au. Shortened links and unfamiliar tracking addresses are difficult to assess, so they are safer to avoid when received unexpectedly. A secure padlock or “https” also does not prove that a website is legitimate; scam sites can use encrypted connections.
The safer approach is to open the official app or type the organisation’s known web address into your browser yourself. For example, access internet banking through your saved bank website or official app instead of using an email button. The same habit applies to myGov, insurance portals and online shopping accounts. If there is a real problem, it should be visible after you sign in through the normal route.
Notice Language, Formatting And Attachments
Many scam emails contain awkward grammar, strange punctuation or wording that does not sound like the organisation. These clues are useful, although polished scams can be written clearly and may use copied branding. A professional logo, matching colours and a familiar signature can all be reproduced.
Check whether the message uses your name appropriately and whether the details make sense. An email addressed to “Dear Customer” is not automatically fraudulent, since some legitimate mass notices use generic greetings. However, a vague greeting combined with an urgent demand, a suspicious link and an unexpected attachment is a strong warning pattern.
Unexpected files deserve special care. Word documents, spreadsheets, compressed archives and HTML files can contain malware or lead to a fake sign-in page. Do not enable macros or security exceptions simply because an email says they are required to view an invoice. If an invoice or resume is expected, confirm with the sender using a known phone number or an existing conversation.
Compare The Request With A Safe Response
A useful way to identify a phishing attempt is to ask what the organisation would normally expect you to do. Legitimate services generally provide a secure portal, a known customer service number or an official app. Phishing messages try to make the email itself the only route to solving the supposed problem.
The comparison below is a quick way to separate common warning signs from safer behaviour.
| Email feature | Possible phishing sign | Safer response |
|---|---|---|
| Sender | Display name matches a brand, but the full address uses a strange domain | Open the organisation’s official website and find its contact details independently |
| Urgency | Threats of account closure, fines, missed delivery or immediate loss | Pause and verify the claim through the normal app or portal |
| Link | Destination is shortened, misspelled or different from the claimed organisation | Type the known web address yourself instead of clicking |
| Personal request | Password, PIN, one-time code, full bank details or identity documents requested by email | Do not reply; contact the organisation through an official channel |
| Attachment | Unexpected invoice, document or archive asking you to enable features | Confirm the file with the sender before downloading or opening it |
Australian consumers can report scams to Scamwatch, which is operated by the Australian Competition and Consumer Commission. Reports help authorities identify patterns, although reporting does not guarantee that money or information will be recovered. If banking details have been exposed, contact the bank immediately using its official number and ask what protective steps are needed.
The Australian Cyber Security Centre also provides guidance for individuals and organisations dealing with suspicious messages. Businesses should follow their internal reporting process as well, since one clicked email can expose shared Microsoft 365 accounts, customer records or payment systems. The Spam Act 2003 regulates many commercial electronic messages, while the Privacy Act 1988 sets obligations around personal information for covered organisations; neither law makes every unwanted email automatically safe or illegal. Practical caution remains important.
If you have clicked a suspicious link, act quickly without panicking. Close the page, disconnect from the internet if malware may have been downloaded, and run security checks using trusted software. Change affected passwords from a clean device, enable multifactor authentication and contact the relevant service provider. Where money or identity documents are involved, notify your bank and consider contacting IDCARE for identity-support guidance.
The most useful habit is to slow down at the exact moment an email tries to speed you up. Check the real sender, question urgent demands, inspect links, treat unexpected files cautiously and use an independent route to verify the request. A phishing email often succeeds through a single rushed click, while a short pause gives you time to see what the message is really asking for.