How to Spot a Phishing Email — With Real Australian Examples
What phishing is trying to do
A phishing message pretends to be from someone you trust — your bank, Australia Post, myGov, the ATO, Netflix, or even a colleague — and tries to make you act quickly without thinking. The goal is to get you to click a link, enter your login details on a fake page, open an infected attachment, or pay money.
The whole technique relies on emotion and urgency: fear that your account is locked, excitement about a refund, or worry about a missed delivery. Once you understand that the message wants to rush you into a reaction, you can pause — and pausing is most of the defence.
Red flag 1: urgency and threats
Almost every phishing message creates pressure. Your account will be suspended in 24 hours. Verify now or lose access. Immediate action required. Legitimate organisations rarely threaten you with instant consequences over email, and they never ask you to resolve a crisis by clicking a link and entering your password.
When a message tries to make you act right now, that urgency is itself the warning sign. Slow down. A real bank or government service will let you log in through their official app or website in your own time — there is never a genuine reason to rush through a link in an email.
Red flag 2: the sender and links do not match
Check the actual sender address, not just the display name. A scammer can put Australia Post as the name while the real address is a random string at an unrelated domain. On a computer, hover over any link without clicking and look at where it really goes — phishing links rarely point to the genuine official website.
Common Australian examples include fake Australia Post delivery notices, myGov or ATO refund emails, bank security alerts, and toll-road payment demands. They copy the logos perfectly, but the sender address and the link destination give them away every time when you actually look.
Red flag 3: requests for details or payment
No legitimate bank, government agency or company will email or text asking you to confirm your full password, PIN, card number or one-time security code. If a message asks for any of these, it is a scam, full stop. Real organisations already have your details and will never ask you to supply them this way.
Be especially wary of any message asking you to pay using gift cards, cryptocurrency, or by transferring money to a new account number. These are hallmarks of scams. A genuine business changing its bank details will never tell you only via an unexpected email.
Red flag 4: odd wording and generic greetings
Many phishing emails contain small giveaways: slightly awkward English, odd phrasing, inconsistent formatting, or a generic Dear Customer instead of your name. While scams have become more polished, these tells still appear often, particularly in messages sent in bulk.
Trust your instinct if something simply feels off — a strange tone from a company you know, a logo that looks slightly wrong, or a request that does not fit how that organisation normally communicates. That gut feeling is frequently right, and it costs nothing to verify before acting.
The safest habit: verify independently
The golden rule is never to use the contact details or links in a suspicious message. Instead, go to the organisation yourself the way you normally would — open your banking app, type the official website address by hand, or call the number on the back of your card. If the message is real, you will see it there too.
This single habit defeats almost all phishing, because it sidesteps the fake link entirely. If a delivery notice worries you, check the courier official tracking page directly. If your bank seems to be alerting you, log in through the app. Verify independently, and the scam falls apart.
What to do if you have clicked
If you entered a password on a fake page, change that password immediately from a device you trust, and change it anywhere else you used the same one. Turn on two-factor authentication so a stolen password alone is not enough. If you gave card or banking details, contact your bank straight away to protect the account.
If you opened an attachment or your computer is behaving strangely afterwards, disconnect it from the internet and have it checked for malware. We help people across Western Sydney recover from phishing — securing accounts, removing any infection, and making sure no lasting access remains. Acting fast limits the damage.
Clicked a phishing link or entered your details?
Act fast: change the password from a trusted device, enable two-factor authentication, and contact your bank if money is involved. If your computer is affected, disconnect it. TechFix Pro helps Western Sydney recover from scams safely.
Quick checklist
- Be suspicious of urgency and account threats
- Check the real sender address and hover over links
- Never share passwords, PINs or one-time codes by email
- Watch for gift card, crypto or new-account payment requests
- Verify by going to the official app or site yourself
Frequently asked questions
How can I tell if an email is phishing?
Look for urgency or threats, a sender address that does not match the real organisation, links that point somewhere other than the official site, requests for passwords or payment, and generic greetings. When in doubt, verify by going to the official app or website yourself.
What are common phishing scams in Australia?
Fake Australia Post delivery notices, myGov and ATO refund or debt emails, bank security alerts, toll-road payment demands, and streaming-service billing scams are all common. They copy logos well, but the sender address and links reveal them.
What should I do if I clicked a phishing link?
If you entered a password, change it immediately from a trusted device and anywhere you reused it, and enable two-factor authentication. If you shared card or bank details, contact your bank. If your computer is affected, disconnect it and have it checked.
Will a bank ever ask for my password by email?
No. Banks, government agencies and legitimate companies never ask for your full password, PIN or one-time code by email or text. Any message that does is a scam.
Worried you have been scammed?
TechFix Pro helps Western Sydney homes and businesses recover from phishing and scams — securing accounts and removing any malware. Remote help from $49, No Fix No Fee.