Phishing emails and online scams cause more financial damage than almost any other form of cybercrime. The Australian Competition and Consumer Commission reported over $3.1 billion lost to scams in 2023, and the figure has continued rising. What makes phishing particularly effective isn't sophisticated code. It's social engineering: an email, a text, or a fake website that looks just real enough to get you to act before you think. This guide explains how to spot the most common attacks, what to do when one arrives, and which habits make you a much harder target.
What phishing actually looks like in practice
Most people picture phishing as a poorly worded email from a foreign prince. That version still exists, but it's the amateur end of the market. The more dangerous variety copies a real organisation's logo, uses your first name, and sends from an address that differs from the real domain by a single character. A message appearing to come from "support@paypa1.com" reads identically to one from "support@paypal.com" at a glance.
Spear phishing takes this further. Attackers research a target on LinkedIn, then write an email referencing a real colleague's name or a recent company event. It doesn't feel like spam. It feels like a Monday morning message from your IT department. This technique is common in business email compromise attacks, where the goal is to trick someone into transferring money or handing over login credentials.
Smishing (phishing via SMS) and vishing (voice calls) follow the same logic. A text claiming your parcel is stuck and asking you to click a link, or a caller claiming to be from your bank asking you to confirm your card number, are both phishing. The channel changes; the manipulation doesn't.
Red flags that give phishing away
Speed and urgency are the most reliable signals. A message demanding you act "within 24 hours" or risk account closure is almost always fabricated pressure. Real banks don't suspend accounts by email without prior warning through a separate channel.
Check three things before you click anything:
- The sender's full email address. Display names can say anything. The actual address (visible in most clients by hovering or expanding the sender field) can't be faked as easily. A mismatch between the name and the domain is a clear sign.
- Where the link actually goes. Hover over any link before clicking. The URL in the status bar reveals the real destination. If it's a string of random characters or a domain that doesn't match the sender, don't click it.
- Whether the message requests credentials or payment. Legitimate services don't ask for your password, card number, or one-time code over email. Full stop.
How to protect yourself when a suspicious message arrives
Don't click. Don't reply. Don't call any number listed in the message itself. Those are the first three rules.
If a message claims to be from your bank, your telco, or a government agency, go directly to their official website by typing the address yourself, or call the number on the back of your card or on a bill you received in the post. That independent route breaks the chain the attacker has constructed. You verify the claim without touching their infrastructure.
Report phishing emails to your email provider using the built-in "report phishing" or "report spam" function. In Australia, you can also forward scam messages to Scamwatch via the Scamwatch website. These reports train filters and help protect others who receive the same campaign.
If you clicked a link and entered credentials, change your password immediately on the legitimate site, then enable two-factor authentication if it isn't already on. If you handed over payment details, contact your bank directly and ask them to flag potential fraudulent transactions.
Habits that make you a much harder target
Two-factor authentication (2FA) is the single biggest deterrent. Even if an attacker captures your password via phishing, they can't log in without the second factor. Use an authenticator app (such as Google Authenticator) rather than SMS codes wherever the service allows it, since SIM-swap attacks can intercept texts.
Use a password manager to generate unique passwords for every account. Credential stuffing, where attackers take passwords leaked from one breach and try them on other services, is a leading follow-up to a successful phish. A unique password per site means one compromise doesn't cascade.
Keep software and operating systems updated. Phishing links often lead to pages that try to install malware via browser vulnerabilities. A patched browser closes most of those entry points. It's also worth reading up on how to protect your personal information online more broadly, since the habits overlap significantly with phishing defence.
Be suspicious of urgency anywhere: in emails, texts, pop-ups, and phone calls. Social engineers rely on the gap between stimulus and rational thought. A five-second pause to ask "did I initiate this contact?" stops most attacks before they start.
When AI makes scams harder to detect
Generative AI tools have improved the surface quality of phishing dramatically. Grammar errors and odd phrasing were useful signals two years ago. They're less reliable now. Attackers use large language models to produce polished, fluent text in any language, at scale, personalised to named targets.
Synthetic voice and video tools add another layer. A caller that sounds exactly like your CEO asking you to approve an urgent wire transfer is no longer a theoretical threat. The Orange IT piece on AI scams and deepfakes: how to recognise and avoid them goes deeper on this specific attack category and what distinguishes a real call from a cloned one.
The defence against AI-generated phishing isn't style detection. It's process. Establish a verbal confirmation protocol with your team for financial requests above a set threshold. Agree on a code word with family members before an emergency call demands fast action. Process is harder to social-engineer than a person acting alone under pressure.
What to do if you've already been caught
It happens to careful people. The goal after a successful phish is damage limitation, not shame. Change the compromised password immediately, then run through every other account that shares it. Contact your bank if any financial data was involved. If your work accounts were affected, tell your IT or security team straight away. Delayed disclosure turns a contained incident into a bigger breach.
Run a scan with updated security software to check whether the link you clicked dropped anything on your device. The best antivirus software for Windows and Mac can detect most common payloads, but clean detection depends on signatures being current. Update before scanning.
File a report with your national fraud or consumer protection body. In Australia that's the Australian Cyber Security Centre (ACSC) at cyber.gov.au. Reports build a picture of active campaigns and sometimes lead to takedowns of the infrastructure behind them.