Something smells a bit phishy?

How to spot a phishing/smishing scam before it finds you

Phishing is one of the oldest scams in the book, but scammers are always looking for new ways to steal. Take smishing for example, which is when they use SMS to trick you. In fact, in 2024 Australian Competition and Consumer Commission (ACCC) reported over $20 million in phishing losses¹, with SMS as the most common form of contact. So if something smells a bit phishy, it probably is.

What’s a phishing/smishing scam?

A phishing/smishing scam is when a scammer tries to trick you into revealing your bank account details, passwords or credit card numbers so they can steal from you.

They’ll contact you by email or phone (phishing) or SMS (smishing) pretending to be from a trusted organisation like a bank, government agency or well-known brand.

How it works

1. The scammer will contact you with an email, phone call or SMS that appears to be coming from a real organisation.
2. The scammer will say there’s an urgent issue that needs to be fixed, like suspicious activity on your account or a missed payment.
3. The message often includes a link to a real-looking fake website that prompts you to enter your information, or the caller may ask for it so they can ‘fix’ the problem.
4. Once you do, the scammers will use your details data to steal your identity, money or both.

4 signs it’s a phishing/smishing scam

Every crime has it’s MO, so here are some good clues it’s a phishing/smishing scam.

1. They use generic messages that don’t use your name and have awkward phrasing.
2. They use threatening language like ‘your account will be locked’ or ‘unauthorised transaction detected’.
3. They include links that look unusual and suspicious looking attachments.
4. They ask for sensitive information like your account, login or credit card details.

Specific things you can do

To help avoid a phishing/smishing scam you should:

• never click on links or open attachments in unsolicited messages
• verify by contacting the organisation using its official phone number, app or website
• use strong, unique passwords and avoid reusing them across different sites
• add an extra layer of security to your accounts by enabling two-factor authentication
• report suspicious messages to ING and scamwatch.gov.au

Better yet: Stop, Reflect & Protect

Whatever the type of scam, keeping these simple steps top of mind could help prevent you from becoming a scam statistic.

For our latest security alerts and more ways ING can help to protect you and your money, visit ing.com.au/security.