Security and fraud

Protect yourself from online threats

• Use strong, unique passwords and change your password if you believe it may have been compromised.
• Adopt two-factor authentication for your important accounts to add an extra layer of security. Macquarie Authenticator is our mobile security app which utilises actionable push notifications to verify account activity.
• Install an anti-virus software and keep it updated to reduce the likelihood of being impacted by malware.
• Regularly back up your computer and devices.
• Think before you share information on social media, especially personal information such as the address of your new house in a photo.
• Be aware of phishing emails and don’t click on them.

Protect yourself from phone scams

• You may receive scam calls even if you have a private number or are registered on the Australian Government’s Do Not Call Register.
• Never disclose your personal information, financial account or online account details over the phone unless you made the call and got the number from a reliable source. 

Phishing emails often impersonate large, trustworthy organisations or government agencies. They may contain a link asking you to enter your information or to respond quickly to their request via email.

• Be on the lookout for poor spelling, grammar or other errors in the email that don’t match the organisation’s presentation.
  
• Be suspicious of emails with offers that seem too good to be true or that threaten you to take an action they’ve proposed.
  
• If you weren’t expecting a message from a person or business, don’t click on the links or open attachments to an email. You can always reach out to the person or business via another communication channel to verify the legitimacy of the message you’ve received.
  
• Before you click a link, hover over it to see the actual web address it will take you to. If you don’t recognise or trust the address, you can always search for the article or site via a search engine with relevant key terms the page might use.
  
• Utilise a spam filter to block suspicious messages from reaching your inbox.
  
• Remember, we’ll never ask you for your passwords or secure codes via email.

Malicious software, often shortened to malware, can be used by cybercriminals to:

• remotely access your computer or smart device
  
• use your computer to attack a third party
  
• install additional software on your software including ransomware
  
• attempt to log keystrokes and capture sensitive information while the user is typing
  
• access the microphone and/or webcam on a user’s device.

Malware can infect your device through a variety of methods such as:

• opening a suspicious file
  
• clicking on a link to a malicious website
• installing modified software that’s been shared for free on the internet
• opening a Microsoft Office document with macros embedded in them.

If you’ve been affected by malware, you might notice your device is running slower than usual, ads popping up on your machine you didn’t expect or notice websites asking for more details than they normally do to do something like logging in. You may also notice alerts from your anti-virus software telling you about an infection.

Some of the ways to reduce your risk of being affected by malware include:

• use anti-virus software and keep it updated
  
• make sure your applications and operating systems are up to date
  
• regularly back up your files
  
• use strong passwords
  
• disable Microsoft Office macros by default and only use macros you know and trust
  
• regularly run anti-virus scans of your machine and review installed applications for unusual items
  
• don’t download applications from third-party download sites or peer-to-peer networks
  
• don’t click on online ads to download applications.

   

Ransomware is a type of malware that locks your device and its files down so you can’t use them without paying a fee.

Ransomware can be very costly to recover from. It commonly uses encryption techniques to lock your files, making them unreadable, and some go one step further and make your computer unusable.

Ransomware infects users’ devices through the same techniques as malware and can include:

• opening a suspicious file sent to you
• clicking on a link to a malicious website
• installing modified software that’s been shared for free on the internet
• opening a Microsoft Office document with macros embedded in them.

In line with the Australian Cyber Security Centre’s guidance, it’s not recommended to pay the ransom if you’re affected by ransomware. There’s no guarantee that paying the ransom will see you get your files back and your computer fixed. You should engage a technical resource for assistance if affected.

Some of the ways to reduce your risk of being affected by ransomware include:

• use anti-virus software and keep it updated
• make sure your applications and operating systems are up to date
• regularly back up your files
• use strong passwords
• disable Microsoft Office macros by default and only use macros you know and trust
• regularly run anti-virus scans of your machine and review installed applications for unusual items
• don’t download applications from third-party download sites or peer-to-peer networks
• don’t click on online ads to download applications.

Identity theft happens when a criminal steals personal information and uses it to commit a crime such as opening fraudulent loans or stealing money from your bank accounts.

Cybercriminals can steal information including contact details, tax file numbers, credit card details, Medicare card details, online account usernames and passwords.

Some of the signs of possible identity theft include:

• your bank transaction history shows purchases or withdrawals you haven’t made
• you stop receiving mail or stop receiving regular, expected mail like your utility bills
• you start receiving communications related to a credit facility you didn’t open
• a government agency gets in touch regarding a benefit that you haven’t applied for
• you start receiving calls from debt collectors without being behind in loan repayments.

Some of the ways you can minimise the likelihood of having your identity stolen include:

• limit what you share online
• set your social media privacy settings to ‘private’
• don’t accept new connections on social media from people you don’t know
• be suspicious of communications asking you to confirm sensitive personal information
• use strong, unique passwords for each online account
• keep your devices, applications and operating system patched and up to date.

Technical support scams involve cybercriminals getting in contact with users and pretending to have identified a serious problem with the user’s computer or internet connection and offer to help. They’ll ask for remote access to the user’s computer but in doing so, will access files, intercept bank account logins and other sensitive information on the machine. They may also ask the user to pay a fee to fix the machine.

This scam works on intimidating the user, often using technical words and phrases to confuse the victim and employing techniques to build urgency. The scams can be initiated via a cold call, mass-messaged emails to users or via pop-up ads suggesting you’ve got a virus and to call a 1800 number for help.

Some of the ways you can protect yourself from scams such as these include:

• always keep your computer up to date with the latest software updates, antivirus software and a good firewall
• never disclose your personal information, financial account or online account details over the phone unless you made the call and got the number from a reliable source
• if a stranger asks for remote access to your computer, say no, even if they claim to be from a reputable business. 

Phone porting fraud is when your mobile phone number is ported to a new telecommunications (telco) provider without your consent. A phone port can be initiated by providing the genuine owner’s name, mobile number, email, or date of birth.

If your phone number has been illegally ported, you lose mobile phone reception, access to network data and therefore, the ability to call and text.

The fraudster who illegally ported your number can now text, make calls from your phone number and is the new owner of the number registered for your two-factor authentication (2FA). This means, the fraudster can log into your internet banking by using your mobile phone number to reset your password and then transact on your account(s).

SIM swap

A SIM swap is where the fraudster will contact your telco provider and request to activate a new SIM card with your number. They can do this through the same methods used to port your phone.

How does a fraudster know my details? 

A fraudster may have obtained this information through a number of different ways. 

You may have clicked a phishing link through an email or text message and entered sensitive information, or your emails may have been compromised. 

The fraudster may have accessed personal information you may have accessible on social media profiles. The fraudster may have also accessed this information via ‘social engineering’ through a phone call or messaging app. ‘Social engineering’ is the act of manipulating people to give up confidential or sensitive information. 

Unusual activity to be aware of

• Your service is suddenly disconnected and showing ‘SOS only’.
• Unexpected texts from your provider advising that you have requested your number to be ported to another network. 

How to prevent phone porting 

• Contact your telco provider and increase your security questions to unique answers only you would know.
• Remove your email, mobile number, and date of birth from your social media profiles.
• Download the Macquarie Authenticator app.
• Be security conscious on social media sites and online. 
• Use two-step verifications to log into your email account and banking apps. 
• Never click a link you receive via email or text message.
• Be aware of cold calls where a scammer will manipulate you to give up personal information such as your banking credentials, credit card, address, or date of birth.

What do to if you suspect your phone has been ported

• Contact your mobile phone provider immediately. 
• Contact your financial institution/s.
• Change your passwords to online banking, email and social media accounts.
• For help with identity fraud, contact ID Care.
• Report the matter to your local police.
• For help with protecting yourself online, visit https://www.cyber.gov.au