How to protect yourself from phishing and impersonation scams

It might start with a quick message – a text about a missed delivery, an email from your bank or a call that sounds official. In the moment, it can feel routine. Something to deal with quickly before moving on. 

But sometimes, that’s exactly what scammers are relying on. 

Phishing and impersonation scams are becoming more sophisticated and harder to spot at a glance. According to Scamwatch, in 2025 alone, Australians reported more than 65,000 phishing scams, with losses totalling over $31 million. 

With the right know-how, you can stay one step ahead and feel more confident every time you tap, click or answer the phone. 

What is a phishing scam?  

A phishing scam is a type of scam where cybercriminals pretend to be a trusted person or organisation to get your personal information. 

This is why phishing is often called an impersonation scam – because the scammer is pretending to be someone you know or trust. 

Unlike data breaches and hacking, phishing is a form of social engineering and is designed to exploit people’s inherent trust to gain access to their accounts and steal sensitive information – often catching you in the moment with a message that feels urgent or familiar. 

If they succeed, they could access your accounts, steal money or use your identity. 

Types of phishing scams  

There are many different types of phishing scams, with the name dependent on the form of interaction, as well as, in some cases, the person being targeted.  

Email phishing is when someone sends you an email claiming to be a person or organisation you know or trust. It may ask you to share personal details or include a harmful link that could include a virus or send you to a fake website designed to capture your information. 

Smishing is similar to email phishing, but sent via SMS. These scams most commonly include a link to a website that looks legitimate, but which is designed to steal your personal details.  

Vishing, short for voice phishing, is a scam that comes in the form of a phone call. There can be a person on the other line, or sometimes, an automated voice. Common vishing scams include Government impersonation scams and bank impersonation scams and might say you have an outstanding debt or are owed money to encourage you to act quickly.  

Spear phishing is a type of highly targeted phishing scam, targeting a specific person’s information. Often this might look like an email from your manager or IT department at work asking you to do something urgently. 

Whaling, like spear phishing, is a highly targeted attempt to steal information. However, it’s called whaling, when the scam is targeting a high-profile individual, like a CEO or business owner of a company. 

What are some common phishing scams in Australia? 

In Australia, some phishing scams are more prevalent than others. Common phishing scams in Australia include: 

Government impersonation scams, where the person contacting you claims to be acting on behalf of a Government agency such as the MyGov, Services Australia, Centrelink or the Australian Tax Office (ATO). Government impersonation scams will often claim you owe money or are owed money in an attempt to reel you in. They may also threaten arrest, deportation or legal action to play on your fears. 

Bank impersonation scams, where the email, SMS or phone call is claiming to be from a bank or financial institution. Bank impersonation scams will often claim there’s been unusual activity on your account or suspected fraud. They may ask you to verify your account, make an immediate payment, or transfer your money elsewhere to keep it safe. AMP Bank GO customers can use the ‘Your Bank Is Calling’ feature, a way of allowing our customers to verify whether a call they have received is, in fact, from AMP Bank GO.  

SMSF and investment scams, where scammers pretend to be from a financial firm, such as a bank or super fund, and encourage you to move your super into an SMSF with promises of high returns or exclusive investment opportunities. Watch out for unrealistic returns, fake investment apps, unusual investment recommendations, or offers that seem too good to be true. Always verify the credentials and licences of anyone providing financial advice.

Toll road scams are another common scam in Australia, where scammers impersonate e-toll suppliers and claim you have an overdue balance or missed a toll. They’ll often include a fake link and ask for your credit card information. 

Friends and family impersonation scams, also called ‘Hi mum’ scams, are when scammers pretend to be people you know to ask for money. They’ll often claim to have a new phone and need help urgently. And because so much of our information is online, they may even use real names or images – making the message feel more convincing.

How to spot a bank impersonation scam

Bank impersonation scams can be particularly convincing because they play on something we rely on every day – trust in our bank.

Scammers can make calls, emails and texts look like they’re coming from your bank. In some cases, they may even appear in existing message threads or use details that make the contact feel genuine.

They’ll often claim there’s a problem with your account – such as suspicious activity or a payment issue – and ask you to act quickly. This might include sharing personal information, clicking a link to ‘verify’ your account or moving your money to another account to keep it ‘safe’.

If you’re ever asked to act urgently or move your money, it’s a sign to pause and double check through official channels.

Warning signs to look out for 

While scams are becoming more sophisticated, they still tend to follow a familiar pattern. Look out for signs like:

• Requests for personal information or unexpected payments

• Messages or calls that create urgency or pressure you to act quickly

• Being asked to lie about the purpose of the transaction or provide false information to your bank

• Being asked to make changes to your account out of the blue

• Emails or texts that don’t use your name

• Sender details or links that don’t match the organisation

• Spelling mistakes or unusual wording

• Web addresses that look slightly different to what you’d expect

Legitimate organisations – including banks and Government agencies – won’t ask for sensitive information via unsolicited emails, texts or links. If something doesn’t feel right, it’s always worth pausing and double checking.

How to protect yourself 

To help keep yourself safe from potential phishing scams, it’s important to never share your personal information, credit card details, passwords or one-time codes with anyone who contacts you unexpectedly, even if they claim to be from your bank or another trusted organisation.

If you’re ever unsure whether you’re dealing with a legitimate email, you can always check with the organisation through their official channels to see if they’ve been trying to contact you. Just make sure to use contact details you’ve found yourself from somewhere like the official website of the organisation you’re trying to reach, rather than from any email or message you’ve received. 

Never download any attachments or click on any links you’re not sure of, as doing so, could install malicious software onto your computer or phone, and be on the lookout for abnormalities in caller or sender IDs like dots, special characters, or numbers. 

You can also search suspicious numbers and email addresses online, or even the message itself, to see if it comes up as a known scam.  

What to do if you believe you’ve been targeted by a phishing scam

If you believe you’re being targeted by a phishing scam, stop engaging immediately, then contact your bank or the purported organisation to report the scam and ask them to stop any transactions. Then, to prevent further issues or losses, change the passwords of any accounts that may have been affected on all your devices. 

This might include online banking, emails, government accounts or online shopping accounts. 

You can also reach out to IDCARE, Australia and New Zealand’s national identity and cyber support service, for help. IDCARE offers free advice and can help you make a plan to limit any damage. To get in touch, call them on 1800 595 160 or visit their website to learn more. 

Once you’ve secured your details, you can also report the scam to Scamwatch to help others avoid becoming targeted by the same scam. 

If you believe your AMP bank account or superannuation has been compromised, alert us immediately. 

AMP Bank customers can call 13 30 30. 

AMP Bank GO customers can message us 24/7 in the app. 

AMP Super members can call 13 12 67.