Phishing emails impersonate trusted organisations — banks, the ATO, Australia Post, Medicare — to steal your credentials or install malware. They've become frighteningly convincing, but there are always tells.
1. Check the Actual Sender Email Address
The display name can say anything. Click on it to reveal the actual email address. "Australia Post" sending from [email protected] is not Australia Post. Legitimate organisations email from their own domain: @auspost.com.au, @ato.gov.au.
2. Hover Over Links Before Clicking
Hover your mouse over any link (don't click) and look at the bottom of your browser window. The real destination appears there. If the email claims to be from your bank but the link goes to bankofaustralia-secure.net, don't click it.
3. Urgency and Threats
"Your account will be closed in 24 hours." "Immediate action required." "Suspicious activity detected." Urgency is a psychological weapon to make you act before you think. Legitimate organisations give you time. The more urgent an email sounds, the more suspicious you should be.
4. Generic Greetings
"Dear Customer" or "Dear Account Holder" instead of your actual name suggests a mass-sent phishing attempt. Your bank knows your name and uses it.
5. Requests for Credentials or Personal Information
No legitimate organisation will ask for your password, full credit card number, or Medicare number via email. Ever. If an email asks for any of these, it's a scam regardless of how official it looks.
6. Unexpected Attachments
An invoice from a supplier you haven't dealt with. A "missed delivery" notification with a PDF. A Word document from an unknown sender asking you to enable macros. These are classic malware delivery mechanisms. Don't open attachments you weren't expecting.
7. Poor Grammar and Spelling
Many phishing emails originate overseas. Subtle errors in grammar, awkward phrasing, or inconsistent formatting are common. That said, AI is making phishing emails better-written, so good grammar is no longer a safety signal.
8. When in Doubt, Go Direct
If you receive an email claiming to be from your bank about suspicious activity, don't click any links in the email. Open a new browser tab, type your bank's address manually, and log in from there. If there's a real problem, it will show up in your account.