Protect yourself from cyber scams: One member's story

A long-time CFS member – we’ll call him Jack, to protect his privacy – received an email recently from someone claiming to be from a prominent anti-virus software firm.  

The email stated that a payment would be taken out of Jack’s bank account to renew his subscription to the anti-virus software.  

Jack clicked the link in the email, responding that he didn’t think he’d ever held such a subscription, but if he had, he wanted to cancel it. 

Later that day, Jack received a phone call from someone claiming to be from the anti-virus firm.  

The person on the phone told him that he could refund money for the subscription payment to Jack’s bank account, but to do that, he would need access to Jack’s computer. 

Jack complied with the request, and the fraudster on the other end of the line was granted remote access.  

The scammer used information obtained from Jack to request two withdrawals totalling $90,000 from Jack’s investment account online to his actual bank account without Jack realising he had provided enough information for the fraudster to access his investment account. Having gained access to Jack’s bank account, the scammer could then have transferred it to a fraudulent account. 

At the end of the conversation, Jack felt something was not quite right about the call and went to his local bank branch, where he learnt the two withdrawals had been processed. 

A block was placed on Jack’s bank account to secure the funds for recovery back to CFS, and he called the CFS contact centre to advise that the withdrawal requests were unauthorised. 

In addition to stopping this loss, our fraud analyst spent time educating Jack on how to secure his identity and his computer moving forward. Jack has since contacted our fraud analyst with questions on how to ensure his device is safe. 

Fortunately, this salutary tale – which all began with a single click in an email – had a happy outcome. Jack acted on his feeling that something about the call felt wrong and contacted both his bank and CFS in time for the fraud to be prevented. 

The scam that almost defrauded Jack of $90,000 began with a phishing email that appeared to be genuine, purporting to be from a reputable company. Phishing is a way scammers trick people into giving them personal information, often by sending emails or text messages pretending to be from trusted organisations. 

Scam activity is becoming very sophisticated, and the emails, websites, advertisements, videos and other materials scammers create to fraudulently obtain money often look very convincing. 

Investment scams alone – which often promise high returns from a specific (but fake) investment opportunity – were responsible for losses worth a reported $1.3 billion in 2023, down from $1.5 billion in 2022, according to a National Anti-Scam Centre report from May this year*.  

According to data reported to Scamwatch, the average amount lost to investment scams in 2023 was $81,000*. 

Total losses have been trending down, following collaboration by government and industry to reduce scam activity by working directly with social media networks and communications companies to disrupt the ways scammers reach and communicate with targets, and to report fraudulent behaviour. 

Australians are being exposed to a wide variety of investment scams, including: 

• Fake Initial Public Offerings (IPOs) 
• Superannuation scams 
• Contract for Difference (CFD) and foreign exchange scams  
• Imposter bond and term deposit scams 
• AI trading platform scams. 

In the case of imposter bond and term deposit scams, fraudsters may create fake websites, advertisements or email addresses depicting or impersonating a licenced financial services firm’s bond and term deposit investment options. 

People may be exposed to these scams when conducting online research into low-risk investment opportunities, such as on digital platforms, or when attempting to compare market rates for investments in term deposits and bonds. They believe they are investing with a legitimate company or bank and may then be contacted by someone claiming to be from that company. 

A scammer may contact people pretending to be from a legitimate financial firm, ask for their personal or account details, or send them an email with a link to gain access to their computer. 

They may try to transfer funds to another account or use stolen MyGov details to access personal details and attempt to access their account. 

AI trading platform scams often entice inexperienced investors who are not actively looking for investment opportunities to start online trading with the promise of leveraging AI software to generate high returns. People may see advertisements and online news articles featuring fake celebrity endorsements endorsing the platform. Early ‘gains’ on the platform are then followed by losses. 

The Moneysmart website lists a range of investment scams to watch out for.  

October is Cyber Security Awareness Month, and this year’s theme is ‘Cyber security is everyone's business’. It’s a good reminder to take steps to protect yourself against scams, particularly those that originate online. 

Some of the things you can do to help protect yourself from scam activity include: 

• Turn on multi-factor authentication (MFA) 
• Recognise and report phishing 
• Use strong passphrases and avoid password reuse 
• Apply software updates. 

If someone contacts you with an investment opportunity, always do your own research.  

Search for and contact organisations independently of any materials you may have received, particularly if you have responded to something online. 

You can also search Moneysmart’s investor alert list for information about investment opportunities presented by organisations and websites that may be fraudulent. 

The CFS Staying safe online hub contains more tips and resources to help you avoid scams.