Most phishing emails give themselves away in four places: the sender, the request, the links and the pressure. Here are the red flags to check, how the common Australian scams work, and a free trainer you can paste a suspicious email into or practise on with your team.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n Phishing is an email, text or call that pretends to come from someone you trust so you’ll hand over a password, a code, money or access. The Australian Cyber Security Centre (ACSC) warns that these messages can look genuine and convincing. Looking for spelling mistakes isn’t enough. Many phishing emails are well written, and some are sent from a genuine account that has already been taken over.<\/p>\n\n\n\n The numbers show why it’s worth a few minutes of training. In 2025, phishing was the most reported scam to Scamwatch, with 65,361 reports, according to the ACCC and the National Anti-Scam Centre. In the combined data from Scamwatch, ReportCyber and the other organisations that share scam reports with the National Anti-Scam Centre, reported losses to phishing were $97.6 million. Payment redirection, a close cousin that often targets businesses, accounted for a further $166.8 million.<\/p>\n\n\n\n The good news is that phishing relies on a small set of tricks, and once you know them most attempts become obvious.<\/p>\n\n\n\n Before you click, reply, pay, scan or open anything, ask:<\/p>\n\n\n\n If the answer to the second question is anything involving money, passwords, codes or files, verify the request through a separate channel even if everything else looks right.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
Why phishing still works<\/h2>\n\n\n\n
\n\n\n\nThe 30-second check: four questions<\/h2>\n\n\n\n
\n\n