Get all your news in one place.
100’s of premium titles.
One app.
Start reading
ABC News
ABC News
National
Bridget Judd

Scams, the Optus data breach and keeping your personal data secure — here are the top tips to help you avoid falling victim

So, your personal details have been exposed in a data breach, and you're not sure what it all means? Or perhaps you consider yourself pretty tech savvy, but you're worried about your parents. 

ACCC deputy chair Delia Rickard, AFP Superintendent Brad Marden, veteran cybersecurity journalist Jeremy Kirk, and triple j Hack reporter James Purtill stopped by with their top tips.

Catch up on the full Q&A below!

Key events

To leave a comment on the blog, please log in or sign up for an ABC account.

Live updates

By Bridget Judd

Pinned

Have you been targeted by a scam? Tell us your story

Australians have lost millions of dollars to scams this year.

Have you been recently been targeted by or fallen victim to one?

We want to hear your story — follow the link below to our secure form.

By Bridget Judd

There are steps you can take right now to ensure you don't fall victim to scammers

This is where we'll have to leave things for this afternoon, but thanks for following along and for all of your wonderful questions.

And of course, a massive thank you to ACCC deputy chair Delia Rickard, AFP Superintendent Brad Marden, veteran cybersecurity journalist Jeremy Kirk, and triple j Hack reporter James Purtill for their insights.

We couldn't get to every single submission, but we hope you gained some tips and tricks that will help you better identify scams and how keep your personal data secure.

There are also some steps that you can take right now to ensure you don't fall victim.

Before you go, why not put all that newfound knowledge to the test with our quiz — are you smarter than a scammer?

By Bridget Judd

Key Event

There is some legal recourse for lost or exposed data, but it is 'mostly unsatisfying'

Is there any legal recourse you can take for lost or exposed data?

Thanks for your question, here's Jeremy Kirk:

Jeremy: There are but they’re mostly unsatisfying. Those affected by data breaches can join class-action lawsuits. Those kinds of lawsuits usually end up in settlements that are reached several years later.

For example, credit bureau Equifax had a large breach affecting mostly US consumers that was discovered in 2017, but the settlement only became final this year. It included reimbursement for fraud, losses and fees associated with ID theft. But of course those costs for many people may have been borne upfront years earlier.

By Bridget Judd

Key Event

The ACCC is constantly trawling through the data about scammers

How does the ACCC identify new and changing scams? Do you rely on people reporting them or do you proactively look for them?

Thanks for your question, here's Delia Rickard:

Delia: It is based on people coming forward and this is why the ACCC asks people who have been exposed to a scam — even if they didn't lose any money — to let us know via scamwatch.gov.au.

Because we trawl through that data every day and whenever we see a new scam emerging, we're trying to get warnings out to people and look at what we can do. That may help stop the scam.

By Bridget Judd

Key Event

How to protect yourself in the wake of the Optus leak

If you were compromised, you could get a new driver’s licence, passport or Medicare number and free credit monitoring. But those measures could take days or weeks to kick in.

Here's what to look out for while you're waiting.

How to protect yourself in the wake of the Optus leak

By Bridget Judd

Key Event

Have there been many cases of data breaches being used for coercive control?

Hi - A question for Brad please- Have you seen many cases of data breaches being used for coercive control?

- Claire

Thanks for your question Claire, I've put this one to Brad Marden for you:

Brad: I have not seen any cases where general data breaches involving large numbers of exposed personal details have been used for coercive control. Most people who access that type of data are doing it for financial gain.  However, if someone is in a situation where they are at risk they should take particular care to follow any advice given to them in terms of remediating the data loss and if at risk, contact their local police.

By Bridget Judd

Key Event

Is PayID a safe way to accept payment for items?

Is PayID a safe way to accept payment for items sold through Gumtree or Marketplace?

- Stacey L

Thanks for your question, Stacey. Here's Jeremy Kirk:

Jeremy: It is. But if you are a buyer, just remember that PayID transactions are instantaneous and a transaction could be tricky to reverse if the payment goes to the wrong PayID.

By Bridget Judd

Key Event

If a scammer has enough information about you, they can open accounts in your name

What type of harm does identity theft cause?

Good question — we've put it to Delia Rickard.

Delia: It causes enormous harm and can be incredibly difficult to unravel. When a scammer, a criminal, has enough information about you they can open accounts in your name — bank accounts, credit accounts, running up debts in your name, telco and energy accounts, etc.

They might also be able to get enough information to be able to then try to access important accounts, be it myGov, your Apple ID, your bank account etc.

So it's incredibly important to safeguard your personal information, I don't think most people realise just quite how important it is.

By Bridget Judd

Australians are losing billions in scams — and there are calls for banks to pay them back

Bill Hall lost $26,000 in an invoice scam after an email from his builder was intercepted and resent with new payment information.

The fraudulent invoice looked exactly the same as one sent by Mr Hall's builder a couple of months earlier, except for the bank account number.

After transferring $26,345 to the Citibank account listed on the new invoice, Mr Hall thought his builder had been paid.

It took about three weeks for his financial institution Bendigo Bank and Citibank to tell him they thought he'd been scammed.

"I was shocked, I thought 'how can this happen?'," Mr Hall said.

Do you have a story you want to share? Hit the big blue button at the top of the page, or use our secure form.

By Bridget Judd

Key Event

Scammers are sneaky — in fact, even the cybersecurity reporter was targeted

What’s the number one rule you live by when it comes to keeping your info safe?

Jeremy Kirk has jumped in to tackle this one:

Jeremy: We have to give up our data all of the time to interact in a modern economy. We don’t have a lot of choice or oversight when we give our data to companies and organizations. We’re taking them at their word when they say they’re secure. But we have no way to verify that.

I monitor my credit reports, as successful frauds may surface that way, such as the time someone ordered three iPhones and two Samsung phones in my name. The sad reality is that most people have been caught up in a data breach at one time or another.

I’d recommend signing up with Have I Been Pwned, a service designed by Australian data breach expert Troy Hunt that lets you know if your email address has turned up in a data breach. It sends an alert out when your email address has appeared in a new data leak. That way, you are at least aware of how frequently your data has been compromised.

Also, it’s important to be vigilant and ignore any text messages or emails asking for personal data, login credentials, etc. or try to get you to click on a dodgy link. If you have any doubt about the veracity of a communication, contact the service provider on a verified phone number and clarify if there is, for example, truly a problem with your account. 

By Bridget Judd

Key Event

Companies will often collect more data than they actually need

Some businesses request date of birth but it is not clear why they need it. Sometimes they just want to know how old you are. Actual date of birth is not necessary. Should I refuse to provide my date of birth if the business cannot explain how it will be used?

- Elizabeth Evans

Thanks for your question, Elizabeth, we've put it to Jeremy Kirk:

Jeremy: You can surely try. Companies will often collect more data than they actually need, which is of course risky if it is compromised. Asking questions about data collection practices may help companies more fully realise the level of concern people have about their personal data. Generally, data governance experts recommend that organisations collect no more data than is needed to provide a service and then delete it when it is no longer needed.

By Bridget Judd

Key Event

A single digital ID service sounds nice, but it would also be an irresistible target for hackers

Is there any valid requirement for Telcos to store so much data? Considering that the government already have the MyGovID, surely Telco's could be granted limited read-only access to the database and have access to only first, last name, town of residence? Additionally wouldn't it be possible for the government to produce security keys (similar to Yubikey) for those without mobile phones or skills to use apps etc?

- Steve

Thanks for your question, Steve. Here's James Purtill:

James: This is exactly the idea recently proposed by government. After the Optus hack , the federal government said it was considering whether to develop a single digital identification service that business could use, instead of each company separately storing millions of people’s data.

And it said MyGovID would be the “natural home”, as it has millions of users already.

So yes, it could happen relatively soon, although federal governments have a patchy record with big tech projects (COVIDSafe) and centralising data storage like this would introduce further problems.

Having all the data in one place would be an irresistible target for hackers. And if the nation’s store of MyGovID numbers were somehow compromised, everyone would need to get a new one.

By Bridget Judd

Key Event

Mystery purchases and dodgy texts — these are some of your scam stories

Australians have lost millions of dollars to scams this year. Have you been recently been targeted by or fallen victim to one?

We'll return to our Q&A shortly, but first, we want to hear from you.

Merrowyn: I'd like an easier way to report scams. We lost 1,000 American dollars once on a Visa card that my husband had. I found the 2 transactions, when going through the statement. The bank had no idea. We'd NEVER shopped at Walmarr. Visa itself was brilliant!!! Cancelled the card straight away. Also whoever keeps saying that cash is dead, I wish they would stop. And as for cryptocurrencies. Good grief 😔. It's just all glorified gambling. If it looks too good a deal, it's probably pretty ordinary. It's been very interesting. Thanks all you experts, and especially for the quiz. I got 8/10 so reasonably aware of personal scam problems. Thank heaven.

Jenny: Just got a text from Telstra with a link saying they need to verify billing details. It felt dodgy so rang Telstra who confirmed it wasn’t them

Anne: Recently I tried to purchase shoes online. I was jet lagged and awake in the wee hours. Probably not my sharpest. I found the shoes I liked on a social media site. I then googled the brand and then the Australian version of that website presented itself. I always ‘feel’ safer buying from an Aussie site. Maybe I’m not the only one, maybe the scammers know that about me! It’s over a month ago now. I received a pair of sunglasses from the ‘shop’ which I didn’t order (in replacement of the shoe order?). We alerted our bank. Then realised I had made another purchase for a different pair of shoes from the same scammer. There was also an amount of money that wasn’t related to any purchase. All in all about $600. The investigation is continuing. Was I the perfect sitting duck: jetlagged, Aussie stockist preferred? Not paying attention! They’re clever!

By Bridget Judd

Key Event

What is the risk if a deceased person's data is hacked?

What is the risk if a deceased person’s data is hacked

- Julie

Thanks for your question, Julie. We've put it to Jeremy Kirk and Brad Marden:

Jeremy: On the bright side that person doesn’t have to worry about footing the bill for fraud. Joking aside, the use of the personal information for deceased people is nothing new.  

But it is a risk to banks or other service providers, which might unwittingly not detect the ruse and grant credit to a fraudster who is impersonating someone else, dead or alive.

Brad: All data breaches can have direct and indirect consequences. Criminals can potentially use the data to establish bank accounts or other instruments, such as Australian Business Numbers or registering company names, in the name of the deceased person.

By Bridget Judd

It's not just the Optus data breach that scammers are capitalising on

They're also taking advantage of supply shortages within the agriculture industry, leading to a loss of more than $1.2 million for farmers, according to the ACCC.

Almost 300 reports of fraudulent sales of tractors and other farm machinery have been made to the ACCC's Scamwatch between January and August this year — a 21 per cent increase in reports made for the same period in 2021.

By Bridget Judd

Key Event

Until companies invest in cyber security, we'll continue to see lapses

Is protecting yourself likely to get easier or harder in the future?

Good question. We've put this one to Jeremy Kirk:

Jeremy: I think what’s most frustrating for people about data breaches is the realisation that once you give away your data, it’s gone. And you have to do that in order to use services. And then there’s the sick feeling when your name, address, phone number and other data suddenly just turns up on the Dark Web, as what happened with Optus.

I think until the regulatory landscape matches what consumers expect – that companies will invest in appropriate cyber security controls and adopt best practices that protect personal data or else there will be big fines – we will continue to see lapses.

By Bridget Judd

Being scammed can be traumatic — especially when romance is involved

When you hear from people who have been scammed, are there any commonalities?

Thanks for your question, we've put it to Delia Rickard.

Delia: Many people are quite traumatised by being scammed, particularly romance scam victims, they are most traumatised of all.

The emotions range from anger, to despair, but it also inevitably involves a loss of trust in the online world.  

By Bridget Judd

Key Event

Jeremy spoke to the purported Optus hacker. This is what he learned

What did you learn about the purported Optus “hacker” from having spoken to them? Does it give you any insights into who some of these people are and why they do it? 

Good question! Here's Jeremy Kirk:

Jeremy: I chat with malicious hackers fairly frequently. I approach it like any other interview, with full disclosure of who I am and asking neutral questions such as, “How did you break in their systems?” The Optus hacker told me how they obtained the data (the unauthenticated API), which confirmed what a second, separate source had told me and also what an Optus executive anonymously told the ABC.

Soon afterwards, however, the person withdrew the ransom demand and stopped logging into the forum under that nickname. The goal for that person was to make money via extortion, but when the Optus situation became just a huge news story, I reckon the person thought it might be best to try to quietly slip away.

We’ll see how the police go in the next few weeks and if they can track the person down. The motivations for attacks can include money, notoriety or political aims.

By Bridget Judd

Key Event

Scammers are capitalising on the Optus breach to try and get your personal details

How do I protect myself without spending hours of time, money and mental load?

Good question! Here's Delia Rickard:

Delia: First of all, you need to be constantly aware that scams are out there. You should have strong antivirus software on all your devices and strong passwords. I know people hate that, but that is important.

Remember that you can never really know who you're dealing with online — by which I mean social media, SMS phone calls, emails. So you do need to be on guard and remember that scammers will almost always pretend to be a trusted entity, a government agency, a bank or major retailer, or they will be tapping in on current events. 

So we're seeing scams and scammers at the moment call and have an excuse that they're calling because of the Optus breach. It's essential not to give people personal information, or banking details or money, or remote access to your computer — and never click on any links in texts or emails.

If you think something's real, then don't use the contact information in the communication. Do a Google search, contact the company, go to their website, and tell them about the call and that communication and say 'Is this real or not?' And you'll nearly always find is going to be a scam.

By Bridget Judd

Key Event

If you've been scammed before, you're definitely not alone

Recently I tried to purchase shoes online. I was jet lagged and awake in the wee hours. Probably not my sharpest. I found the shoes I liked on a social media site. I then googled the brand and then the Australian version of that website presented itself. I always ‘feel’ safer buying from an Aussie site. Maybe I’m not the only one, maybe the scammers know that about me! It’s over a month ago now. I received a pair of sunglasses from the ‘shop’ which I didn’t order (in replacement of the shoe order?). We alerted our bank. Then realised I had made another purchase for a different pair of shoes from the same scammer. There was also an amount of money that wasn’t related to any purchase. All in all about $600. The investigation is continuing. Was I the perfect sitting duck: jetlagged, Aussie stockist preferred? Not paying attention! They’re clever!

- Anne

Thanks for writing in, Anne! Here's James Purtill:

James: That’s very clever! Sounds like a classic online shopping scam.

If it’s any consolation, you’re definitely not alone in getting scammed this way.

I just looked up the latest figures on Scamwatch: There have been more than 11,000 reported online shopping scams this year, totalling close to $6 million in losses.

Scamwatch (which is run by the ACCC) has some tips for how to protect yourself:

  • Check the refunds or returns policies

  • Try to find out if it’s an Australian company (not just an Australian website), as you have a better chance of getting your money back

  • When making the online payment, look for “https” in the URL - and a closed padlock symbol

James: I’d add —  Google the site and find if others have had issues. Also, if you think you’ve been scammed, call your bank right away and they may be able to stop the transaction.

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.