Scammed or clicked a suspicious link? First steps

If you’ve been scammed, official sources describe acting quickly: Scamwatch’s first step is to contact your bank or card provider straight away and ask it to stop any transactions, and to stop sending money. Realising you may have been tricked is stressful, and it can happen to anyone. This page summarises what official sources say to do if you’ve been scammed or clicked a suspicious link, covering common situations in the order they describe. CyberThreats.au can’t take reports or assess your situation; Scamwatch, IDCARE, your bank and the other services named here can.

Not sure yet whether it was a scam? The quick scam red-flag checklist sets out the warning signs official sources describe.

Find your situation

Scamwatch’s guidance puts contacting the bank first, so if more than one situation applies, the money section comes first here too.

• I sent money or gave card or bank details
• I entered a password on a page or form
• I clicked a link or opened an attachment
• I shared identity details, such as my licence, passport or Medicare number
• I let someone connect to my computer or phone

If you sent money or card details

What Scamwatch and the ACSC say to do:

1. Contact the bank or card provider. Scamwatch says to act fast: contact your bank or card provider right away and ask it to stop any transactions. The ACSC’s guidance says to use the bank’s official phone number.
2. Stop sending money. Scamwatch notes that scammers keep asking for more until you stop.
3. Record what happened. The ACSC’s hacking guidance describes noting what happened, when it happened, whether someone contacted you and how you responded.

If you’re unhappy with your bank’s response, Scamwatch says you can complain to the Australian Financial Complaints Authority (AFCA).

If you entered a password

What the ACSC and Scamwatch describe:

1. Use a trusted device. The ACSC says to follow recovery steps on a device known to be free from malware, or the account may be compromised again.
2. Change the password. Scamwatch lists online accounts such as banking, email, government and shopping. The ACSC explains that email is especially valuable to criminals because it can be used to reset other passwords.
3. Log in directly. The ACSC says to change the password by going to the platform itself, not through emailed or messaged reset links, which cybercriminals often fake.
4. Change accounts that share the password. The ACSC lists checking other accounts, including any using the same password.
5. Turn on multi-factor authentication, log out of all devices and check recovery details. The ACSC lists all three, and says to remove recovery details or sign-in methods you don’t recognise. See how multi-factor authentication works and how to turn it on.

If you can’t get into the account, the ACSC describes using the recovery options the provider offers. See what to do if your account is hacked and plan your account recovery.

If you clicked a link or opened an attachment

What happens next depends on what was entered or downloaded. Our phishing guide also covers what official sources describe if you’ve already responded to a phishing message.

• If you entered details, the password and money sections above summarise what Scamwatch and the ACSC say to do.
• If software was installed, Scamwatch’s phishing guidance says to take the device to a qualified technician to have it removed.
• If the device may be infected, the ACSC’s hacking guidance describes disconnecting from the internet, scanning for viruses to identify and remove malware, and changing passwords and passphrases. The ACSC’s ransomware guidance points to its 24/7 hotline, 1300 CYBER1 (1300 292 371), or an IT professional for help. See how ransomware works.

If you shared identity details

If a driver licence, passport, Medicare card or similar details were shared, these are the steps official sources describe:

1. Contact IDCARE. Scamwatch describes IDCARE as a free service that can help you make a plan to limit the damage. IDCARE’s individual line is 1800 595 160.
2. Contact the issuing agency. The OAIC’s guidance says to contact the agency that issued the document for advice.
3. Watch for warning signs. IDCARE lists mail that stops arriving, bills for things you didn’t order, a credit application declined without explanation, and debt collectors chasing purchases or loans you never made.

See identity theft explained for more on what official sources describe, including how to place a credit ban.

If you gave someone remote access

Scamwatch explains that these scams usually start with an unexpected call claiming a problem with an account, phone or computer. The caller then asks the person to install screen-sharing or remote desktop software so they can control the device.

What Scamwatch, Victoria Police and the ACSC say to do:

1. Contact the bank. Scamwatch says that if you shared financial information or sent money, to contact your bank immediately.
2. Turn off the remote access software and get the device checked. Victoria Police says to disable any remote access applications or software, and to contact an IT professional to check the device.
3. Get support from IDCARE. Scamwatch says to contact IDCARE on 1800 595 160 if personal information was stolen.
4. Disconnect and change passwords. The ACSC’s hacking guidance describes disconnecting from the internet and changing passwords, and its account guidance says to do this from a device known to be free of malware. Victoria Police also says to change passwords on any affected accounts.

See remote access scams.

Report it

Scamwatch says reports help it stop scammers and warn others, even if money can’t be recovered.

• Scamwatch collects scam reports at scamwatch.gov.au.
• ReportCyber at cyber.gov.au is where Scamwatch points people to make an official police report.
• The platform where it happened: the ACSC’s account guidance describes reporting the incident directly to the account provider.

See where to report scams and cybercrime in Australia.

Common questions

What do I do if I’ve been scammed?

Scamwatch’s first step is to contact your bank or card provider straight away and ask it to stop any transactions, and to stop sending money, because scammers keep asking for more until you stop. The ACSC describes recording what happened. Scamwatch points to IDCARE on 1800 595 160 for help making a plan, and to reporting at scamwatch.gov.au. Find your situation lists the steps for money, passwords, links, ID details and remote access.

Can I get my money back after a scam?

Not always. Scamwatch says reports still help it stop scammers and warn others, even if money can’t be recovered. Its first step is to contact your bank or card provider straight away and ask it to stop any transactions. If you’re unhappy with the bank’s response, Scamwatch says you can complain to AFCA. Scamwatch also warns to be wary of anyone offering to help get money back. See If you sent money or card details.

What do I do if I clicked on a scam link?

It depends on what was entered or downloaded. If you entered a password, the ACSC describes changing it by going directly to the platform, from a device known to be free from malware. If software was installed, Scamwatch says to take the device to a qualified technician. If the device may be infected, the ACSC describes disconnecting from the internet and scanning for viruses. See If you clicked a link or opened an attachment.

What happens if I gave a scammer my licence or passport details?

Official sources describe contacting IDCARE on 1800 595 160, which Scamwatch calls a free service that can help you make a plan to limit the damage. The OAIC’s guidance says to contact the agency that issued the document. IDCARE lists warning signs such as mail that stops arriving, bills for things you didn’t order and debt collectors chasing loans you never made. See If you shared identity details.

What do I do if I let a scammer access my computer?

Scamwatch says to contact your bank immediately if you shared financial information or sent money. Victoria Police says to disable any remote access applications or software, contact an IT professional to check the device, and change passwords on any affected accounts. Scamwatch points to IDCARE on 1800 595 160 if personal information was stolen. See If you gave someone remote access.

Where do I report a scam in Australia?

Scamwatch collects scam reports at scamwatch.gov.au, and points people to ReportCyber at cyber.gov.au to make an official police report. The ACSC’s account guidance also describes reporting the incident directly to the platform where it happened. Scamwatch says reports help it stop scammers and warn others. See Report it and the full directory of where to report scams and cybercrime in Australia.

Watch for follow-up scams

Scamwatch warns that scammers often return to people they’ve scammed, and to be wary of anyone offering to help get money back. See money recovery scams.

Support after a scam

Being scammed can affect sleep, mood and confidence. Scamwatch points to free financial counselling if a scam has caused money problems, and lists Lifeline (13 11 14, 24/7) and Beyond Blue (1300 22 4636). It also mentions reaching out to family and friends.