Is this a scam? Warning signs official sources describe

If you’re not sure whether a message, call or offer is a scam, official guidance comes down to pausing and checking it using contact details you find yourself, not the ones in the message. Most scams don’t look like scams. They look like a text from your bank, a parcel update, a bargain, a job offer or a friendly message. Scamwatch says scams “look like the real thing”, and that scammers often get in touch when people are busy trying to do many things at once. That is why a quick, calm check matters more than spotting perfect spelling mistakes.

If you’re asking “is this a scam?”, this page is a starting point. It has a quick self-check, examples of what scams look like on different channels, practical ways to check whether a contact is genuine, and links to our guide on every common scam type.

Spotting a warning sign doesn’t prove something is a scam, and some scams show none of these signs. Treat each one as a reason to pause and check.

Quick self-check: red flags

Run through these questions. One “yes” is a reason to slow down. Several together are a strong pattern.

• Did it arrive out of the blue? Unexpected contact is one of the most common signs that myGov guidance and Scamwatch describe.
• Is there a deadline or a threat? “Act today”, “your account will be closed”, fines, arrest or debts. myGov lists “a threat of fines, debts or jail” as a warning sign.
• Does it play on strong feelings? Fear, excitement, sympathy or love. Scamwatch says scammers target people’s “desires, fears, and compassion”.
• Are you asked to pay in an unusual way? Gift cards, cryptocurrency, wire transfers, several different accounts, or a “new” account. The ATO says it will never ask for payment by gift cards, crypto, cash delivery or personal or offshore accounts.
• Are you asked to move money to keep it safe? Scamwatch says: “Your bank will never ask you to open new accounts to keep your money safe.”
• Are you asked for a code, password or PIN? The ACSC says to never share log-in details or multi-factor authentication or verification codes with anyone. See how one-time codes work.
• Are you asked to install an app or let someone onto your device? eSafety’s Be Connected guidance says legitimate companies won’t call about a computer or internet problem and ask you to install software that gives them access.
• Is there a link to tap or a number to call in the message itself? These are the details a scammer controls.
• Does the offer seem too good to be true? The ACSC describes “scarcity” offers that create a fear of missing out.
• Are you being asked to keep it secret or stay on the line? The ATO says it won’t demand that you stay on the line.
• Does something just feel off? Scamwatch says to “trust your instincts if something feels wrong”.

Why scams work

Scamwatch describes three core tactics behind most scams:

• Impersonation. Pretending to be “people or organisations you know and trust”, such as a bank, a government agency, a delivery company or a friend.
• Urgency. Creating “time pressure to make you act quickly”, so there’s no time to check.
• Emotion. Using fear, hope, excitement or sympathy to cloud judgement.

The ACSC adds that scammers “exploit current news stories and events to make their claims seem more real”. myGov guidance also notes that “if a scammer already knows something about you, they can be very convincing”, for example after a data breach (why breached information matters). Knowing your name or address doesn’t make a caller genuine.

What scams look like on each channel

The examples below are fictional, with invented names and .example web addresses. They show typical patterns, not any real message.

Text message

“Your account has been locked due to unusual activity. Verify now at secure-account-check.example to avoid suspension.”

What gives it away: unexpected, a deadline, and a link to “verify”. ACMA says scam texts can appear in the same message thread as genuine ones from an organisation, so sitting next to real messages proves nothing. The ACSC also says a text labelled “Unverified” under the sender name can be a sign of a scam.

Read more: phishing, smishing and vishing and impersonation scams.

Email

From: “Accounts Team” <billing@paymnts-portal.example>

“Dear valued customer, your invoice is overdue. Open the attached file to avoid a late fee.”

What gives it away: the ACSC lists generic greetings such as “Dear valued customer”, sender addresses that closely copy a real business with a few characters changed, and unexpected attachments. eSafety’s Be Connected guidance describes checking that the display name matches the actual email address.

Read more: business email compromise.

Phone call

Nadia’s phone shows what looks like a familiar number. The caller says her identity has been used in a crime, she must not tell anyone, and her savings must be moved while “the investigation” runs.

What gives it away: a threat from “authority”, secrecy, pressure to stay on the line, and a request to move money. The National Anti-Scam Centre has warned that scammers can disguise their number to look like a trusted organisation’s.

Read more: threat and extortion scams and remote access scams.

Social media and messaging apps

A message arrives from a friend’s account: “Hey, I’m stuck and my card isn’t working. Can you send $300? I’ll pay you back tonight.” Separately, an ad shows a well-known presenter apparently praising an “automated trading” site.

What gives it away: Scamwatch describes scammers hacking social media accounts to “message your contacts claiming to be friends in need”, and its investment scams page says scammers use “the image, name and characteristics of famous people without their permission” in fake endorsements. Calling the friend on a number you already have is a simple check.

Read more: investment scams, romance scams, job scams and deepfake and voice-cloning scams.

Marketplace and online shopping

Leo lists a couch for sale. A “buyer” agrees to the full price without seeing it and sends an email saying payment is “on hold” until Leo pays a small fee. Meanwhile, a store at bargain-brand-outlet.example is selling designer sneakers at a third of the usual price.

What gives it away: paying to get paid, unusually low prices, and pressure to move off the platform. A December 2024 Scamwatch alert describes fake websites and social media stores that imitate well-known brands, using similar web addresses and page designs.

Read more: marketplace scams and online shopping scams.

Pop-ups and computer warnings

A full-screen warning says the computer “will be damaged” unless a support number is called immediately. Scamwatch describes these fake warnings, and pop-ups claiming you have “only minutes to claim a prize”. See remote access scams.

How to check if it’s real

The common thread in official guidance, including Scamwatch’s Stop. Check. Protect. framework, is simple: don’t use the contact details in the message. Find them yourself. Based on guidance from Scamwatch, the ACSC, myGov and eSafety (checked October 2026):

1. Stop and don’t reply, tap or call back. Scamwatch’s Stop step is to “say no, hang up, or delete suspicious messages”.
2. Find the organisation’s contact details yourself. Use its official website (typed into the browser or found through your own search), its official app, the number on the back of your card, or, as myGov describes, a number on a bill or letter you already have.
3. Log in directly instead of using a link. If a message says there’s a problem with an account, open the app or type the website address and look there. eSafety’s guidance describes this. See also how to check a link before you open it.
4. Check the sender details. Compare the display name with the real email address, and look for small spelling changes or a different domain ending (the ACSC’s example is .com instead of .net), which the ACSC lists as a sign. Our phishing guide shows how to check an email’s real sender address.
5. Search before you click. The ACSC describes searching an unfamiliar web address or business name with the word “review”. Adding “scam” can also surface warnings.
6. Compare with what the organisation says it never does. Many organisations publish this. The ACSC notes, for example, that banks often state they will never request your password. The ATO and Services Australia publish similar lists.
7. For investment offers, check the business. Moneysmart describes searching ASIC’s Professional Registers and the Investor Alert List. Our investment scams guide explains how.
8. Get a second opinion. Scamwatch’s Check step includes asking family, friends or professionals.

Common questions

How can I tell if something is a scam?

Official sources describe common red flags: contact out of the blue, a deadline or threat, strong emotions, unusual payment methods, requests for codes or passwords, and requests to install an app or move money. Scamwatch says scams “look like the real thing”, and some show none of these signs, so each one is a reason to pause and check. Run through the quick self-check.

How can I tell if a text message is a scam?

The signs are the same as on other channels: unexpected contact, a deadline, and a link or number to use. ACMA says scam texts can appear in the same thread as genuine messages, and the ACSC says an “Unverified” label under the sender name can be a sign of a scam. Checking through the organisation’s own app or website avoids using the link in the text. See the text message example.

If a call shows my bank’s real number, can I trust it?

Not necessarily. The National Anti-Scam Centre describes “spoofing”, where scammers disguise their number to look like a trusted organisation’s, and eSafety’s guidance says not to treat caller ID as proof of identity. The check official sources describe is to hang up and contact the organisation on a number you find yourself, such as the one on the back of your card. See How to check if it’s real.

If a message uses my name and address, does that mean it’s real?

No. myGov guidance explains that “if a scammer already knows something about you, they can be very convincing”, for example after a data breach. Knowing your name or address doesn’t make a contact genuine. The same check applies: contact the organisation using details from its official website, its app or a bill you already have. See Why scams work.

What do I do if I clicked a link in a scam message?

It depends on what happened next, such as whether a password was entered or something was downloaded. Our help guide sets out what official sources describe after clicking a link or opening an attachment. IDCARE (1800 595 160) offers free support if personal information may have been shared, and Scamwatch’s first step if money went is to contact your bank or card provider.

Is a bad online purchase the same as a scam?

Not always. Scamwatch describes a scam as “when someone deceives you into providing personal or financial information so they can steal from you”. A faulty product or poor service from a genuine business is different: Scamwatch notes “You have rights under the Australian Consumer Law.” Our online shopping scams guide explains the difference in more detail.

If it’s already happened

Being scammed can happen to anyone. Scamwatch’s steps (checked October 2026):

1. Act fast. “Contact your bank or card provider immediately to report the scam”, and ask them to stop transactions. If you’re unsure, stop sending money.
2. Get help to recover. Contact IDCARE on 1800 595 160 for a free plan to limit the damage. If you’re unhappy with your bank’s response, Scamwatch points to the Australian Financial Complaints Authority (AFCA).
3. Warn others and report. Report to Scamwatch, and make a police report online through cyber.gov.au.
4. Watch for follow-up scams. Scamwatch warns about anyone offering to help get your money back. See money recovery scams.
5. Get support. Scamwatch lists free financial counsellors, Lifeline (13 11 14) and Beyond Blue (1300 22 4636).

Scamwatch’s Protect step also mentions changing passwords that may be compromised, monitoring statements and credit reports, and telling the impersonated organisation and the platform. Our first steps after a scam page brings these together.

Where to report

Scamwatch accepts scam reports at scamwatch.gov.au, and cybercrime can be reported to police through ReportCyber at cyber.gov.au. Telling the organisation that was impersonated, and the platform where the scam happened, can also help. See where to report scams and cybercrime in Australia.

Guides to every scam type

• Impersonation scams: fake banks, government agencies, police and telcos, “safe account” requests and spoofed numbers.
• Investment scams: fake trading platforms, celebrity ads, imposter bonds and how to check a business with ASIC.
• Romance scams: fake profiles and “romance baiting” that leads to money requests or investments.
• Online shopping scams: fake stores, fake ads and how to check a website.
• Marketplace scams: fake buyers, fake payment emails, overpayment and items that don’t exist.
• Job scams: fake job offers, “task” jobs and money mule recruitment.
• Remote access scams: fake tech support and callers who want access to your device.
• Threat and extortion scams: fake debts, fines and arrest threats.
• Money recovery scams: offers to get lost money back, for a fee.

Related threat guides: phishing, smishing and vishing, QR code phishing, deepfake and voice-cloning scams and identity theft.