A message claiming to come from your bank can create immediate pressure. It may warn that your account will be closed, a payment has been blocked, or your online banking access needs to be verified. The email may use the bank’s colours, logo, legal wording and even your name, making it difficult to judge quickly.
Bank impersonation scams are common in Australia because people regularly use mobile banking, PayID, Osko, card payments and electronic statements. Criminals take advantage of these everyday habits to steal passwords, one-time codes, card details or identity documents. A convincing message can arrive while you are commuting through Sydney, shopping online in Melbourne or checking email during a busy workday in Brisbane.
The safest response is to slow down and separate the message from the action it demands. Do not click a link, open an unexpected attachment or reply with personal information. Instead, verify the issue through an official channel that you find independently, rather than through contact details contained in the suspicious email.
The advice below applies whether the message claims to be from a major bank, a credit union, a digital lender or a payment service. It also helps when the email appears to mention a genuine transaction. A scammer may copy details from a data breach or use a small real purchase to make a larger fraud attempt seem credible.
Urgency is one of the strongest warning signs in a phishing email. Scammers may say that your account will be suspended within hours, that a suspicious transfer requires immediate approval, or that you must confirm your identity to avoid a fee. This language is designed to make you act before you inspect the message carefully.
Put the email aside and take a moment to consider whether the request makes sense. Banks may send alerts about transactions, but they generally do not ask customers to disclose online banking passwords, full card numbers, PINs or security codes by email. Treat unexpected requests for these details as a serious warning.
Do not call a number printed in the email simply because it looks professional. Do not use a login button in the message to check your account. Close the message if necessary, and access your bank through its official mobile app, a bookmarked website or a telephone number printed on your physical card.
The displayed sender name is not reliable. A message may appear as “Your Bank Security Team” while the actual address contains random characters, a misspelled domain or an unrelated business name. On a phone, tap the sender’s name to view the full email address rather than relying on the short preview.
Look for subtle changes such as an extra word, a different domain ending or a substituted letter. A fraudulent address might use a bank’s name in a subdomain, while the real organisation is identified only after the final “@”. Still, a familiar-looking address is not absolute proof that the message is genuine because accounts can be spoofed or compromised.
Examine the greeting, spelling, formatting and timing. An email addressed to “Dear customer” is not automatically fraudulent, and a polished message is not automatically safe. However, unusual grammar, inconsistent branding, unexplained attachments and a request that conflicts with how your bank normally communicates should increase your suspicion.
Phishing links often lead to a counterfeit banking page that copies the appearance of a real login screen. The address may contain a lock symbol or use HTTPS, but those features only indicate that the connection is encrypted; they do not prove that the website belongs to your bank. Never enter credentials simply because a page looks familiar.
Hover over a link on a computer to preview its destination without opening it. On a phone, avoid tapping it altogether. A shortened web address, a string of unrelated characters or a destination that does not match your bank’s official domain is a strong reason to delete the message or report it.
Unexpected attachments can contain malware, fake invoices or forms designed to collect information. Do not open HTML files, compressed folders, documents or “security forms” sent without warning. Replying can also confirm that your address is active and may invite further scams, so use an independent support channel instead.
Open your banking app directly, type the bank’s known website address into the browser, or use a number printed on your debit or credit card. Check recent transactions, scheduled payments, new payees and changes to contact details. If the email refers to a particular transfer, compare the information with your own account records.
Australian customers should be cautious about messages involving PayID, Osko and instant transfers. A scammer may claim that a payment is waiting for release or that you must “upgrade” a PayID account. These services do not require you to hand over your banking password through an unsolicited email. If something appears wrong, ask the bank to confirm the transaction using its secure channel.
You can also contact the organisation using details from an official statement or its verified website. Banks may record scam reports and advise whether they need to place a temporary restriction on the account. If a transfer has already been made, speed matters: ask the bank whether the payment can be recalled and provide the full transaction details.
If the email is fraudulent, report it to your bank and to Scamwatch, which is operated by the Australian Competition and Consumer Commission. Scamwatch reports help authorities identify patterns, although reporting does not guarantee that lost money will be recovered. You can also report suspicious cyber activity through the Australian Cyber Security Centre where appropriate.
If you clicked a link but did not enter information, close the page, run security updates and monitor your accounts. If you entered a password, change it immediately through the genuine banking website or app. Change the same password anywhere else it was used, because criminals often test stolen credentials on email, shopping and social media accounts.
If you supplied card details, contact the bank and ask whether the card should be cancelled or replaced. If personal identity documents were provided, consider contacting IDCARE for guidance. Where money has been stolen or an identity crime has occurred, make a report to the police and keep copies of emails, screenshots, bank messages and transaction records.
The ePayments Code, administered by the Australian Securities and Investments Commission, sets rules for certain electronic payment transactions and unauthorised payments. Whether a customer receives a refund can depend on the facts, including how quickly the incident was reported, whether security obligations were followed and whether the customer contributed to the loss.
A bank may investigate whether a payment was genuinely unauthorised, whether warnings were provided and whether the customer acted honestly. Scam payments can be complicated because a person may have been tricked into authorising a transfer themselves. Keep communication factual and provide a clear timeline of what happened.
Australia’s Privacy Act and related identity-protection processes may also become relevant if an organisation has exposed personal information. Ask the affected organisation what data was involved and what protective steps it recommends. You can place extra attention on credit activity and consider checking credit reports with Australian credit reporting bodies if identity misuse is a concern.
Financial stress can make scam decisions harder, especially when a person is tired or worried about overdue bills. Research and practical discussion about sleep and money can help explain why postponing a high-pressure decision is a useful safety habit, not a sign that the matter is being ignored.
A few routine measures can make suspicious bank emails easier to handle. They are particularly useful in households where several people share devices, manage joint accounts or regularly shop through online marketplaces.
It is also useful to separate routine account checking from reacting to an alarming email. Log in at a regular time through the official app and review the account calmly. This reduces the chance that a message will control the timing of your decision. If several people manage household finances, agree on a simple rule: no large transfer or new payee is approved solely because an email says it is urgent.
If you replied but did not provide sensitive details, stop communicating with the sender and report the message. Be alert for follow-up calls or texts claiming to be from the bank’s fraud department. Criminals sometimes use the first response to begin a longer impersonation attempt, including requests for remote access to your computer.
If you clicked through and entered your banking login, contact the bank immediately using an official number. Ask whether online access, cards, payees and transfers should be temporarily restricted. Change your email password as well, especially if the same password was reused, because access to your email can allow criminals to reset other accounts.
If you disclosed a one-time password or authorised a payment, explain exactly what happened rather than assuming the transaction cannot be challenged. Write down the time of the email, the information you supplied, the device used and any transaction references. Fast, accurate reporting gives the bank the best opportunity to investigate and attempt recovery.
A calm household response is valuable after an incident. Review other accounts, remove suspicious applications or browser extensions, and warn family members about the impersonation method without sharing unnecessary personal details. Community education can be practical and local; even a neighbourhood book exchange can become an opportunity to share reliable information about scams and digital safety.
A suspicious bank email should be treated as an unverified claim, not an instruction. Stop, inspect it without clicking, contact the bank through an independent route, and report any exposure quickly. The key thing to remember is that a genuine bank will not require you to surrender control of your account just because an unexpected email creates pressure.