Stop phishing emails that impersonate trusted senders

Phishing emails can copy the display name, logo and tone of someone you know, making a fraudulent message look routine in a crowded inbox. A display name does not prove who sent the email, so learning how to stop falling for phishing emails that use the display name of a trusted sender is essential.

In Australia, many important interactions still arrive by email, including tax notices, Medicare updates, bank alerts and parcel notifications from Australia Post. Australians often call malicious messages “email scams”, and a friendly “G’day” or casual greeting can make fraudulent copy seem familiar. Logos, Australian English and a convincing context may lower your guard without establishing authenticity.

The safest response is deliberate verification rather than an immediate reaction. Check the actual sender and link destination, test unusual requests through a separate channel, and treat the familiar name as one clue rather than proof.

Read the full sender identity

Expand the sender details in your email application and examine the full address, reply-to address and destination behind every link. A genuine colleague might use name@company.com.au, while an attacker could hide a similar address behind another domain, use a misspelled company name or display a reply-to address at an unrelated mailbox. On mobile devices, long-press a link to inspect its destination without opening it.

Look closely at unfamiliar domains, including subtle substitutions such as a missing letter, an extra hyphen or a different top-level domain. Run the visible domain through sender trust checks and compare its reputation with the organisation’s known website. Domain reputation helps identify spoofing, but it should still be combined with careful inspection.

Recognise urgency and familiar local pretexts

Phishing messages manufacture pressure by threatening suspension, demanding an immediate payment or presenting a delivery problem that requires action “within 24 hours”. Australian examples may imitate an Australian Taxation Office refund, a Services Australia payment, a Medicare claim, a bank fraud warning or an Australia Post redelivery fee. These themes exploit services that people genuinely rely on and trust.

Urgent wording alone is not evidence of fraud. A legitimate message can arrive outside normal hours because of Australia’s time zones or distributed teams in Sydney, Melbourne, Brisbane and Perth. Check whether the request makes sense, especially if it changes bank details, asks for credentials or introduces an unexpected attachment. Messages written in polished Australian English can be just as deceptive as badly worded ones.

Verify through a separate channel

Do not use contact details or links inside a suspicious message to confirm that message. Open the organisation’s app, type its known website address yourself or call a number printed on your card, invoice or official document. For workplace requests, contact the supposed sender through the company directory or a new chat message rather than replying to the email.

Be cautious with attachments, QR codes and shortened links, particularly HTML files, ZIP archives and invoices containing macros. If a message asks you to sign in, approve a payment or change authentication settings, open the service directly and complete the task there. A genuine organisation should be able to verify the request through its established support process without requiring secrecy or immediate action.

Strengthen authentication for your domain

Organisations can make spoofing harder by publishing SPF, DKIM and DMARC records in DNS. SPF lists servers permitted to send the domain’s email, DKIM cryptically signs outgoing messages, and DMARC tells receiving servers what to do when authentication fails. Effective DMARC deployment also requires alignment, ensuring the visible domain matches the authenticated domain rather than merely passing a technical check.

Authentication reduces the usefulness of display-name impersonation, but it cannot prevent a criminal from sending a link to a fake login page from an unrelated domain. Domain owners should monitor authentication reports, investigate unexpected senders and progress towards a quarantine or reject policy. The about Trusted Sender Score page explains the platform’s approach, while bulk domain checking, developer tools and an API can help teams verify trust within existing workflows.

Contain harm and report suspicious messages

If you clicked a link but entered no information, close the page and report the message through your email provider. If you supplied a password or approved an MFA prompt, change the password from a trusted device, revoke active sessions, replace affected MFA methods and contact your bank if the account was financial. An unexpected attachment or unexplained account activity warrants isolating the device and seeking professional IT support.

Report scams to Scamwatch and the Australian Signals Directorate’s Cyber Security Centre. Organisations should preserve the message headers, block relevant indicators and alert other staff quickly. If personal information was compromised, consider the Notifiable Data Breaches scheme under the Privacy Act and notify the Office of the Australian Information Commissioner when required. A brief pause and an independent check can prevent a convincing display name from becoming a serious security incident.