Why Your Bank Will Never Send Secure Login Links from a Low Trust Score

Australian customers regularly receive emails that appear to come from Westpac, ANZ, NAB or Commonwealth Bank. Some announce security changes, new PayID arrangements or a request to review an account. A sender-domain check can expose messages that imitate those brands but originate from a domain with a suspicious history.

A genuine bank may use an unfamiliar sending service, but it should direct customers to sign in through an established first-party domain or its mobile app. If a secure login link points to a domain with a low trust score, customers should treat the message as unsafe rather than rely on its branding or tone.

What a low trust score reveals

A trust score reflects a domain’s history, age, sending patterns and observed associations with spam or malicious activity. It does not automatically prove that one message is fraudulent. However, a newly registered banking domain with poor reputation is very different from a long-established Australian institution’s official .com.au domain.

The difference matters because criminals can copy bank colours, signatures and wording within hours. A link saying “Sign in securely to your account” may resolve to a convincing replica hosted on a disposable domain. Local branch numbers from Sydney, Melbourne or Brisbane can be included as well, making the scam appear relevant to the recipient.

DKIM, DMARC and healthy authentication

Email authentication helps distinguish authorised infrastructure from forged sender addresses. SPF lists servers permitted to send mail, DKIM cryptographically signs messages, and DMARC tells receiving systems what to do when those checks fail. Banks use these controls to protect customer communications, although authentication can only be trusted when the underlying records and keys are maintained properly.

DKIM keys can expire, be replaced incorrectly or become mismatched after a mail migration. Banks should validate DKIM keys regularly and investigate unexpected alignment changes. For Australian domain owners, this includes monitoring both .com.au addresses and any delegated sending domains used by email providers.

When DMARC passes but danger remains

A DMARC pass means the message came from infrastructure authorised by the domain owner and aligned with its policy. It does not mean the content is harmless. An attacker controlling an authorised mailbox could still send a phishing link, while a legitimate account could be compromised and used before detection.

This explains why an apparently valid message can still carry a fake banking page. Security teams should know how to detect DMARC-passing malicious content, rather than equating a successful DMARC result with safety. Payment requests mentioning PayID, urgent account restrictions or alleged fraud charges deserve the same scrutiny regardless of authentication results.

Safe responses to suspicious bank messages

Do not open a login link from an unfamiliar or low-trust domain. Open the banking app independently, navigate to the bank’s official site by typing its known address, or call the number printed on the back of the card. Search-engine advertisements and phone numbers supplied inside the suspicious message should not be used for verification.

If the link has already been opened, close the page without entering information. If credentials were entered, contact the bank immediately, change the password through a trusted device, revoke active sessions and review recent transactions. Australian customers can also report suspicious messages to Scamwatch or the Australian Cyber Security Centre’s report.cyber.gov.au service. Prompt reporting helps disrupt campaigns targeting major Australian bank customers.

Strengthening domain trust at scale

Domain owners build credibility by maintaining stable DNS records, rotating DKIM keys correctly, enforcing SPF and DMARC, and monitoring unexpected traffic. A low sender score can be investigated through DNS diagnostics and authentication checks, allowing security teams to distinguish a configuration fault from an impersonation campaign.

Larger organisations can use bulk tools to find weakly authenticated domains across their industry or supplier network. Trusted Sender Score also provides API access for embedding domain checks into support, procurement and email-security workflows. Secure banking links should always lead through trusted, accountable infrastructure, never through a domain whose reputation remains unexplained.