Why do careful people get caught?
Scams have got very good. The text looks exactly like the toll company's, the caller knows your name and your bank, the website has the right logo. Being scammed isn't a sign you've done something silly; it's a sign the scammers are organised. What matters now is moving quickly.
Which scams are doing the rounds in Queensland?
- "Unpaid toll" texts using the name of Linkt, which runs Brisbane's toll roads, saying you owe a toll and will be fined unless you pay through a link. Linkt says it never texts or emails asking for personal information or login details: check your account in the Linkt app or website instead.
- Parcel delivery texts saying a delivery failed and asking you to "reschedule" or pay a small fee.
- "Your bank" calling about a suspicious payment, then asking you to move money to a "safe account" or read out a code.
- Fake tech support: a pop-up or a call saying your phone has a virus, then asking you to install an app so they can "fix" it. That app gives them control of your phone. Here's how to deal with pop-ups and fake virus warnings.
- "Hi Mum" or "Hi Dad" messages from a "new number", asking for money.
- myGov, Medicare or ATO texts with a link to "claim a refund" or "update your details".
Since 1 July 2026, Australian phone companies have to label texts from business names that aren't on the ACMA's new sender ID register as "Unverified". An "Unverified" text claiming to be your bank or the toll company is a big red flag. Even a text that isn't labelled can be a scam, though: the register doesn't cover messages from ordinary phone numbers. The ACMA says Australians lost more than $13.8 million to text scams in the first nine months of 2025.
What do I do in the first hour?
- Stop all contact. Hang up, don't reply, don't click anything else.
- Call your bank (and any card provider) straight away, using the number on your card or the bank's website, not one from the text or the caller. Ask them to freeze your cards and accounts and stop any payments. Banks run their scam lines around the clock.
- If they had remote access, turn on Aeroplane Mode to cut them off, then delete the app they had you install (common ones are AnyDesk, TeamViewer, QuickSupport and Zoho Assist). The Australian Cyber Security Centre says to report remote access scams to ReportCyber and contact your bank immediately.
- Change your passwords from another device (a family member's phone or a computer you trust), starting with your email, then your bank, your Apple Account or Google account, and myGov. If someone could see your screen, assume they saw your passwords.
- Turn on two-step login for email and banking, so a password alone isn't enough.
- Call your phone company if you gave out any codes or personal details, and ask them to watch for anyone trying to move your number or swap your SIM.
- Report it: to ReportCyber (cyber.gov.au), which passes reports to police, and to Scamwatch (scamwatch.gov.au).
- Call IDCARE on 1800 595 160, Australia's free identity and cyber support service. They'll help you work out what else to lock down.
Does my phone need a reset?
| What happened | Reset the phone? |
|---|---|
| You clicked a link but didn't type anything | Usually not. Close the page, clear your browser history, keep an eye out. |
| You typed bank or card details into a fake site | Not usually. Call the bank, change passwords. The phone itself wasn't changed. |
| You installed an app a caller asked for, or they had remote control | Yes, after the steps above. You can't be sure what else they changed or left behind. |
| You find apps, profiles or settings you didn't add | Yes. |
| The phone is acting strangely since: pop-ups, battery drain, accounts logging out | Get it checked, and probably yes. |
What to look for first
- iPhone: Settings → General → VPN & Device Management. A profile you don't recognise can give someone control over the phone; remove it.
- Android: Settings → Accessibility, for apps you didn't install that have been given accessibility access (scam apps use it to read the screen), and Settings → Security → Device admin apps.
- Your Apple or Google account: check the list of devices signed in to it, and remove any you don't know.
- Your email: check for forwarding rules you didn't set up. Scammers add them to see your emails quietly.
How do I reset it safely?
A reset (factory reset, or "erase all content and settings") wipes everything, including whatever the scammer installed. Do it carefully, so you keep what matters and don't bring the problem back:
- Save your photos and contacts first: make sure iCloud Photos or Google Photos has finished uploading, and that contacts are syncing to your account. Here's how to back up.
- Erase the phone: Settings → General → Transfer or Reset iPhone → Erase All Content and Settings, or on a Samsung, Settings → General management → Reset → Factory data reset.
- Set it up as a new phone rather than restoring a full backup, which could bring a dodgy app or setting back with it. Sign in to your Apple or Google account (with your new password) to bring back photos and contacts.
- Reinstall apps one by one from the App Store or Play Store, and only the ones you know.
- Set a passcode and turn on two-step login before you start using it again.
What should I watch for in the weeks after?
- Watch your bank statements for small test payments.
- Expect follow-up scams: people who've been scammed often get calls offering to "recover" the money for a fee. That's another scam.
- Ask IDCARE whether you should put a temporary ban on your credit file, so no one can take out credit in your name.
- Talk about it. Telling family and friends what happened is how the next person avoids it.
Sources
- Australian Cyber Security Centre: Protect yourself from remote access scams
- ACMA: SMS Sender ID Register goes live to help protect Australians from scams
- ACMA: Scam alert: remote access requests
- Linkt: Latest scams and security alerts
- Scamwatch: Report a scam
- IDCARE: Get help
- Australian Cyber Security Centre: Secure your mobile phone
Related repairs at Taigum Square