‘Don’t be embarrassed’: Cybersecurity expert’s tip to avoid scams online

A leading cybersecurity expert has warned Australians not to be “embarrassed” about asking companies how they store personal data as a wave of breaches pushes data safety into the spotlight.

Australians continue to be impacted by data breaches, with recent confirmed incidents involving Origin Energy and healthcare provider Partnered Health renewing widespread concerns about personal information safety.

These corporate breaches come alongside a relentless wave of attempted phone scams, including fake ATO text messages requesting detail updates and fraudulent Qantas Rewards alerts urging recipients to click links before their points expire.

While the frequency of these attacks has left many Australians feeling vulnerable, Rajiv Shah, Director from the Australian Information Security Association (AISA), says the recent surge in reports isn't entirely bad news.

“There is an element of organisations getting better at detecting breaches, and better discipline around disclosure and reporting,” Shah told nine.com.au.

For Australians unsettled by texts, emails, and corporate leaks, Shah says taking proactive, everyday precautions is the best line of defence.

Upgrade beyond basic passwords

To keep accounts secure, basic security questions and repeated passwords need to be retired.

Read more

Origin confirms customer data stolen in cyber hack

“Relying on your mother’s maiden name or date of birth as something only you know doesn’t work any more,” Shah warned.

Instead, he advises users to adopt pass keys, use authenticators and stop password reuse.

“The best solution is to use passkeys if available,” he said.

“More organisations are offering these now. It can be fiddly to set up first, but it’s definitely worth the effort.”

Shah added that Australians should turn on multifactor authentication using authenticator apps or SMS codes as additional logon checks, and to never use the same password across multiple online accounts.

Treat unsolicited calls and texts with scepticism

Scammers regularly use leaked data to make fake calls feel legitimate, but Shah urges consumers to stay cautious.

“Just because they know information about you, your accounts, or your activity doesn’t guarantee they are genuine,” he explained.

Many Australian banks now feature in-app caller verification tools. If that isn't available, Shah recommends taking a reference number, hanging up, and calling the organisation back using the verified number listed on their official website.

Likewise, if you receive a fraud alert regarding your account, never click the link or call the number in the message.

Access the service directly via their official app or browser site.

Think twice before handing over everyday data

Australians should also evaluate how much data they share on a daily basis.

Read more

Healthcare provider hit by cyberattack ‘should have been more prepared’

“Think about what data you hand over to whom,” Shah urged. “For example, if ordering from a QR code in a restaurant, do they need your real details?”

Furthermore, consumers should start treating cyber safety like any other product standard before signing up with new companies.

“If we ask companies how they protect our data before doing business with them, this changes the incentives,” Shah explained.

“The same way we check the safety rating of a car before buying it, companies need to know how they protect our data is part of our decisions on who to buy from.

“Don’t be embarrassed to ask questions. This is how we make sure cybersecurity is taken seriously.”