The Cyber Sushi

(serving up the cold facts, with some phish bytes)

Welcome back! Here's what we are covering in this issue:

• “Scambling”: Online gambling scams
• Outreach highlights
• Behind the mask: The guide to new and trending scams
• Ask IDCARE: ‘Can non-government organisations refuse me service if I don’t want to give them my identity credentials?

“Scambling”: Online gambling scams

Scambling refers to online platforms that offer fake gambling services, most commonly casinos and pokies. Some scambling websites use a ‘sit and wait’ approach, targeting people who are actively searching for online gambling, while others use more overt marketing strategies such as social media advertisements.

Criminals craft legitimate looking platforms to trick victims into depositing money and providing identity credentials. They do this through mimicking the strategies and design features of legitimate gambling providers, including offering bonuses and using bright visuals and celebratory sounds.

Scambling sites will generate fake winnings to create the illusion of profits, and in some instances, may even provide a small initial payout as a strategy to gain trust and to encourage further engagement with the site Scambling sites will use deceptive strategies to trick users in to believing their profits are increasing however when the user attempts to withdraw these funds they are unable to do so. Some users even report being told they must make additional payments to access the money. Before engaging an online gambling platform, consider the following to reduce your risk:

• Online casinos, pokies, in-play sports betting, and scratchies are illegal in Australia, meaning there are no legitimate Australian sites providing these services.
• Don’t assume a ‘Sponsored’ or ‘Ad’ result through your browser equals legitimacy, many criminals use strategies to boost their scambling sites.
• Check if the gambling operator is legal through the Australian Communications and Media Authority website. Be sure to cross check the URL as scambling sites have been known to impersonate legitimate providers.

If something doesn’t feel right, stop, check, and verify before making a payment.

Outreach highlights

The IDCARE team delivered a series of outreach sessions throughout August. Some sessions focused on general community awareness whilst others were small business specific. These events play a vital role in equipping people with the knowledge and confidence needed to identify scams, respond to cyber threats, and better protect themselves in an increasingly digital world.

Australian Women in Security Network (AWSN) National Symposium

IDCARE’s CEO Charlotte Davidson presented at the Australian Women in Security Network (AWSN) National Symposium. The presentation was delivered in conjunction with Leanne Swan, the Cyber Trust and Safety Lead for the City of Gold Coast and focused on the joint outreach work between the City of Gold Coast and IDCARE. Charlotte will be delivering a series of outreach sessions at Gold Coast libraries from the 8thto the 10thof September. These sessions will cover the scam landscape, how criminals target people, the warning signs everyone should be aware of, and simple online safety habits. For more information, visit theCity of Gold Coastwebsite.   

Voice, Interests and Education of Women (VIEW) Club presentation
IDCARE’s Cyber Security Clinic delivered a community presentation to the Newmarket VIEW Club. The event highlighted the work of IDCARE, explored common tactics used by cybercriminals, and provided practical advice to help community members stay safe online. The session generated strong engagement, with attendees asking a range of insightful questions and contributing to valuable discussions about cyber safety.

Small business outreach
IDCARE presented a webinar to the Enterprise and Training Company (ETC), a not-for-profit employment and training services provider. The webinar worked to increase awareness on the current scams impacting businesses and provided attendees with practical steps to reduce their risk.  

Behind the mask: The guide to new and trending scams

Tax related scams

It’s not uncommon to see an increase in tax related scams during the Australian tax season. Criminals take advantage of this period, knowing that more people will be anticipating a message from myGov or the Australian Taxation Office (ATO).

myGov and ATO impersonation scams are most commonly delivered through email and SMS phishing messages. These scams replicate similar messaging to legitimate myGOV and ATO communications and are designed to enticerecipientsto engage with the message andprovide login details and other valuable credentials.

As expected, tax file numbers (TFN) and myGov login details are two of the most compromised credentials in these scams, with Medicare card details and driver licence information also often requested. Criminals use these credentials to gain access to  myGov accounts, where they will then amend bank account details and lodge false claims.

Our tips:

• Be cautious of links requesting  personal information.
• Do your own research when provided with contact details to ensure you are engaging the legitimate organisation. Ensure you are using the official government site and/or apps to login.
• Be cautious of urgent language, or messaging indicating you need to take immediate action, this is often a common scam tactic.

If you think you have been targeted by this scam, report the incident to the legitimate organisation and contact IDCARE if you have concerns about your personal information or identity documents.

Ask IDCARE: ‘Can non-government organisations refuse me service if I don’t want to give them my identity credentials?

Our question today comes from Kate

Hi IDCARE,

I recently hired a car and was required to provide my driver licence details. I gave the company my licence details but now I am concerned. It made me think – can non-government organisations refuse me service if I don’t want to give them my identity credentials, and if I do have to provide my information to access the servicecan I ask them to delete my information afterwards?

Hi Kate,

Thank you for your question, your concern is understandable. The short answer is yes to both -but with caveats!.  I will break down the answers below. If you don’t want to comply with a non-governmentorganisation’s request for your driver licence, they have the right to refuse you service. Private companies set their own terms of service and if their policy requires proof of identity, then they can decline services to those who refuse. Under thePrivacy Act 1988

a business can’t collect more information than is reasonably necessary and must take active measures to securely store personal information and destroy or de-identify it once it is no longer needed (in accordance with the Act)

So, if the car hire company collected your driver licence details for identification purposes, once that purpose has been fulfilled, they must delete or deidentify the record. If you are not happy with the business’ response, you can escalate a complaint to the Office of the Australian Information Commissioner (OAIC). If a business is not bound by thePrivacy Act 1988, for example a small business, they may not be legally required to delete your details. However, it is always worth asking if you are concerned.

Have a scam, identity, or cyber-related question? Ask IDCARE!

Every day, IDCARE supports people affected by scams, identity theft, and cybercrime. Our team draws on extensive real-world experience and deep insight into the online criminal environment to help individuals understand risks and take action.

If you have a question for us,  send it to[email protected].

Kind regards,
The Cyber Sushi Team