The Cyber Sushi

(serving up the cold facts, with some phish bytes)

Welcome back! Here's what we are covering in this issue:

• The Damage You Can't See: Why It's Not Only About the $$$
• Email Accounts Under Attack
• In Their Words: IDCARE Client Stories
• Behind the Mask: New and Trending Scams
• Ask Dr Lacey - "My Son, Who Has an Intellectual Disability, Is in a Romance Scam"

The Damage you Can't See

At IDCARE, we’ve seen how scams and cyber incidents impact far more than bank accounts. They can harm mental health, relationships, jobs, and even a person’s sense of self.

Over the past year, our team has supported hundreds of people affected by cybercrime. Many told us the hardest part wasn’t the money—it was everything else: shame, confusion, anxiety, sadness, and even homelessness.

The Emotional Toll
Scams like investment fraud, romance deception, and phone phishing can leave people feeling completely broken. Some have had to move in with family after losing their home. Others said they struggled to sleep, eat, or trust anyone again.

Even without financial loss, knowing your personal information has been exposed in a data breach or account compromise can be enough to trigger distress. The fear of what could happen next can be overwhelming.

Some incidents are especially likely to lead to this emotional fallout:

• Investment scams: Fake friendships or “mentor” relationships that lead to betrayal and loss.
• Romance scams: Emotional manipulation that leaves victims feeling abused and heartbroken.
• Account or identity compromise: Discovering your personal information is being misused—often without knowing how or why—can be deeply unsettling.
• Phone scams: High-pressure calls from criminals posing as officials can be terrifying and leave lasting fear.

Why This Matters
Many people impacted by scams don’t seek help—especially those who feel ashamed or believe emotional support isn’t “for them.” But cybercrime doesn’t just steal money; it chips away at wellbeing. Recognising this is the first step in helping victims truly recover.

If you or someone you know is struggling after a scam or cyber incident, please reach out. You’re not alone—and it’s not your fault. Our case managers are here to help. Fill in the Get Help form on our website, idcare.org, or visit our Learning Centre. 

 IDCARE's analysts have prepared a comprehensive report for our subscribers on the non-financial harms of cybercrime which explores this topic in detail. If you are interested in purchasing a copy, please email [email protected].

Email Accounts Under Attack

We asked our Small Business Cyber Resilience Service (SBCRS) advisors what issue was causing the most disruption for Australian small businesses. The answer was clear: email compromise.

A review of the more than 1,000 small businesses this federally funded service has supported in the past eight months confirmed it: email accounts being accessed and details changed was the number one misuse recorded.

Nick, one of our advisors, said clients often find it “very confusing to identify what’s going on.”

“Email account access often happens alongside other account compromises, which quickly becomes overwhelming,” he explained. “Many business owners don’t know how the access happened, which only adds to the concern and frustration.”

Email accounts are also the gateway to other valuable accounts. Our team frequently sees email compromise linked to social media account takeovers, myGov access and false invoicing, where customers unknowingly pay criminals instead of the business.

How to reduce your risk

• Turn on multi‑factor authentication (MFA) for every account.
• Use strong, unique passphrases (consider a password manager).
• Regularly review mailbox rules and auto‑forwarding settings.
• Disable legacy protocols like IMAP/POP if you don’t use them.
• Always verify bank detail changes by calling a trusted number before processing payments.
• Back up your email and data regularly so you can recover quickly.

A few proactive steps can stop a stressful, costly email compromise. If this feels overwhelming, we can help.

If you are an Australian small business with 19 or fewer full-time equivalent staff, visit idcare.org/smallbusiness or call the SBCRS on 1800 595 170 – it’s free and confidential.

Doug and the Remote Access Scam 

Real Story: Doug thought he was talking to his bank. He wasn't
Meet Doug. He lives in Caboolture and attended IDCARE's Cyber Resilience Outreach Clinic as part of Redcliffe's very first Be Safe Online Day.

This event was inspired by Redcliffe Uniting Church's Reverend Tim Griggs, who was concerned about the scams impacting his community. It brought together 18 stakeholders from across Moreton Bay Regional Council, IDCARE, Seniors Enquiry Line, ANZ, Westpac, the Australian Taxation Office, police, Scamwatch and others. Over 130 people attended the event to understand how they could stay safe in the online space. Doug was one of them.

Doug shared how two years ago he received a phone call from what he thought was his bank, advising they were concerned about unusual transactions on his account. In 2023, this kind of scam caused over $11 million in financial losses over nine months. Over-55s, like Doug, accounted for 56% of those losses.

Doug gave the criminals access to his device. While they were going through his computer, his screen "went blank". Thankfully, Doug checked his bank account and noticed $300 had been transferred from his account.

He asked them what they were doing—when they couldn't answer, Doug immediately took corrective action. He hung up the phone, turned off the computer, disconnected from the internet and went to his bank.

Unfortunately, Doug couldn't get his $300 back. He was grateful he only lost $300, as others he knew had lost "thousands".

Doug also used IDCARE's services. What did he have to say about it?

You'll have to watch the video to find out. CLICK HERE

NOTE: When Doug is describing what happened in this video, he says something we hear all too often at IDCARE: "Foolish me, I went through all the motions of what they were trying to get me to do." Doug wasn't "foolish". He was targeted by an international criminal gang. He was the victim of a crime.

Behind the mask: The Guide to New and Trending Scams

🚨 Indeed, this is no job: Employment Scams Targeting Job Seekers on Indeed
We’ve seen a sharp rise in employment scams on the popular job search platform Indeed, where job seekers believed they were applying to reputable Australian organisations – only to end up handing over sensitive personal information including:

• bank account and superannuation details
• tax file numbers (TFN)
• copies of their driver’s licence, passport and Medicare card. These scams are convincing and often promise the job immediately to build trust.

Our tips:
✔️ Verify the job offer by contacting the organisation directly through their official website or phone number (not the contact details in the ad).
❌ Never send personal identity documents like your driver’s licence or passport until you’ve met the employer in person and confirmed the role is genuine.

🐾 Pet Microchip Renewal Scams Target Pet Owners
We’re warning pet owners after reports of scam emails claiming your pet’s microchip registration has expired. These emails look legitimate and even include:

• your pet’s name and photo
• microchip number
• an “official” looking payment page asking for a $20 renewal

Our tips:
✔️ Access your pet’s registration account through the official council or registry website, not via links in emails.
❌ Don’t pay any fees or provide details until you’ve verified the request directly with your local pet registry.

💀 Extortion Email Threats: “Pay Me or I’ll Harm You”
Disturbing extortion emails are being sent out claiming someone has paid the sender to harm the recipient (e.g., throw acid in their face). The email demands $2,000 in cryptocurrency within 24 hours to “call off the hit.” Sweetening the deal are promises to reveal the person who "ordered" the attack once the fee is paid.

Our tips:
✔️ These are mass scam emails designed to frighten you into paying.
❌ Do not reply, do not pay, and do not engage. Report the email and delete it immediately.


✝️ Scammers Impersonating Priests Asking for Donations
We’re seeing scams where criminals impersonate well-known priests on Facebook and WhatsApp, requesting donations for “orphanages.” In one case, a scammer used a fake account of a well-known priest and asked for a $400 donation.

Our tips:
✔️ If asked for a donation, verify directly with the organisation or person using official contact details.
❌ Never transfer money or gift cards based solely on social media messages – even if the profile seems legitimate.


🚀 The Elon Musk Fan Scam (X/Twitter)
Scammers are posing as Elon Musk on X/Twitter, claiming to be rewarding loyal followers with cryptocurrency or exclusive “meet and greet” opportunities. One client was asked to:

• create crypto wallets
• share their wallet details
• pay a $2,250 “liquidity fee” to unlock a fake $10 million “reward”

Our tips:
✔️ Be wary of unsolicited opportunities, especially those linked to celebrity accounts.
❌ Legitimate organisations and public figures will never ask you to pay a fee to access winnings or rewards.

Ask Dr Lacey: "My son, Who Has an Intellectual Disability, is in a Romance Scam?"

Have a Scam, Identity, or Cyber-Related Question? Ask Dr. David Lacey!
 
Having dealt with countless cases of scams, identity theft, and cybercrime, Dr. David Lacey is one of Australia’s most respected experts in the field. He is highly sought after by both government and industry for his unique insights into the online criminal environment. In this edition of The Cyber Sushi, Dr. Lacey is inviting you to submit your questions – and we (the Cyber Sushi team) will answer them. Send your questions to [email protected].

Our question today comes from Jillian.

Hi Dr Lacey,

How do i convince my son, who has an intellectual disability, he is in a romance scam

Answer:

Hi Jillian,
Thanks for bravely sharing your question. It is a tough one to navigate, particularly when it is someone you love, and you can see how they are being hurt.

Convincing your son that he’s in a romance scam will take patience and care. The most important thing is to use gentle, reassuring language that focuses on how much you care about him. You might start by saying: “I love you and I just want to make sure you’re safe. You’re really important to me.”

Rather than saying he’s being scammed, frame it as your concern: “I’m worried the person you’re speaking to might not be who they say they are. Sadly, there are people who pretend to be in relationships online just to take advantage of others. It’s not your fault – they’re very skilled at what they do, and they mislead many people.”

You can invite your son to look at the situation with you: “Can we check a few things together, just to be sure? If everything is fine, that’s great – but if it’s not, I don’t want anyone to hurt you or take your money.”

Soothing words like “You’re not in trouble” and “I’ll be here for you no matter what” can help keep him open to the conversation. If he has a trusted doctor, support worker, or friend, involving them can also help him hear the message from someone else he trusts.

If he’s at serious risk, you may need to step in to block payments or communication, but explain why: “This isn’t about taking away your choices – it’s about keeping you safe because I love you.”

Remember, this can take time. He may feel embarrassed or defensive. The key is staying calm, patient and open so he knows he can come to you – no matter what.

He may also want to contact IDCARE for additional support. Our case managers know how to tread these conversations carefully and with compassion. It is never an easy one to have and a lot may be at stake. We also know scammers are unlikely to leave him alone, even if he does realise it is a scam. The global scam expert, Professor Monica Whitty, who is part of the IDCARE Foundation, highlighted in our romance scam podcast how often victims re-engage.

Another suggestion is to help him find a relationship by navigating dating apps with him.

You can listen to our podcast with Professor Whitty HERE.


Kind regards,
The Cyber Sushi Team.