IT'S NOT ABOUT INTELLIGENCE

Have you ever thought, “I’m too smart to be scammed”, or “I don’t know how people fall for that”? What about “only older people get scammed”?

Many people believe scams only affect those who aren’t very tech savvy, or that intelligence is enough to stay safe. In reality, scams can, and do, affect people of all ages and backgrounds – our data shows the majority of individuals who engage our service are working age adults, aged 18 – 54, across a range of locations and all demographics.

Scams often occur at moments when life is busy or in situations where the context of the scam can seem believable. At IDCARE, we regularly support people who tell us they never thought they would be involved in a scam.

Key takeaways

• Scams can affect anyone – there is no correlation between scam compliance and a person’s intelligence.

How does it work?

Most financially motivated cybercrime relies on a tactic called social engineering. This simply means tricking people into doing things they normally wouldn’t do by using fear, urgency, or trust.

Let’s use what we call a Remote Access Scam or IT Support Scam as an example:

Bob is scrolling through social media and comes across an interesting article he wants to read. It might be about a current event or something else designed to grab attention.

He clicks the post, which takes him to a website. Suddenly, the screen fills with warning messages, flashing alerts, sounds, and instructions telling him his device is infected. The messages urge him to call a phone number immediately to “secure” his device.

This is the hook. Cybercriminals try to put people into a heightened state. When we feel alarmed or rushed, we don’t think as clearly as we do when we’re calm, and we’re more likely to follow instructions without questioning them.

When Bob calls the number, the person on the other end claims to be from technical support and tells him they can help fix the problem. Bob is asked to download an application so the person can “check” or “secure” his device.

The application itself may be a real program used for remote support, which can add a layer of validity, but once Bob installs it and allows access, the caller can see and control his device.

While connected, the caller may point out normal computer behaviours and tells Bob these are signs of serious problems or hackers. This makes the situation feel even more urgent.

Bob is then told the issue needs immediate action, often requiring payment for a service or ongoing protection. Wanting the problem resolved and trusting the person on the phone, Bob may agree to pay or provide personal information.

By the time Bob realises something isn’t right, money may already have been stolen, and his device, identity, or accounts may be at risk.

Some other examples of common scams we see are:

-        Fake delivery or missed package messages.

-        Messages claiming to be from myGov stating you have a new message.

-        Investment opportunities promising fast, guaranteed, and high returns.

-        Fake job offers that require upfront fees, personal details, or identity documents.

-        Extortion scams that threaten to share sensitive data if payment isn’t made.

-        Romance scams where an online relationship is established before money is requested.

-        Funds recovery or refund scams targeting people who have previously lost money.

While the stories and details may differ, these scams rely on the same tactics of creating urgency, impersonating familiar people or organisations, and applying pressure so individuals believe they need to act quickly.

But how can it affect me?

Every person can be affected by scams and cybercrime.

Even experts can be caught off guard. One well known cybersecurity consultant who authored books on phishing and social engineering once clicked a fake Amazon email while packing for a flight telling him his bank card had been declined. He had recently been shopping on the Amazon website, was distracted, and the message looked legitimate.

Although he entered his password into the website, he noticed the fake website in time and secured his account. The experience highlighted an important truth – scams succeed not because people are unintelligent or careless, but because they catch us when we’re human.

What you can do to reduce the risk

• Use strong, unique passwords for important accounts like email, banking and government services.
• Turn on two‑factor authentication wherever possible.
• Double check website addresses, especially when clicking links and entering information.
• Avoid clicking advertisements on social media and search engines.
• Be aware of the personal information you share online, even on trusted platforms.
• Pay attention to unusual account activity and act quickly.

For more information on scams and cybercrime, please visit our Learning Centre.

If you are an individual and feel you have been affected by a scam, please contact our National Case Management Centre on 1800 595 160 or submit a Get Help Form for free support and guidance.

If you are a Small Business and you feel you have been affected by a scam or would like to improve your cyber security please contact our Cyber Security Clinic on 1800 595 170‍ or submit a SMB Help Form for free support and guidance. Additionally, you can take a free Small Business Cyber Health Check to assess your cyber resilience.