Data privacy and safety – investigations, tips, guides and advice - Vlog /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety You deserve better, safer and fairer products and services. We're the people working to make that happen. Wed, 08 Apr 2026 04:49:02 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.4 /wp-content/uploads/2024/12/favicon.png?w=32 Data privacy and safety – investigations, tips, guides and advice - Vlog /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety 32 32 239272795 Real estate agents, chemists, car hire companies and more under new privacy scrutiny /data-protection-and-privacy/articles/real-estate-agents-car-hire-companies-under-new-privacy-scrutiny Thu, 08 Jan 2026 23:14:20 +0000 /?p=920932 Australia’s privacy regulator is reviewing the privacy policies of businesses collecting your personal data during in-person interactions.

The post Real estate agents, chemists, car hire companies and more under new privacy scrutiny appeared first on Vlog.

]]>

Need to know

  • In recent years, Vlog has conducted several investigations that focused on the far-reaching permissions privacy policies give the businesses that write them
  • In 2023, we reported on the privacy policies of rental platforms, and last year we analysed the privacy policies of Australia’s ten most popular car brands
  • This month, the Office of the Australian Privacy Commissioner begins its first full-scale privacy policy review, focusing on information demanded by businesses in person

Very few of us read the privacy policies we passively consent to when engaging with a service provider. Fewer still would understand what these privacy policies actually say.

In recent years, Vlog has conducted several investigations that focused on the far-reaching permissions these documents give the businesses we regularly interact with.

In 2023, we reported on the privacy policies of rental platforms such as realestate.com.au’s Ignite as well as Ailo, Tenant Options, Rental Rewards, Snug, 2Apply and Simple Rent.

The conclusion? These RentTech platforms collected information that went well beyond what’s needed to assess a tenant’s ability to pay the rent. The questions often seemed designed to grab as much data as possible from people who had no choice but to provide it.

In 2024, we analysed the privacy policies of Australia’s ten most popular car brands to see how the vehicles monitored and tracked their drivers. Here again we found that the harvesting of personal driver information was often excessive, and the rights the manufacturers gave themselves to share the data with third-parties were both far-reaching and vague.

The ACCC has estimated that it would take the average Australian 46 hours to read all the privacy policies they encountered in a month, the average length of which is about 6876 words.


The ACCC has estimated that it would take the average Australian 46 hours to read all the privacy policies they encountered in a month

All of this makes the Office of the Australian Information Commissioner’s (OAIC) recent announcement that it will begin its first large-scale review of privacy policies in early January 2026 more timely than ever.

What’s changing in privacy law?

The Privacy Act requires privacy policies to contain certain details, such as what information is collected, why it’s needed, how it’s used, and how it can be corrected if necessary. 

An update to the Act in 2024 means businesses will also be required (as of 10 December 2026) to specify in their privacy policies whether a computer program will be using your personal information to make decisions that could go against you, such as when an application for a rental home is rejected. 

The privacy policy sweep is … focusing on information demanded by businesses in person, such as when a real estate agent asks you for personal details when you’re inspecting a rental property or a car rental company presents you with a lengthy form before handing you the keys

In addition, the 2024 update gave the OAIC the power to issue infringement notices for Privacy Act violations without going to court. And it gives individuals the right to seek legal redress and financial compensation in certain cases for invasions of privacy or misuse of their personal information.

The OAIC’s privacy policy sweep is taking a different approach than our investigations of online privacy documents. It will occur in the real world, focusing on information demanded by businesses in person, such as when a real estate agent asks you for personal details when you’re inspecting a rental property or a car rental company presents you with a lengthy form before handing you the keys. The privacy policies of such businesses must include the above-mentioned information. 

Not having the right information in a privacy policy – or not having a privacy policy at all – could lead to fines from the OAIC of up to $66,000.

Which types of businesses will be targeted?

The privacy policy sweep will focus on sectors where the OAIC believes there are particular power imbalances – also known as information asymmetries – between the business in question and the customers being asked to provide the information.

When confronted with in-person requests for their personal information … consumers often don’t have access to all the information they might need to make an informed decision

Privacy Commissioner Carly Kind

“When confronted with in-person requests for their personal information from retailers, licensed venues, car hire companies or real estate agents, consumers often don’t have access to all the information they might need to make an informed decision,” says Privacy Commissioner Carly Kind.

“This makes them vulnerable to overcollection of personal information and creates risks to their security and privacy.”

The OAIC says it will review the privacy policies of around 60 businesses from the following six sectors, with a particular focus in each case.

  • Rental and property – collection of individuals’ personal information during property inspections.
  • Chemists and pharmacists – collection of personal information for the purpose of providing a paperless receipt and collection of identity information to provide medication.
  • Licenced venues – collection of identity information to enable individuals to access a venue.
  • Car rental companies – collection of identity and other personal information to enable an individual to enter into a car rental agreement.
  • Car dealerships – collection of personal information to enable an individual to conduct a vehicle test drive.
  • Pawnbrokers and second-hand dealers – collection of identity information from individuals who wish to sell or pawn goods.

Transparent communication is critical

In the OAIC’s view, a business’s explanation of how it will use personal information should be open and transparent.

“The Australian community is increasingly concerned about the lack of choice and control they have with respect to their personal information,” Kind says.

“The first building block of better privacy practices is a clear privacy policy that transparently communicates how an individual can expect their information to be collected, used, disclosed and destroyed.

“In conducting a compliance sweep, the OAIC intends to ensure that entities are meeting their obligations to be transparent with consumers and customers about how they’re using the personal information they collect in-person.

“We hope this will also catalyse some reflection about how robust entities’ privacy practices are, and whether more can be done to improve compliance with the Privacy Act writ large.”


The post Real estate agents, chemists, car hire companies and more under new privacy scrutiny appeared first on Vlog.

]]>
920932
Five sophisticated scams to watch out for in 2026 /data-protection-and-privacy/articles/scams-to-watch-out-for-this-year Thu, 08 Jan 2026 21:51:56 +0000 /?p=919582 From the teen social media ban to interest rate hikes, here’s how scammers may try to get you this year.

The post Five sophisticated scams to watch out for in 2026 appeared first on Vlog.

]]>

Need to know

  • This year, watch out for these new ways scammers will be trying to fleece consumers
  • Criminals may exploit confusion surrounding the teenage social media ban and prospective changes to interest rates to convince Australians to hand over their money
  • The growing popularity of sales events, sporting matches and live performances are also attracting criminals trying to make a buck

Australians reported $312 million worth of losses to Scamwatch last year.

That number is down slightly compared to the previous year, as scam awareness improves and businesses and governments introduce measures to crack down on online criminals.

But new laws, advances in technology, shifts in the economy and other changes impacting our lives are providing scammers with new avenues to exploit – and novel ways to do so.

We’ve put together a guide to some of the latest efforts from the world of scams to help you know what to look out for this year.

On this page:

1. Social media ban phishing

One of the biggest stories of last year was the federal government’s introduction of age limits on social media.

Since December 2025, popular platforms like Facebook, Instagram and TikTok have taken steps to prevent anyone under 16 from creating or holding an account.

Much of the coverage of this world-first initiative has focused on the impact on teens, but regulators are warning that criminals may take advantage of the upheaval to target all of us who use social media.

Platform impersonation

State and national bodies are warning that scammers may impersonate social media platforms, the federal government or police and claim you’re at risk of losing your account or being fined unless you share personal details or money to prove your age.

These phishing criminals may ask you to click a link to a fake website, provide your account username and password or upload sensitive identity documents to prove you’re old enough to be on social media.

Clicking on fake links can put your device at risk, while sensitive details like personal ID numbers can be used by scammers to steal money under your name.

Accounts for cash

Regulators say criminals may also contact young Australians and their families and offer to sell them fake IDs or access to age-verified accounts so they can avoid the ban.

The eSafety Commissioner says these operators are unlikely to ever provide what they’ve promised and warns they may try to develop an unsavory relationship with the teens they talk to.

Scammers may target children trying to get accounts on social media following the teen social media ban.

Hi Mum, revamped

There’s also a risk that scammers might use news of the ban to breathe new life into a well-worn phishing exercise.

The “Hi Mum” scam – where criminals contact people at random, claiming to be their children who are in need of help after losing their phone – has been a favourite ploy of scammers in recent years.

The eSafety Commissioner and the ACCC say Hi Mum operators may tweak their approach and pose as older teenagers or young adults accidentally caught up in the social media ban.

Their messages may claim parents have to click on a link or share copies of a child’s ID documents in order to verify their age and allow them to keep using social media.

How to avoid them
  • Ignore requests for payment: None of the platforms targeted by the ban are requesting payment as part of their compliance with the laws. Any demand to send money to secure your account is a scam.
  • Double-check suspicious messages: Don’t act on unexpected texts or emails. Avoid falling for the Hi Mum scam by contacting family members on a number you’ve used before or found yourself. Ignore offers to help teens circumnavigate the ban with fake IDs or access to a verified account.
  • Check platform information: Social media companies complying with the ban should provide info on how they’re verifying people’s ages. Check a platform’s website using a link you’ve found yourself. It should also say if it’s employing a third party to help with verification efforts.

The ACCC says shopping scams “surged” in 2025, becoming one of the most commonly reported cons of the year, while cyber security companies reported that the criminals running these schemes are expanding their methods to coincide with popular sales.

With events like Black Friday getting bigger every year and other perennial discounting periods like the End of Financial Year (EOFY) sales just around the corner, it’s likely we’ll see shopping scammers deploy more of their familiar cons in coming months.

Dodgy shopping sites

Look out for websites promising products at big discounts that are, in reality, phishing portals designed to steal your money and sensitive information.

Some sites are copies of the official pages of popular outlets, while others are “ghost stores” – wholly invented operations, claiming to be small local boutiques.

Shoppers making orders through any of these sites are usually left waiting for products that never arrive, or find their purchases are poor-quality knock-offs.

Note that the scammers running these pages have been able to promote them to appear on social media and in search engine results, so be careful of sponsored posts too.

Fake parcel alerts

Scammers know many of us will be shopping online in this year’s sales and will likely play on our eagerness to see our valuable packages delivered to us safe and sound.

Criminals often impersonate courier companies and send SMS messages urging you to click on links to secure upcoming parcel deliveries, arrange re-delivery or pay fees to receive a parcel.

These links often lead to pages designed to harvest your payment information or other sensitive details.

Note that scammers are currently still able to use technology to make it look like their SMS messages are coming from trusted delivery services like Australia Post, giving them an air of authenticity.

How to avoid them
  • Don’t click on suspicious sale links: Don’t click on unexpected links claiming to connect you with shopping deals. Look up the store online and click on the first non-sponsored search engine result.
  • Check that a branded website isn’t a dodgy copy: Avoid websites claiming to be major retailers that are offering suspiciously big discounts on all products or those that have an unusual URL and inconsistent supporting information.
  • Scrutinise a store’s “local” connections: Avoid retailers that claim to be a small local business, but can’t be found on any maps of the town where they claim to be based and say in their fine print that their products ship from overseas.
  • Double-check delivery demands: Don’t click on unexpected links demanding that you take action over a parcel delivery. Contact the company that is claiming to contact you independently using details you’ve sourced yourself to confirm any requests for information or money.

3. Fake events and tricky tickets

Flaming sky lanterns are banned in Australia, so avoid events claiming to provide these.

One in five Australians have missed out on an event due to fake or undelivered tickets, according to research by PayPal, with many losing significant amounts of money.

Scammers have been employing a mix of methods to carry out these thefts. These include selling tickets to wholly fake events, as well as the long-standing practice of selling fake tickets to real events like popular concerts and sports matches.

In September last year, Western Australian authorities warned consumers not to buy tickets for sky lantern festivals or drone shows around Perth that were being promoted on social media, revealing such events didn’t exist.

This came after authorities in South Australia urged fans of a local AFL team to be on the lookout after fake tickets were sold for hundreds of dollars by scammers looking to cash in on interest in the club following its strong performance.

Meanwhile, a New South Wales man was charged for allegedly being involved in a similar scheme where more than 100 fake passes were sold to a popular music festival.

How to avoid them
  • Know what’s possible: Open flame lanterns that float into the sky are illegal in Australia, so a local event based around these is highly implausible.
  • Be skeptical of secrecy: Beware of events advertised on social media whose promoters claim tickets and the exact location will only be issued 48 hours before the event.
  • Stick to official sources: Watch out for tickets to major events being sold through social media. Ticketing for events at big stadiums and arenas is usually controlled by a large ticket company, which would usually be the authorised reseller.
  • Compare prices: All states have some form of anti-scalping laws, which put a cap on how much a legitimate ticket reseller can charge. This cap is usually based on a percentage markup of the original price (usually 10%). Overcharging could be a sign of a scam, so compare what you’re being offered to the ticket’s original sale price.

4. Pump and dump schemes

The corporate regulator is warning anyone interested in investing this year to watch out for “pump and dump” schemes following a rise in reports of this type of scam in recent months.

A pump and dump is when people with a financial interest in a small company or obscure asset spread misleading rumours online in order to inflate the price of their investment.

Once their asset has been sufficiently “pumped,” these unscrupulous operators will “dump” (sell) their share for a profit. The following fall in the asset price often results in those who bought into the hype losing money.

Meanwhile, with inflation on the rise again, some market watchers expect the Reserve Bank to raise interest rates this year.

Such announcements often spur borrowers and savers to see where they could be getting a better deal, so scammers may use these times to spruik dodgy investment opportunities or fake loans.

How to avoid them
  • Be careful of buying into hype: A rush of advertising, influencer and celebrity endorsements or online forum comments telling you to invest in a particular company could be the beginning of a pump and dump scheme.
  • Follow up on communication: Your bank or other legitimate financial institutions shouldn’t contact you and create a sense of panic about your finances or advise you to make sudden changes. Verify any suspicious messages using contact details for the bank or institution you’ve found yourself.
  • Know the common red flags: Beware of suspicious schemes involving cryptocurrency or requiring you to download remote access software. Watch out for conversations on social media or messaging platforms that unexpectedly turn to investing.
  • Do your research: You should be able to find plenty of information about a legitimate investment company by searching online.

5. AI video clones

At the end of last year, NAB intervened to stop a customer from sending $100,000 to someone appearing to be Hollywood actor Kevin Costner.

Suspicious about the requested transfer, the bank says it discovered that the Kevin the customer had been talking to via video call was a copy created by scammers using AI – one so realistic it had convinced the customer she was speaking to the real actor and that he needed the money.

Scammers are likely to deploy more AI-generated clones to aid their efforts this year. Image: Meta

Mounting improvements in generative AI will be one of the consistent stories of this year and scam victim support organisation IDCare says it expects to see more cases of criminals taking advantage of these advances to better clone the voices and faces of individuals who can lend credibility to their schemes.

We’ve previously pointed out the devastating impacts of audio deepfakes used in phone-based scams, but combined with the latest visual cloning technology to create video messages, they now pose a greater threat.

How to spot them
  • Be realistic: A celebrity is unlikely to ever contact you asking for money. If the request is coming from someone you know, verify it by contacting the person using details you’ve used before or found yourself.
  • Check the source: See where the video came from. Official accounts of legitimate organisations or individuals are unlikely to create AI videos of themselves or their representatives.
  • Read their lips: The audio in an AI video may not always match the mouth movement of the person depicted. Watch for instances of dodgy lip-syncing.
  • Check if it looks too good: AI clones sometimes have an airbrushed, over-polished look. Check if the hair, lighting and skin tone looks believable. Beware of unnatural blinking or flickering around the eyes.
  • Look at the body parts: AI struggles with hands – if these appear in the video, check that they look realistic. Look also at faces for any unusual asymmetries.
  • Once more with feeling: Look for unusual facial expressions that don’t match the tone of what’s being said.

The post Five sophisticated scams to watch out for in 2026 appeared first on Vlog.

]]>
919582 siblings using smartphone hand releasing a sky lantern facebook deepfake detection challenge example
Qantas data hack exposes alarming gap in consumer protections /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/qantas-data-breach Wed, 02 Jul 2025 14:00:00 +0000 /uncategorized/post/qantas-data-breach/ Vlog repeats call for an airline ombuds scheme following a massive data breach at Australia's largest carrier.

The post Qantas data hack exposes alarming gap in consumer protections appeared first on Vlog.

]]>
Vlog is reiterating urgent calls for an airline ombuds scheme after revelations of a widespread data breach at Australia’s biggest airline, Qantas. 

On Wednesday, Qantas revealed that they had detected “unusual activity” on a platform used by their contact centres earlier in the week, and that initial investigations found data such as customer names, emails, dates of birth and frequent flyer numbers had been compromised. 

Qantas says that credit card details and passport details were not held in the system that was breached

The airline says some six million customers had data stored on the service platform in question and that a “significant” amount of customer data had likely been stolen. 

Qantas says that credit card details and passport details were not held in the system that was breached. 

Time for an ombuds scheme 

Bea Sherwood, senior campaigns and policy advisor at Vlog, says the data hack highlights the urgent need for a strong aviation ombuds scheme to support airline customers and facilitate complaints when events like this occur. 

“This is not the first time Qantas customers have had issues with the airline, with Vlog giving the company a Shonky Award in 2022 for unusable flight credits, delayed flights, and more,” she says.  

There is currently no equivalent independent body for airline customers to raise concerns – a huge gap in our consumer protection system

Vlog senior campaigns and policy advisor Bea Sherwood

“Despite ongoing issues with Qantas and other airlines since, customers still don’t have an effective means of directing or resolving their complaints. The Australian Financial Complaints Authority and the Telecommunications Industry Ombudsman consider financial and telco complaints, including about data breaches,” she says. “There is currently no equivalent independent body for airline customers to raise concerns – a huge gap in our consumer protection system.”

“As airlines become more data driven, a robust ombuds scheme to protect consumers is needed more than ever,” says Sherwood.

The post Qantas data hack exposes alarming gap in consumer protections appeared first on Vlog.

]]>
766151
Australian super system caught unprepared for cyber attack /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/superannuation-funds-data-breach Thu, 03 Apr 2025 13:00:00 +0000 /uncategorized/post/superannuation-funds-data-breach/ Banks, telcos and social media platforms are required to protect Australians from scams, but the super industry is exempt

The post Australian super system caught unprepared for cyber attack appeared first on Vlog.

]]>

Need to know

  • At least five superannuation funds have been targeted in a data breach
  • The government's Scams Prevention Framework (SPF) requires banks, telcos and social media platforms to protect Australians from scams, but the super industry is exempt
  • Australians are urged to log in to their super account to check details are correct and report any unusual emails or text messages from their fund 

Members of the super funds Australian Retirement Trust, Australian Super, Hostplus, Rest, Insignia and possibly others will not be having a relaxing weekend.

The major funds recently suffered a cyber attack from criminals who reportedly had familiarity with the Australian super system.

Passwords were apparently harvested from the dark web, and the latest media reports suggest that only AustralianSuper members have so far been hit with fraudulent withdrawals.

The question for affected super members – as well as for the industry as a whole – is which anti-scam protections were in place, and why didn’t they work?

Cyberattack ‘shocking and unsettling’

The recent passage of the government’s Scams Prevention Framework (SPF) requires banks, telcos and social media platforms to meet new obligations to protect Australians from scams, or risk fines of up to $50 million.

But the legislation doesn’t apply to superannuation funds. Recent cyber attacks on a number of major funds shows why this needs to change.

“Reports of this cyberattack on at least five big super funds are shocking and unsettling,” says Super Consumers Australia CEO Xavier O’Halloran. “This is people’s financial future at risk. And the details and extent of this attack are still emerging.”

This is people’s financial future at risk. And the details and extent of this attack are still emerging

Super Cnsumers Australia CEO Xavier O'Halloran

The breach follows continual warnings from regulators and consumer advocates that the super sector as a whole is falling behind on cyber-resilience and scam protections. 

As Australians are legally required to put their money into super, this can’t be a good thing.

“Today’s news is chilling when we know super funds aren’t doing enough to protect Australians’ retirement savings,” O’Halloran says. 

“We’re calling on the next Government to urgently extend the new protections to safeguard Australians’ retirement savings against fraudsters, scammers and cybercriminals.”

The affected funds have reportedly been working with the National Cyber Security Co-ordinator to figure out just how big this hack is. 

What to do if you’re concerned your super may be affected

If you’re concerned about today’s news, Super Consumers Australia has this advice:

  • If possible, log in to your super account to check your details are correct and change your password.
  • Watch out for communications from your super fund.
  • Contact your super fund if you see any unusual activity; for example, SMSs or emails about transactions or changes that you have not requested. 

The post Australian super system caught unprepared for cyber attack appeared first on Vlog.

]]>
767558
‘What was stolen?’ Victim of IVF data hack says company has kept them in the dark /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/ivf-data-hack Tue, 18 Mar 2025 13:00:00 +0000 /uncategorized/post/ivf-data-hack/ Genea patient claims poor communication following hack of extremely sensitive health data.

The post ‘What was stolen?’ Victim of IVF data hack says company has kept them in the dark appeared first on Vlog.

]]>
For Sydney mother Chloe*, years had passed since she had thought about IVF company Genea, which she had used to receive donor eggs to become pregnant with her child over a decade ago. 

Despite asking the company to dispose of her frozen eggs six years ago and having had nothing to do with them since, her data has now been compromised in a major data hack.

Genea was hacked in the early weeks of February and by late in the month the criminals reportedly began posting data relating to patients on the dark web. Some of the data stolen included contact details, Medicare card numbers, medical histories, test results and medications. 

It has been almost a month now and I have emailed them and they still can’t tell me what was stolen

Genea ex-patient

Chloe heard about the hack from media articles, but thought that – given she hadn’t heard anything from the company – she wasn’t impacted. She later received a message from them saying that she had been affected, but not specifying how. 

“The communication has been really poor, they haven’t told us anything and have kept us in the dark,” she says. “It has been almost a month now and I have emailed them and they still can’t tell me what was stolen,” she says. 

“I’m lucky I have already told my child about being born from a donor, because that information may be out there now,” she adds. 

Sensitive health data 

University of Melbourne’s professor of law and digital ethics Jeannie Paterson says under the law in Australia all health data is considered “sensitive data”, and companies that hold it have greater responsibilities to protect it. 

“Because this data is so sensitive it is very attractive to hackers, because the sensitive nature puts a lot of pressure on the company to pay a ransom rather than face the embarrassment of having this data leaked,” she says. 

While acknowledging that it takes time for the full extent of a data breach to come to light, Paterson says Genea should have done better at informing affected patients. 

“Companies have an obligation to report data breaches to the Information Commissioner, but they also should have a plan in place for keeping people whose lives have been infected informed,” she says. 

“The level of trauma and uncertainty that happens to people when there’s a data breach, it only goes up the longer they’re kept in the dark, particularly when information is being published in screenshots in the dark web,” Paterson adds.

Sensitive health data is particularly attractive to hackers.

OAIC and Genea respond 

The Office of the Australian Information Commissioner (OAIC) declined to comment on the Genea hack specifically, but said of all sectors, the health sector had notified OAIC of the most data breaches since the notification scheme commenced in 2018. 

“Organisations that collect, use and store personal information have a considerable responsibility to ensure that data is held safely and securely. This is very important for health service providers given the sensitive information they hold,” an OAIC spokesperson says. 

A spokesperson for Genea says they continue to liaise with the police and other authorities to investigate the data breach and that they will continue to update affected patients. 

“We understand the importance that people place on their personal information and that this incident is concerning for those patients potentially impacted. Genea is committed to communicating with patients as swiftly and transparently as possible, and we apologise for any concern this incident has caused,” the spokesperson says. 

*Not her real name 

The post ‘What was stolen?’ Victim of IVF data hack says company has kept them in the dark appeared first on Vlog.

]]>
764574 technician-in-a-fertility-clinic
Major data breaches go from rare to routine /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/big-jump-in-major-data-breaches Sun, 02 Mar 2025 13:00:00 +0000 /uncategorized/post/big-jump-in-major-data-breaches/ A cybersecurity firm warns that Australian businesses must do better. 

The post Major data breaches go from rare to routine appeared first on Vlog.

]]>

Need to know

  • Mega data breaches (those affecting a million people or more) have gone up and up in recent years – from the beginning of 2022 to the end of 2023, there were 12
  • From January to June 2024, the Office of the Australian Information Commissioner received 527 data breach notifications, the highest number since the July to December 2020 period 
  • A report by a Sydney-based cybersecurity firm indicates that businesses and organisations still aren't doing enough to protect our data 

Our main focus in the digital world these days should be on steering clear of scams, and deleting, reporting or ignoring all forms of contact that seem even remotely fishy. But large-scale data breaches that make our personal details available to scammers – pretty much forever – are worth paying attention to as well. 

With the stolen personal information, all the corporate-style global scam operations out there have a lot to work with. They can craft personalised scams that can fool the best of us. 

The biggest data breaches in recent years include the Optus case, where up to 9.8 million people had their data stolen; the Latitude Finance case, which affected around 14 million Australians; and the Medibank event, where the records of around 4 million customers were heisted. 

Most of the breaches in the first half of 2024 affected 100 people or less, but the MediSecure data breach affected almost 13 million Australians

But these are just the well-publicised cases, and the reported ones. Under the Notifiable Data Breaches scheme, all organisations must report any data breach both to the Office of the Australian Information Commissioner (OAIC) and to affected people if the theft of the personal information is likely to result in harm to those it identifies. 

From January to June 2024, the OAIC received 527 data breach notifications, the highest number since the July to December 2020 period and a 9% increase on the previous six months.

Most of the breaches (63%) in the first half of 2024 affected 100 people or less, but the MediSecure data breach affected almost 13 million Australians. Many breaches likely go unreported. 

Twelve major breaches over two years 

According to the Sydney-based cybersecurity firm StickmanCyber, mega data breaches (those affecting a million people or more) have gone up and up in recent years. 

The firm – which is a member of the NSW Government Cybersecurity Taskforce and the Australian Cyber Security Centre – recently released a report it says is based on an analysis of all 6000 notifiable data breaches reports submitted to the OAIC since the scheme’s inception in 2018. The firm obtained the reports through a Freedom of Information request lodged in October last year. 

The main takeaway is that there were just two data breaches that affected a million Australians or more between 2018 and 2021. And then, from the beginning of 2022 to the end of 2023, there were 12. Breaches affecting at least a 1000 people went up 40% over that period as well, according to the report. 

We should never accept this as the status quo – businesses have to do better, or they must leave our data alone

StickmanCyber CEO Ajay Unni

Other noteworthy findings include that nearly a third of mega breaches went undetected for at least 30 days; that Australian Government organisations usually take longer than corporate entities to detect a breach; and that the healthcare and finance sectors have suffered the highest number of breaches. 

“For mega breaches to increase so much, so fast, is cause for concern,” says StickmanCyber CEO Ajay Unni. 

“The problem is that there are now more companies with more data on Australian residents than ever. When they are breached, we are accustomed to the contact, payment and identification details of millions of people falling into the wrong hands. But we should never accept this as the status quo. Businesses have to do better, or they must leave our data alone.”

Data breach details in OAIC reports 

The StickmanCyber report would be eye-opening for many, but it’s worth noting that the data breach information was already available by way of the OAIC’s , for those who take the time to delve into government reports. 

In its January to June 2022 report, when the OAIC started to notice an increase in large-scale data breaches, it introduced a breakout box showing the number of Australians affected.

An OAIC spokesperson tells Vlog the reasons for the increase in major breaches are multifold, the standout being “the increasing frequency and complexity of cyber attacks”, which are behind the majority of breaches. 

More businesses reporting breaches to the regulator as required following the high-profile Optus and Medibank cases is another probable reason, OAIC says. Other reasons for the increase include the growing use of external service providers by businesses, particularly cloud and software services. 

The data suggests that underreporting is a chronic issue in the private sector

Data breaches also give criminals the tools they need to launch increasingly effective cyber attacks, leading to further data breaches. The OAIC’s spokesperson referred to these as “credential stuffing attacks”. It means the criminals are using our personal information to steal yet more personal information. 

Ajay Unni says his firm’s research provides further evidence that the organisations that have our data continue to fall short on protecting it. 

“The Australian public sector is notably poor at both identifying and responding to breaches in a timely fashion. But at least the public sector is reporting to the OAIC. The data suggests that underreporting is a chronic issue in the private sector. There are suspiciously few breaches in many industries like retail, which we know collect large volumes of data and struggle to protect it.”

The post Major data breaches go from rare to routine appeared first on Vlog.

]]>
759860
Why aren’t businesses doing more to stop us from getting scammed? /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/scam-victim-quantitative-report Tue, 27 Aug 2024 14:00:00 +0000 /uncategorized/post/scam-victim-quantitative-report/ A new Vlog report reveals four out of five scam victims received no warning before transferring money to a scammer.

The post Why aren’t businesses doing more to stop us from getting scammed? appeared first on Vlog.

]]>

Need to know

  • Four out of five of the victims we heard from said their banks did nothing to flag a scam before they transferred their money to the perpetrator
  • About half of these scam victims say any support they received from their banks was sorely lacking
  • In over half the cases we documented, the scammer first made contact with their victim on a website or social media platform

To gauge the enormity of the problem of scams in Australia, it helps to look at the numbers. 

Australians lost $2.7 billion to scams last year, most of it stolen from older people. The 2022 numbers were worse – $3.1 billion spirited out of our bank accounts and into the pockets of scammers.

These are colossal figures by any measure, so it stands to reason that deeply resourced businesses like banks, telcos and tech platforms should know how to prevent scammers from infiltrating their services to pull off these fraudulent transactions. 

Failing that, these businesses should at least do their best to support customers who become victims of them. But a Vlog survey of 280 scam victims tells a different story. 

The resulting report, Passing the Buck: how businesses leave scam victims feeling alone and ashamed, delivers disturbing news. 

Four out of five of the victims we heard from said their banks did nothing to flag a scam before they transferred their money to the perpetrator

Four out of five of the victims we heard from said their banks did nothing to flag a scam before they transferred their money to the perpetrator. And about half of these scam victims say any support they received from their banks was sorely lacking.

Banks are only part of the problem.

In over half the cases we documented, the scammer first made contact with their victim on a website or social media platform, where it remains all too easy for criminals to set their traps. 

In about two out of 10 cases, the scammer initiated contact by text or phone call. 

Victims of scams carry the burden 

Shame and embarrassment play key roles in whether a scam victim even tries to get their money back. 

About a third of the people we heard from just accepted the loss because they felt foolish that it had happened. Around the same number didn’t think reporting the incident to their bank would do any good. 

The victim’s state of mind is also a factor. Over half of survey respondents said they were under stress around the time the scam occurred.

Our data shows that it’s a real roll of the dice as to how a scam victim is treated by their bank

Vlog director of campaigns Rosie Thomas

“Our research highlights that scam victims are left feeling alone, ashamed and carrying the burden of scams, while the businesses enabling the criminal activities of scammers face virtually no consequences,” says Vlog director of campaigns Rosie Thomas. 

“After a scam is identified, the banks play an important role in helping to recover money and providing appropriate support. However, our data shows that it’s a real roll of the dice as to how a scam victim is treated by their bank, and whether they get the support they need.”

Australians 65 and older lose more money to scams than any other age group.

Where banks have to pay you back 

Banks in other jurisdictions have certain obligations. In the UK, a mandatory reimbursement scheme for customers who unknowingly authorise a payment to a scammer through a bank (called an ‘authorised push payment’) is set to take effect in October this year. 

There are a few exceptions to reimbursement, including whether the customer was grossly negligent, but their vulnerability to the scam is taken into account. 

Australia is a long way behind when it comes to banks helping scam victims. 

Only 14% of our survey respondents said their bank had alerted them that a probable scam was in the offing. And more than seven out of 10 weren’t immediately notified by their bank that a scam had occurred.

In half the cases we documented, victims say their bank made no effort to recover the stolen funds after they contacted them. 

Australia falling behind on anti-scam regulation

In November last year, the Australian Banking Association announced the industry would introduce a confirmation of payee system, an account name-matching protocol designed to prevent bank customers from transferring money to scammers.

The long-awaited measure is expected to be rolled out over 2024 and 2025. 

Such a system was adopted by the six largest banks in the UK in 2019, covering 92% of bank transactions. After the first year, transactions to the wrong account, including scammers’ accounts, fell by 35%.

In the UK, an Online Safety Bill came into effect last year that imposes penalties on platforms that fail to block fake ads and scams

When Dutch banks introduced the IBAN-name check service in 2017, reported scams and fraud ended up falling by 81%.

Our research suggests that around half the scams we documented could have been prevented by a 24-hour delay in transferring the money, according to victims.

Australia has also fallen behind on forcing digital platforms to prevent scammers from buying ads. 

In September last year, a Vlog investigation revealed that scam ads for some of Australia’s most popular retailers were rampant on Google, Facebook and Instagram. 

In the UK, an Online Safety Bill came into effect last year that imposes penalties on platforms that fail to block fake ads and scams, but to date there has been no parallel effort by the Australian government.

$345 million lost from January to March this year

Scams do not appear to be going away anytime soon. 

The most recent quarterly update from the ACCC’s National Anti-Scam Centre shows financial losses are trending downward, but there’s still plenty of money being lost.

From January to March 2024, Australians lost $345 million to scammers as reported to Scamwatch, ReportCyber and the Australian Financial Crimes Exchange. (The billions in annual losses cited at the beginning of this article also include reports to IDCARE and ASIC.)

I thought that I would never get scammed, but now I don’t answer phone calls, I delete emails, and I transfer money as little as possible and use cash as much as possible

Our scam victims research also shows that Australians are losing trust in online financial transactions, and that being scammed takes a heavy toll on victims’ mental health and sense of wellbeing. 

For many, it’s a life-changing event. Three out of five of the victims we heard from said they’re no longer confident when transacting on the internet.

“I thought that I would never get scammed, but now I don’t answer phone calls, I delete emails, and I transfer money as little as possible and use cash as much as possible. There is a new scam every day,” one victim told us.

“I reported the scam within four hours and gave a lot of detail to the fraud squad at the bank. To get only $50 back is shocking. The money I lost was everything I had at the time,” another victim reported.

Anyone can fall victim

Our research bears out what has become increasingly obvious: anyone can fall victim to a scam. 

“I did a huge amount of research but still got scammed,” another victim told us. “The false websites, verbal communications, verbal and written documentations. This was a very well constructed scam. I could have lost much more.”

In January, we reported on the case of a family losing $2.5 million after sending money to accounts controlled by scammers at Westpac, ANZ, Commonwealth Bank and Bendigo Bank. It all started with a fake ad on Google for investment opportunities. None of that money has been recovered.

The false websites, verbal communications, verbal and written documentations. This was a very well-constructed scam

Scam victim and Vlog survey respondent

“Businesses like banks, telcos and social media platforms, who have the technology and resources to detect, prevent and respond to scams, are not moving fast enough to protect and support consumers from the scourge of scams,” says Thomas. 

“We’ve welcomed the Government’s commitment to strong, mandatory obligations that provide a baseline of support – that way consumers can expect basic protections no matter who they bank with or what platform they’re on.” 

The post Why aren’t businesses doing more to stop us from getting scammed? appeared first on Vlog.

]]>
766674 worried-man-on-phone-with-credit-card-and-laptop
Heartless romance scammers exploiting people with disability /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/romance-scams-targeting-people-with-disability Mon, 26 Aug 2024 14:00:00 +0000 /uncategorized/post/romance-scams-targeting-people-with-disability/ Those looking for love and living with disability are being hit hard by scams. Vlog investigates, with tips for staying safe.

The post Heartless romance scammers exploiting people with disability appeared first on Vlog.

]]>

Need to know

  • Australians with disability are more than twice as likely to report experiencing a romance scam
  • Advocates say abuse of people with disability is rife
  • Vlog says the businesses involved need to do more to protect consumers

This article mentions suicide. If you or anyone you know needs support, contact Lifeline on 13 11 14 or at , or Beyond Blue on 1300 224 636 or at .

Chris* first met Hana on Snapchat. She suggested they shift to another platform to get to know each other better. 

So, on a hot summer night in early 2023, as Chris lay on a leather sofa bed in the spare room of his best friend’s house, lit by the dull light from his mobile phone, he launched Telegram – an encrypted messaging app favoured by drug dealers and the alt-right. Chris isn’t involved in either, but he opened direct messages and typed, “Howdy.”

“Hello Chris,” Hana replied. 

They talked on Telegram until well past midnight and into the next morning. Chris told Hana about his TAFE studies, his job, and his plan to move out of home. Hana listened attentively. Chris soon sent a picture of himself. “Do you think I look cute?” he said.

“You look great, but I think it’s better if you show your big smile,” said Hana. 

In return, Hana sent a picture of herself. She looked to be in her mid-20s and was wearing a flattering yellow blouse, with brown hair to her shoulders framing a kind face.

Messages between Chris and Hana, a scammer.

After a nervous gap between messages, Chris typed, “Can I ask you something… are you single?”

“Yes, I am single,” Hana replied.

“Because the last three relationships were fake ones,” Chris wrote. “Scammers.”

“I’m not that kind of person,” typed Hana.

“The last two people I had feelings for said that, and they took advantage of me. I have a disability, so I’m an easy target,” Chris wrote.

Looking for love 

Chris, who lives in Adelaide, is 26 and was looking for a relationship. He turned to a space familiar to him – the internet. Online, people with disability may not face the same stigma they often face in real-world dating. 

Hana is not the first person Chris had messaged. In 2023, he messaged no fewer than eight potential partners who all turned out to be romance scammers. Meeting them through Snapchat, he gave them his phone number or email address before they suggested moving the chat to a platform with end-to-end encryption, such as Telegram, WhatsApp or Google Chat. 

They suggested moving the chat to a platform with end-to-end encryption, such as Telegram, WhatsApp or Google Chat

Monica Whitty, Professor of Human Factors in Cyber Security at Monash University, says this is common. “By moving them to other sites, it increases the ability to communicate with the victim and develop an intimate relationship with them.”

Geoff Rowe, CEO of Aged and Disability Advocacy Australia, says that people with disability can be more vulnerable to romance scams because their exposure to romantic relationships may be limited and scammers use that vulnerability to engage people.

How romance scams work

Before Hana, Chris had met two less sophisticated suspected scammers, “Angela” and “Viv”. 

Viv told Chris that she lived in the same suburb as him, was “just bored” and wished she had someone to hang out with. They arranged to meet, but first, she said, Chris would have to send her a small amount of money. When Chris said he would do it later, she said, “Just do it now, okay. You do it now!” Put off by the demand, Chris ended the conversation.

Angela was even more forward and made sexual advances as soon as they moved the conversation to an encrypted platform. This was too much for Chris, who wasn’t looking for sexual intimacy. Angela quickly changed tactics. Suddenly, she was an orphaned Monash University student living with her grandma who needed a $200 gift card for Steam, a video game store. She said the gift card was for food. Chris didn’t send Angela or Viv any money.

Scammers develop an intimate and trusting relationship before asking for small gifts, like flowers or gift cards, to prime their targets for larger requests

While Chris initiated these conversations, what happened next was part of a common online trap. Whitty says typical scammer profiles will “exaggerate the aspects that someone would want to date” to lure people in. For heterosexual men, the profile might be a “very pretty” young woman with “some kind of vulnerability”, often a struggling student or nurse. 

What follows is a process of grooming where scammers develop an intimate and trusting relationship before testing the waters and asking for small gifts, like flowers or gift cards, to prime their targets for larger requests. 

This experience was similar to Chris’s, who did send small amounts of money to some scammers without going further. In total, Chris estimates he lost around $190 to romance scammers last year.  

Rowe says that people should be cautious and talk to family and friends about the interactions they are having online as they may have advice or warnings.

How scammers get the money

“Good morning babe,” Chris messaged Hana one day. 

He had the day off work. This gave Hana plenty of time to work on him. They continued to chat online; she sent a sketch of a dress design she said she was working on and Chris complimented her work, then she said she was going to her friend’s house to help her create a Binance account.

Chris grew suspicious, but played it cool and waited a couple of hours before replying. When he did, Hana suggested he set up a Binance account too. Chris knew this was a red flag and said he wasn’t interested.

Chris told Vlog that other scammers had offered to sell him nude pictures, which he didn’t buy. Those who did succeed in getting money out of him were the ones who built a connection. Preying on his kindness, Chris says they asked for help with ailing grandparents or overdue phone bills, and he bought gift cards to send to try and solve their problems. 

Preying on his kindness, they asked for help with ailing grandparents or overdue phone bills, and he bought gift cards to send to try and solve their problems

The ACCC’s Targeting Scams report, released in April 2023, found people with disability lost $33.7 million to scams in 2022, up 71.2% from 2021. The report also found that people with disability are more likely to send money in alternative ways – cryptocurrency, gift cards, plane tickets, even transferring home ownership. 

Money lost to romance scams by people with disability increased by 8% between 2021 and 2022. 

Scams in general are underreported. Rowe thinks the underreporting of romance scams is “because people are embarrassed that they’ve fallen for it”. 

He says this is a reason to be vigilant and to help people feel comfortable that they’re not the only ones to have fallen for romance scams.

Moving on

Relationships Australia’s Relationship Indicators 2022 report found people with disability had higher levels of loneliness than average. This means many may seek romance in an environment they feel comfortable in – such as the internet.

Once Hana had built Chris’s confidence, she quickly grew impatient. She laboured for three days, but not once did Chris express interest in “investing”. 

Two months passed with no messages between Chris and Hana. But in early April 2023 they reconnected. Hana told Chris about her cryptocurrency success; Chris updated Hana on his studies at TAFE. He ignored Hana’s investment advice, instead asking for relationship advice with someone he was interested in at TAFE. It became clear to Hana that Chris would not give her what she wanted.

Once Hana had built Chris’s confidence, she quickly grew impatient

“You are brave,” Hana wrote, “but you are afraid of investing your money.”

“You know I have a disability,” Chris reminded Hana. “I see things differently, and I have time trying to think about things.”

“Disability isn’t a problem anyway. If you see things differently you should prove to everyone that you think and act as a normal one.”

Chris deleted Hana. The following week he messaged ‘Katie’, another romance scammer. After that, he deleted Snapchat. His dad now gets a notification whenever he tries to re-download the app and gives Chris a concerned phone call.

Psychological effects

Chris says he wants to share his experience. “This needs to get out there because not many people with disability … know about these romance scammers [and] what their real intentions are.”

Whitty says, “What we know is that the victim’s upset and pain from psychological effects can be just as damaging as the financial effects.

“I’ve seen people lose very small amounts of money but commit suicide or attempt suicide. It may affect him for the rest of his life.”

Abuse of people with disability is rife. They experience abuse, discrimination, probably more than any others … across our society

Geoff Rowe, CEO Aged and Disability Advocacy Centre

The Disability Royal Commission released its final report in September 2023, which revealed widespread abuse and exploitation experienced by Australians with disability. It confirmed that people with disability are more than twice as likely to report experiencing a romance scam, and to experience financial loss from dating and romance scams, than people without disability. 

“Abuse of people with disability is rife,” Rowe says. “They experience abuse, discrimination, probably more than any others … across our society.” 

He encourages people who have been affected to call the Disability Advocacy Support Helpline via the Disability Gateway on 1800 643 787 (ask to be connected to the helpline). tgHe says advocates can “help people unpack what’s going on” if they have been scammed and help them navigate the system.

Alex Soderlund, senior campaigns and policy adviser at Vlog, says, “Scams have become increasingly sophisticated and harder to detect. It’s possible for anyone to be scammed, but when you are experiencing vulnerability – whether that’s an ongoing vulnerability, or more momentary stress, anxiety or sadness – you’re at an even greater risk of being scammed.

“Australia’s laws currently shift the burden onto consumers to detect and protect themselves from scams. This requires people to be constantly vigilant, which is an impossible and unfair expectation.

It’s possible for anyone to be scammed, but when you are experiencing vulnerability – whether that’s an ongoing vulnerability, or more momentary stress, anxiety or sadness – you’re at an even greater risk

Vlog senior campaigns and policy adviser Alex Soderlund

Soderlund says that scams often occur due to failures from big businesses to protect their consumers. 

“Businesses like banks, telcos and digital platforms should be subject to strong rules requiring them to do what’s necessary to protect people from scams, backed by strong penalties and remedies for victims,” she says.

Chris is no longer looking for a relationship. “Not at the moment, I just want to focus on my studies, probably because I have been heartbroken too many times,” he says.

*Names have been changed.

The post Heartless romance scammers exploiting people with disability appeared first on Vlog.

]]>
766552 romance-scam-text-messages
AI voice scams: What you need to know /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/ai-voice-scams Sun, 25 Aug 2024 14:00:00 +0000 /uncategorized/post/ai-voice-scams/ With the latest phone scams, it's even harder to spot fact from fake.

The post AI voice scams: What you need to know appeared first on Vlog.

]]>

Need to know

  • Criminals are using AI to impersonate the voices of people you may know to try to convince you to part with your money
  • Australians are being targeted by this new type of scam, which has already wreaked havoc overseas
  • AI is improving quickly, so paying close attention to the content of a call or voice message rather than the voice quality can help you identify this scam

On this page:

They’ve caused chaos and distress overseas, but AI voice scams are now being deployed against Australians in attempts to steal our money and personal information.

Harnessing the latest technology to impersonate the voices of our loved ones or prominent people, these novel cons have created headlines in the US for getting around the defences of even tech-savvy scam-avoiders.

We’re breaking down the types of AI voice scams you could encounter and how to spot and avoid them.

What are AI voice scams?

First emerging overseas last year, many AI voice scams appear to be an evolution of the text message-based “Hi Mum” scam which gained notoriety in Australia in 2022.

This scam saw criminals contact victims by text, pretending to be a family member (often a child) in urgent need of money after losing their phone.

But the power of AI has now enabled scammers to take their impersonations to the next level, as Toby Murray, associate professor in the school of computing and information systems at the University of Melbourne, explains. 

“AI voice-cloning technology allows you to mimic someone’s voice pretty closely and [it’s] getting good enough now that the results are becoming almost indistinguishable,” he says.

Scammers can use voice clones of a loved one in trouble to convince victims to hand over money.

“You can create a convincing, false recording of someone’s voice that could then fool a family member into thinking that it’s their loved one,” Murray explains.

These recordings are then deployed against victims through phone calls or voice messages on social media apps.

But it’s not just a family member or friend’s voice you might hear on the other end of the line – investment scammers are also deploying this method, enlisting the voices of famous individuals to spruik get-rich-quick schemes and convince victims to hand over their savings.

Are AI voice scams happening in Australia?

The latest AI voice scams targeting Australians involve fake investment schemes.

Lending prominent voices to fraudulent investment schemes has been one of the first areas where AI voice scams have been leveraged against Australians.

When Sydney-based advertising executive Dee Madigan received a message from a social media account pretending to be Queensland Premier Steven Miles, she knew it was a scam.

“Steven’s a friend of mine, so I knew it wasn’t him, [but] he had a fantastic idea about an investment,” she recalls.

Wanting to test the would-be scammer, Madigan asked them to call her, thinking it would put an end to the interaction. What happened next surprised her.

“All of a sudden, my phone suddenly rang and on the other end was his voice,” she recalls.

Over the course of a brief call and a follow-up audio message, the voice claimed to be too busy to talk, but promised to send her more information about the money-making opportunity.

Sydney-based advertising executive Dee Madigan received a call from a scammer who had used AI to clone the voice of Queensland Premier Steven Miles

“It was surprisingly good,” Madigan says of the voice. “[It was] slightly robotic, but much better than I thought it would have been. It definitely did sound like Steven.”

Miles’ office didn’t respond to a request for comment, but has confirmed the incident was a scam in previous statements.

As for other cases, including instances where distressed family members were impersonated, AI-powered scams still appear to be in their infancy in Australia.

The ACCC’s National Anti-Scam Centre says it’s received fewer than five reports where it suspects scammers have used AI technology to clone voice or video since 2022.

Australian banks are warning customers to look out for AI voice scams.

But experts and business say the threat is growing, with the National Australia Bank (NAB) putting AI voice clones at the top of its list of scams likely to be targeting Australians this year.

“We really should expect that, because this voice cloning technology is getting so good,” agrees Murray.

“People have started to become much more aware of traditional [text message] scams and I think scammers know this, so we should expect … that scammers are going to adopt [AI voice] technology.”

AI voice scams already causing devastation overseas

In recent cases in the US, people have paid hundreds of thousands of dollars in ransom to scammers after being confronted with elaborate schemes where AI clones of a loved one’s voice convinced them that a family member had been kidnapped.

America’s consumer watchdog, the Federal Trade Commission, is warning consumers to beware of AI voice cloning and earlier this year ran a competition to try to find ways to protect consumers from these scams.

How AI voice scams work

The best AI tools only need seconds of your voice to create a clone.

A convincing voice clone can be made with mere seconds of original audio – something scammers can recover from sources such as videos on social media.

Once they’ve made a clone, scammers will call targets with a pre-recorded message spoken in the cloned voice.

Dr Shaanan Cohney, researcher at Melbourne University’s Centre for AI and Digital Ethics, says these messages targeting family members closely follow the “Hi Mum” progression.

“A common one is someone you know is in urgent need and needs you to make a transfer of some funds to a particular location,” he explains.

“There’ll be an excuse provided for why the funds are needed and also for why no further voice communication can happen. The goal is to minimise the opportunity for the person to identify that something’s wrong with the voice communication.”

As with many modern cons, the perpetrators of AI voice scams will often direct targets to send money via a gift card, cryptocurrency or bank transfer.

There’s been an explosion of easy-to-use cloning tools in recent years. Image: Google

New services powering scams

The growing prevalence of sophisticated AI tools has delivered criminals the means to copy voices quickly for relatively little cost.

“The technology has crossed a threshold where the improvements have accumulated to the point where [it’s] now very usable with very little effort by ordinary people, rather than just by experts,” explains Murray.

Cohney says that although sophisticated computer software programs are available, he suspects most groups running this scam are using easy-to-find, web-based options.

“[If you] type ‘voice cloning’ into Google, [you] get ‘AI voice cloning’, ‘Clone your voice in minutes’, ‘Free AI voice cloning in 30 seconds’. There are hundreds of these services now.”

Our AI voice clone experiment

Earlier this year, Vlog signed up to one such service. For only $US1.10 ($1.66) a month, we were able to clone existing voices or create new ones from scratch.

Wanting to replicate the process a scammer might follow, we uploaded a few smartphone recordings of this author’s voice, ensuring the original files were of a similar quality to social media videos.

Running these recordings through the tool several times, we were able to make our clone read a message similar to one a scammer might play to a victim’s loved one.

For only $US1.10 ($1.66) a month, we were able to clone existing voices or create new ones from scratch

We found the first versions of the voice we created would occasionally drop into an English accent. But after uploading further samples and changing the prompts to the cloning tool (instructing the engine on the gender, age and nationality of the original voice, for example) we were able to get a clone that sounded quite similar to the author’s voice.

If you listen to a sample of the voice below, you might notice subtle changes in accent in some parts, as well as a lack of some of the emotion one might expect someone in a stressful situation to carry in their voice.

Press play to hear our AI voice clone

·

Can you tell if you’re speaking to an AI clone?

AI experts say vocal cloning tools are now so good that a voice they create can be very difficult to tell apart from the original.

They instead recommend paying attention to what the caller is saying and listening for:

  • a sense of urgency
  • an unwillingness to explain things further
  • the absence of normal social cues 
  • missing signs of ordinary communication, such as if your loved one is not greeting you in a way they normally would.

“Notice if things seem out of the ordinary for your communication with this particular person,” Cohney advises. “If something appears out of context, then it’s a wise move to inquire further.”

If you’re hearing the voice in a phone call, asking questions or trying to extend the conversation is an easy way to catch an AI scammer in the act.

Most current cloning tools are only effective at delivering short, pre-prepared messages, and can’t engage in spontaneous conversation.

Finally, as with SMS-based “Hi Mum” scams, scammers will likely call from an unknown or private number. 

Therefore, treat unusual calls that sound like they’re from a loved one on an unknown number with suspicion and contact the person using details you have yourself to confirm what they’re saying.

Text-only accessible version

How to spot an AI voice scam
You could be a target if you get contacted by a loved one who…
– calls from a number they don’t normally use
– lacks emotion in their voice
– occasionally slips into an accent they don’t normally use
– says they’re in trouble and needs your help, but won’t explain in detail
– doesn’t greet or speak to you the way they do normally
– won’t answer your questions and can’t continue the conversation.

Can you protect your voice from AI?

Videos of ourselves on social media can make our voices vulnerable to cloning.

Murray says the fact that many of us are sharing videos and audio of ourselves online means there isn’t much we can do to stop our voices from being cloned.

“In the social media age, asking people not to post videos of themselves online is unreasonable,” he says.

“Just as there is little you can do to prevent somebody creating a fake social media profile in your name, we are now entering an age in which our voices and faces can be impersonated by AI.”

You can, however, adjust the privacy settings on your social media accounts so that videos or other sensitive posts can’t be seen by people you’re not connected with who visit your page.

“Being vigilant is the best defence,” concludes Murray, highlighting the previously mentioned methods for identifying an AI voice scam as the easiest way to stay safe.

If you are particularly worried about AI scammers impersonating loved ones, agree on a codeword or question-answer exchange you’ll recite if one of you ever has to call for help.

The post AI voice scams: What you need to know appeared first on Vlog.

]]>
758766 concerned_senior_on_phone financial-stock-market-graph-on-screen person_making_payment_on_smartphone audio_editing_software_on_screen google-search-results-for-voice-cloning video-on-social-media
Five steps to take if you’ve been scammed /data-protection-and-privacy/protecting-your-data/data-privacy-and-safety/articles/what-to-do-if-you-have-been-scammed Sun, 25 Aug 2024 14:00:00 +0000 /uncategorized/post/what-to-do-if-you-have-been-scammed/ Think you might've fallen foul of a scam? Find out how to report and limit your losses.

The post Five steps to take if you’ve been scammed appeared first on Vlog.

]]>

Need to know

  • If you think you might have been scammed, break off contact with the scammer and contact your financial institution immediately
  • You can get help dealing with the experience and lodge a report with various government agencies and other organisations
  • If you've encountered a scam, it's important to report it, even if you haven't handed over any money or information

On this page:

Lots of us are encountering scams. When we surveyed Australian consumers in July, 52% told us they believe they’re being targeted by a scam every week and nine out of 10 said they had come across at least one suspected scam in the past year.

It’s hardly surprising then, that Aussies have already lost almost $400 million to scams so far this year, and that’s just according to reports received by the ACCC’s Scamwatch.

Finding out you’ve been scammed can be nothing short of devastating. Scam victims have told us of the emotional toll the experience has taken on them and their families.

We’ve given lots of advice on how to spot scams in the past, and now we’re providing guidance on what to do if you have lost money or personal information to a scammer, or even just had a near miss.

Text-only accessible version

What to do if you’ve been scammed:
1. Break off contact
Stop communicating with the scammer and don’t provide any more money or information.
Don’t click on any links or phone numbers they’ve sent you.
2. Contact your financial institution
Contact your bank or payment platform as soon as possible.
They may be able to stop any payments you’ve made and provide support.
3. Secure your personal information
Contact IDCare for advice if you think someone has access to your indentity credentials.
4. Report the scam
Report what’s happened to Scamwatch, ReportCyber and other relevant agencies.
5. Get support
If you’re struggling after being scammed or believe your bank has acted inappropriately, speak to a financial counsellor.

1. Break off contact and don’t provide any more money or information

Scammers will often come up with a series of reasons for why you should continually give them money or personal information.

If you’re suspicious about an interaction you’re having with someone, whether it be over the phone or by text message or email, don’t provide them with any money or information. If you’ve already done this, ignore any follow-up requests for more.

Scammers also often impersonate major companies, government agencies or even loved ones (new AI voice cloning tools make impersonation scams even harder to detect). If you’re receiving suspicious or unusual communication from any of these, break off contact and independently verify what they’re saying or asking you to do.

You can do this by contacting the person or organisation using details you’ve found yourself, perhaps by searching online.

You should also be careful not to follow any directions that might allow the person you’re interacting with to take remote control of your device

When interacting with a suspected scammer, it’s also important not to click on any links or use any phone numbers they’ve sent you. Scammers can set up fake websites with URLs that come close to matching trusted brands and these sites could be dangerous to your device.

You should also be careful not to follow any directions that might allow the person you’re interacting with to take remote control of your device (they might ask you to download a particular app to facilitate this) and to ignore any requests from them to transfer money to a new bank account.

Once you’ve broken off contact with a scammer, you can block numbers that you’re receiving texts or calls from, but be aware that these criminals have been known to regularly change the sender and caller IDs that they operate under.

2. Contact your financial institution

Bank transfer was the most common way scam victims reported losing money last year.

If you’ve sent money to someone who you think is a scammer, contact your bank or financial institution as soon as possible to see if they can stop the payment.

Do the same thing if you’ve paid them using a credit or debit card or another payment platform – these tend to have more safeguards than bank transfers, with many offering purchase protection provisions.

Unfortunately, several scam victims have told us that they had a difficult time dealing with their bank after losing money to a scam. 

If you’re not happy with how your bank has responded to your situation, you can file a complaint with the and speak to a financial counsellor.

Do banks refund money you lose to scams?

While you’re likely to get your money back if it was taken out of your account without any action on your behalf, this isn’t the case with bank transfers you’ve initiated yourself.

In some countries, such as the UK, banks are required to reimburse most individuals who have transferred money to scammers, but Australian banks aren’t currently required to do this.

In some countries, such as the UK, banks are required to reimburse most individuals who have transferred money to scammers

The current advice from government regulators is still to contact your bank as soon as possible if you’ve transferred money to a scammer, in case they may be able to stop the transaction.

If you believe your bank has acted inappropriately during this process, or is responsible for your loss, you can get advice from a financial counsellor who’s familiar with the rules governing financial institutions. See point 5 “Get support” for more information.

3. Secure your personal information

Some scams don’t fleece you of funds straight away, but rather take your personal information, such as identity or online login details, with a view to using them later.

If you believe a scammer is holding your personal information, contact  for advice on what to do next.

It’s important to take steps to safeguard your personal information after you’ve been scammed.

IDCare is a nonprofit organisation that helps individuals who have been affected by identity theft or are worried about their cyber security.

It’s a free service and their identity and cyber security case managers can provide you with advice tailored to your situation and work with you on a plan to secure your identity credentials.

“Our expert case managers listen to your story, in a non-judgemental way, ” an IDCare spokesperson tells Vlog. “As they are listening to what has happened, they’re assessing the risk presented to you and developing a tailored plan of the steps you need to take to protect yourself.”

IDCare regularly helps people in a range of situations – from those concerned after visiting a suspicious website or divulging information to a scammer over the phone, to people who have been caught up in a data breach, and even individuals who have had their wallet stolen or house broken into.

Get in touch with IDCare by filling out the  on their website or by calling 1800 595 160 (available Monday–Friday, 8am–5pm AEST).

4. Report the scam

Report all scams (even if it’s a near miss and you haven’t lost any money or information) to the .

“Reporting to Scamwatch helps us identify emerging scams so we can alert the community, issue relevant warnings and provide timely advice and guidance,” an ACCC spokesperson explains.

Any report you submit to Scamwatch is also analysed by the National Anti-Scam Centre – an initiative that brings together experts from government, the private sector, law enforcement, and consumer groups to share up-to-date information on scams and disrupt and combat scams targeting Australians.

If you have lost money or personal information to an online scam, you can also , a portal run by the Australian Cyber Security Centre. Reports taken through here are passed onto police.

Depending on the type of scam you’ve encountered, you can also file reports with the relevant government agencies:

Type of scam Who to report it to
Financial and investment scams (Including those involving financial advice, financial products and insurance)
Cryptocurrency scams
myGov and Services Australia scams (Including those involving Centrelink, Medicare and Child Support)
Tax scams
Superannuation scams
dzܰ:

Fake shopping websites

If you’ve fallen foul of a fake shopping website, post about your experience on social media or on forums like Google Reviews or Trustpilot. 

If the site is impersonating an established retailer, it’s a good idea to let the brand and its customers know. An easy way to do this is by posting a comment on one of its official social media pages or by contacting them directly.

5. Get support

If a scam has put you in a difficult financial position, you can speak to a financial counsellor for free by contacting the  (NDH) on 1800 007 007. You can also live chat with a counsellor via the NDH’s website.

Speak to a financial counsellor if you’re stuggling financially after being scammed.

Claude Von Arx is a financial counsellor at the Consumer Action Law Centre who regularly speaks with scam victims and says financial counsellors can also advocate on your behalf and make sure you’ve been treated fairly by your financial institution.

“We ask a range of questions, around the nature of the scam, to work out what the response was from [a victim’s] financial institution,” he explains. “If we feel that a bank has not acted appropriately … or didn’t give out sufficient warnings and try to protect their clients, we will make a claim on the bank themselves.”

“We will try and get the client’s money back, even though the original funds are probably long gone,” he adds. “We go to the bank and make them financially accountable for not protecting their clients, where we deem it apparent.”

If you’re struggling with money, it’s also worth knowing that you may be able to get No Interest Loans (NILs) to help you deal with expenses. 

DzԱǴھ has more info on these, including eligibility criteria and where you can find a provider.

The post Five steps to take if you’ve been scammed appeared first on Vlog.

]]>
769121 person_typing_credit_card_details_into_computer_or_locking_card senior_person_giving_credit_card_details_over_the_phone