Terms of Use or Privacy Policy Acceptance Scam
This email scam informs recipients that Telstra has updated their Terms and Conditions, Privacy Policy, or other administrative document. To continue using their email address or account, they must formally accept these changes. The email includes a link to a malicious website. The scam's goal is to trick recipients into providing their username and password. Telstra occasionally updates its policies and may notify customers of these changes. However, we don't require you to click on links in emails or sign in to accept them. Be cautious of scams that impersonate legitimate email addresses, such as "noreply@" addresses, to deceive recipients. If you're unsure, contact our experts via our Report Misuse of Service form for further guidance.
Bonus Rewards Points email scam
In this scam email you may be offered a large number of rewards points for a loyalty program such as Telstra Plus. The scam can impersonate many different brands, but, usually offers a significant number of points as an enticement to click on a link and provide information such as your username or password. The point amounts can be anywhere from 10,000 to 100,000 (or even more). In some variations of the scam, there may be an additional encouragement to click to spend "expiring points". Also note that there are some versions of this scam which may be sent via SMS (see our SMS scam section for more information). We recommend that you avoid clicking on links in email messages and instead access rewards systems through the official app or website.
"Laryngitis" gift card scam
This email based scam may come from a name, or email address, that is familiar to you. The scam message may claim that the writer hasn't been feeling well, and possibly has laryngitis and is unable to speak. The writer asks for you to do them a favour and reply back. The scammer then will ask for online gift card purchases to be made for them, and for you to take pictures of the gift cards and send the pictures as a reply. Never trust emails, or other online messages, which ask you to make such a purchase and share the gift card details.
Malicious QR codes in scam emails
There has been a significant increase in the malicious use of QR codes to trick potential victims into visiting malicious websites. Scam emails claiming to be from the ATO, myGov, or other organisations may contain threats or warnings of financial or other penalties as a way to scare people into scanning and using the QR code. Be extremely cautious with QR codes and never visit links they may point to without first evaluating the link's destination in detail. Most mobile devices will display the link location first, and if it does not point to a known and trusted website you are familiar with, do not click.
"We have received complaints about your email account" scam
In this scam, an email is received which claims that Telstra has received a number of complaints about your email account sending viruses. The email has a link to a malicious website which claims to help you "scan for viruses", or, in some cases, to download (fake) anti-virus software. Whilst Telstra does notify our customers of security or Internet abuse issues, these scam emails contain a number of spelling and grammatical mistakes, are not personalised for the recipient, and also contain a noticeable mixture of peculiar colours and fonts in an HTML email. Telstra's Internet Abuse department would never send messages in such a fashion.
Your mailbox needs to be upgraded or is expiring scam
This scam email may claim that your "Classic" mailbox needs to be upgraded to an arbitrary version (like "12.9"), and for this upgrade to take place, you should click on a link to a malicious website. There may also be a warning about "signal interruption" if you do not click soon. There are many versions of this scam, but they all indicate that an upgrade is required. Be wary of any messages making such a claim.
Cancellation of your Telstra subscription email scam
This email scam will claim that your "nominated debit/credit card or bank account" failed for payment and to avoid disruption to your services you should visit a (malicious) website which is designed to gather your My Telstra username and password. Telstra recommends using the official My Telstra app whenever you wish to review your legitimate account details with us.
Fraudulent software invoice (refund) scam
This scam usually consists of two parts: A fraudulent invoice for a product or service (usually computer anti-virus software), and a telephone number provided to call to dispute the charges in the invoice. The goal of the criminal is to convince you to call the number they provide and enquire about the charges. They may claim to offer a refund and ask for your credit card information to provide the refund. Instead of giving you money back, the criminals will make large charges on your credit card, for which you may be held responsible. In some cases, this scam is combined with the “Fake Technical Support” scams mentioned above and scammers will attempt to gain control of your computer to obtain actual invoices or bills you may have saved, manipulate the contents, and send you the fake “new” invoice to pay. Note that there are versions of this scam which do not contain a phone number, and are more like standard "phishing" scams where the fake invoice contains a link to a malicious website which may try to steal your personal or financial information. Many of these scam emails will claim to be an urgent reminder for renewal of computer security software due to expire within days.
“Your bill was paid twice” email scam
This is a very old email scam that returns every now and then. This scam claims that you accidentally paid your Telstra bill twice and are entitled to a refund. The email contains a link to a malicious website. If you are ever in question as to your Telstra bills or account, use the MyTelstra app or website to review the most recent status.
“Your AutoPay payment was unsuccessful” scam
In this email scam, a claim is made that Telstra was unable to process your last payment, and that a one-off payment is required to maintain services. The email contains a link to a malicious website and is often designed to gather your credit card information, or, other personal details.
Email Bill Overdue scam
This scam has many variations, but, contains a file attached which is an "HTML" or "ZIP" document, and usually has a name for the attachment such as "TRPB_1_K1702548545.html" or ends with ".zip". This document is a form of a phishing scam which, if opened, will appear in your web browser to look similar to a legitimate Telstra web page. The scam is designed to gather your personal information or username and password. Telstra does not send email bills as HTML or ZIP documents, so we would recommend deleting any email message which claims to be a Telstra bill and contains a document such as described here. You can always visit MyTelstra app or web to see the current status of your Telstra accounts and bills.
“Changes to Legal Agreements”
This email claims Telstra has made changes to legal agreements which apply to the recipient of the email. The message requests that you visit a website to “agree” to the policy updates. The email may threaten that if you do not click to “agree” that your account may be limited. Whilst Telstra may update our policies from time to time, we do not ask that you click on any links to agree to changes.
"SMS OTP CODE"
An email claiming that the last bill was unable to be processed and that a new credit card number needs to be provided. Most versions of this scam may refer to an "SMS OTP CODE" (often in all capitals) as part of the scam. The email may also instruct you to “keep the window open”. You may see a “3D Secure” or “Verified by VISA” logo on the scam website. This scam targets your credit card number and tries to trick you into providing it to criminals. Some versions of this scam email may contain a website link that points to the LinkedIn service.
"Your last payment was declined"
This email claims that “an invalid billing associated” was detected on your account, and requests that you visit a malicious website which asks for personal or financial information. Variations on this scam have been around for over a decade, and some other recent examples are listed below.
Invoice “INT 1-[long number]” and “code 004” or “code 044” scam
An email scam that claims a credit card payment was not successful. It may include a reference to “code 004” or “044” and possibly a number like 1-22341284291 or 1-2234129558471 as an invoice reference number. A link to a malicious website is also included. Note that the “INT 1-“ number may change, but the message is still a scam.
Ransom email
This is an email based scam which attempts to extort the reader into paying a ransom in Bitcoin to prevent the release of sensitive information. In some versions of the scam, the “From” and “To” of the email may appear the same, which is a trick used by scammers. The scammer may claim to have access to a computer’s camera or sensitive files. This is a scam and Telstra does not recommend paying the ransom. For Bigpond/Telstra accounts, you can manage your password in MyTelstra and make sure it is strong and unique.
"Unsuccessful Direct Debit"
This is a phishing email claiming that a payment failure by a financial institution requires a new credit or debit card to be provided. Email contains link to malicious websites. May also ask you to “Update Your Payment Method”
Fake “Overpayment” or “Refund Bill” notification
The email claims that an overpayment of 393.23 * 2 (638.46) was made, and that the recipient of the email is due a refund. The amounts may vary but will typically contain an amount and a multiplier (* 2). Email may be signed by a “Gerd Schenkel”. Contains a link to malicious website.
Business Email Compromise scams
We have recently noticed an increase in what’s referred to as a Business Email Compromise scam. These emails claim to be from senior people in a company and ask for money to be transferred urgently, or, to pay an urgent invoice.
In some cases, they may request the purchase of electronic Gift Cards (such as iTunes, Netflix, Steam, or Google Play cards). Other versions of this scam include unexpected invoices with fraudulent “new banking details” being provided.
In some cases, criminals may also attempt to impersonate employees and ask for payroll departments to re-direct salary to bank accounts controlled by criminals. Telstra advises all customers to verify bank and payment information in invoices carefully and repeatedly, and to not accept requests for payment submitted via email without speaking to trusted individuals to confirm the request first.
