Scam Text Messages in Australia — How to Identify Every Type

SMS phishing — called "smishing" — is now one of the most common ways Australians are scammed. Unlike email phishing, scam text messages arrive in the same conversation thread as genuine messages from the same organisation, because criminals can spoof the sender name on SMS messages. This makes them significantly harder to identify than email phishing and catches many people who consider themselves security-aware.

How SMS Sender Spoofing Works

Legitimate businesses send SMS messages using alphanumeric sender IDs — "CommBank," "Services Australia," "Australia Post." Criminals can use the same sender ID names to send fake messages that appear in the same thread as genuine messages from that organisation. Your phone has no way to verify that a message claiming to be from "CommBank" was actually sent by Commonwealth Bank — any SMS service provider can send messages with any sender name. This is a fundamental limitation of the SMS protocol that cannot be fixed on the recipient's end.

Australia Post Parcel Scam SMS

These messages claim you have a parcel that could not be delivered and ask you to click a link to reschedule delivery, usually requiring a small payment of $2 to $5 to release the parcel. In Melbourne's high-density suburbs, where parcel deliveries are common, this scam is extremely effective. Australia Post will never ask you to pay a fee to redeliver a parcel via SMS — you can track genuine deliveries through the Australia Post app.

Toll Road Scam SMS

Messages claiming you have an unpaid toll and threatening significant fines. These have been particularly prevalent in Victoria targeting CityLink and EastLink users — both of which Victorians know they use, making the scam seem plausible. Always log in directly to your toll account by typing the URL yourself — linkt.com.au or eastlink.com.au — rather than clicking any link.

Bank Security Alert SMS

Messages claiming your account has been locked, suspicious activity detected, or a new payee has been added — with a link to "verify your account" or "cancel the transaction." Your bank's genuine app or website will show you any actual issues. If the message concerns you, open your banking app directly and check — never click the link in the SMS.

The Universal Rule

Never click any link in an unexpected SMS. If the message claims to be from an organisation you deal with, close the message and contact that organisation directly through their official app or by typing their website address yourself. This one habit prevents virtually all SMS-based scams. If you have clicked a link in a suspicious SMS, do not enter any information on the page that loads, and run a security scan on your device.

Specific Scam SMS Campaigns in Victoria

Victoria-specific SMS scams have targeted CityLink and EastLink users with fake toll payment notices, VicRoads users with fake licence renewal notices, and AusPost customers with fake parcel delivery notices. These campaigns often concentrate on specific postcodes or demographics and use local detail to seem more credible. Being aware of these specific campaigns makes them easier to identify — if you receive an unexpected SMS about a CityLink toll and you do not regularly use CityLink, it is almost certainly a scam.

What to Do If You Have Already Responded

If you have already clicked a link in a suspicious SMS and entered information, act immediately. If you entered payment card details, contact your bank to cancel the card and report the fraud. If you entered myGov or government service credentials, go directly to my.gov.au, change your password, and enable MFA. If you entered your phone number or personal details, monitor for follow-up scam calls and report to Scamwatch at scamwatch.gov.au. Acting quickly — within minutes if possible — significantly improves the likelihood of limiting the damage. IntrusionX provides personal security consultations for Australians who have been targeted by scams — contact us for support and guidance.