What To Do If You've Been Scammed Online

First: don't panic, and don't feel embarrassed. Scammers are professionals. They run call centres, use real-looking websites, and know exactly which psychological levers to pull. Being tricked doesn't mean you're careless — it means someone worked hard to deceive you.

What matters now is acting quickly. The steps below are in priority order.

Step 1: Stop and disconnect

If you gave a scammer remote access to your computer — through software like AnyDesk, TeamViewer, or similar — disconnect immediately. Unplug your ethernet cable or turn off Wi-Fi. Then shut the computer down.

Do not use that computer again until it's been checked by a technician. Scammers routinely install software that gives them ongoing access even after the call ends. They can log keystrokes, steal saved passwords, and watch everything you type.

Step 2: Contact your bank

If any money was transferred, or you gave a scammer your bank details or card number, call your bank immediately. Use the number on the back of your card — not a number provided by the scammer.

Banks have fraud teams available 24/7. The faster you call, the better the chance of stopping or reversing a transfer. Tell them exactly what happened and ask them to flag your account.

Step 3: Change your passwords

Change the passwords on your most important accounts from a different, clean device — not the compromised computer. Priority order:

1. Email (this is the key to resetting everything else)
2. Online banking and financial accounts
3. myGov (Australian government services)
4. Any account where your credit card is stored (Amazon, eBay, PayPal)
5. Social media accounts

Enable two-factor authentication (2FA) on your email and banking if you haven't already. This means even if someone has your password, they can't log in without a code sent to your phone.

Step 4: Report it

Reporting helps authorities track and shut down scam operations — and it helps protect others from the same scam.

• Scamwatch — run by the ACCC, Australia's primary scam reporting body
• ReportCyber — for cybercrime including unauthorised access to your computer (Australian Cyber Security Centre)
• IDCARE — free support service for Australians who've experienced identity theft or scams: 1800 595 160

If you gave the scammer your Tax File Number, Medicare number, or passport/driver's licence details, contact Services Australia and the relevant document-issuing authority as well. Identity theft can follow months or years later if these aren't flagged.

Step 5: Get your computer checked

Even if no money was transferred and you think you caught it early, your computer should be checked by a professional. The most common scam types that involve computer access include:

• Tech support scams — fake calls claiming to be from Microsoft, Telstra, or your ISP, saying your computer has a virus
• Remote access scams — where you're asked to install software so they can "fix" a problem
• Invoice scams — fake invoices that contain malware attachments

In all of these cases, there's a risk of installed software, saved passwords being exposed, or other persistent access. A proper malware scan and system review will confirm what was or wasn't accessed.

What to expect going forward

Be aware that scammers sometimes sell victim lists to other criminal groups. If you've been targeted once, you may receive follow-up calls offering to "recover" money you lost — this is another scam. Hang up.

Monitor your bank statements and credit file for unusual activity over the coming weeks. The Australian Credit Reporting agencies (Equifax, illion, Experian) allow you to place a credit ban if you're concerned about identity fraud.