Latest alerts.

With the start of tax time having just begun, a warning about the heightened risk of phishing scams is being issued by ME to all customers. 

Cyber criminals are increasingly using sophisticated tactics to create phishing links that impersonate common communications from financial institutions and government agencies such as the Australian Taxation Office or Medicare.  

What to look out for:

• Unexpected requests. Be wary of unsolicited requests for personal or financial information. Never click on a link or disclose sensitive information via email or text message. 
• Faked sources. Always verify the authenticity of the communication. Phishing messages can be spoofed to appear to be from a genuine source. 
• Red flags. Poor grammar, misspelled words, and email addresses that don't match the official domain are all common indicators of phishing attempts.

How to protect yourself:

• Do not respond or click on links. If you receive a suspicious email or message, do not click on any links or respond to the sender. 
• Report it. Make a cybercrime or cyber security incident report to the ACSC via ReportCyber at www.cyber.gov.au/report or call the Australian Cyber Security Hotline on 1300 292 371. You can also report suspected phishing attempts to ScamWatch.
• Secure your information. Change your passwords regularly, use strong, unique passwords and passphrases for all your accounts and enable multi-factor authentication where available. Monitor your accounts for any unusual activity.
• Contact the ATO. If you have any concerns about the legitimacy of correspondence, or individuals, contact the ATO directly using their genuine website and contact details https://www.ato.gov.au/ 
• Call ME. To report a fraud or scam, call ME immediately on 13 15 63 Monday–Friday, 8am–8pm, and Saturday 9am–5pm (AEDT).
• Alternatively, you can contact ME directly either via melb.fraudgroup@boq.com.au or get in touch using the details on our Contact ME page.

We have been alerted to a new impersonation scam. It involves a scammer who contacts customers and claims that suspicious transactions are being attempted on their ME card or account.

Customers have reported that the scammer impersonating ME, may:

• Claim to work in the ME fraud or security team. 
• Use spoofing technology to appear to be calling from a ME phone number or a similar number that looks correct at first glance (e.g. 1 digit difference).
• Have a British accent. 
• Provide an ‘employee number’ and/or transfer to a ‘supervisor’ if asked to prove they work for ME.
• Know the customer’s card details (from a third-party data breach or a past phishing incident).
• Use the customer’s card details to generate pass codes, this gives plausibility to their claims. They then ask for these codes to ‘stop’ the suspicious transactions.  
• Request other card numbers, login details and codes to ‘resolve’ the security issue. 

What to look out for:

• A text message, email or a call that may allude to a security compromise or transaction but not provide specific or accurate information.
• Callers who claim to require SMS or email pass codes to stop fraudulent transactions (when, in fact, this is what they need to complete the transactions/scam).   
• People who request your Customer ID and Access Code to secure your account or guide you through the self-service reset process and then they tell you a new Access Code to choose.  
• Someone who asks you to transfer funds to another account for safekeeping.  
• Urgency is emphasised. This is so the scammers can pressure you to provide your details or convince you to do something quickly. 

How to protect yourself:

• Never provide sensitive information to anyone over the phone, especially during a call that you did not initiate.
• Always call a trusted number to confirm whether you’re actually speaking with the organisation or company that says they are calling. 
• If you receive an unexpected call or SMS, never click any links or provide any personal or banking information.
• Never provide your internet banking details or one-time pass codes over the phone. 
• If directed to call your bank, always call ME on 13 15 63 or get in touch using the other details listed on our ‘Contact us’ page.
• If you think your account details or card details have been disclosed to a scammer, or if you receive a verification code that you didn't request, immediately contact ME on 13 15 63.

ME has been made aware of a new impersonation scam:, where an unknown caller is contacting ME customers claiming that their debit or credit card has been used at an overseas location. These messages are appearing in the same chain as previous legitimate ME correspondence and may include spoofed links and names to appear legitimate.

Several customers have reported that the scammer impersonating ME may:

• Have a British accent. 
• Introduce themselves as ‘Kevin’.
• Claim to work in the ME Fraud or Security team. 
• Will ask you to confirm your current account balance or account types. 

You may receive a look-a-like SMS from ‘MeBank’, to verify that you are speaking with ‘Kevin’ from the fraud team with an authentication code to quote to the caller. This is a tactic used to make their contact appear more realistic or genuine. 



The caller will request you to provide your Customer ID and Access Code “secure your profile’’. The caller will advise that you will be sent a one- time passcode SMS and request you to quote the code over the phone. However, after you provide the one- time passcode the caller can access your internet banking which may result in unauthorised transactions.
 
What to look out for:

• The text message or caller may allude to a security compromise with your account but may struggle to provide any specific information.
• Urgency is emphasized so that the scammers can pressure you to provide your details or convince you to do something quickly.
• Callers informing you that your funds are not safe and request you to provide your Customer ID and Access Code to secure your profile.

How to protect yourself:

• Never provide sensitive information to anyone over the phone especially during a call that you did not initiate.
• Call a trusted number to confirm you are speaking with the organisation or company that says they are calling. 
• If you receive an unexpected call or SMS, you should never click any links or provide any personal or banking information.
• Never provide your card information, internet banking details or a one-time passcode SMS over the phone.
• If directed to call your bank, always call ME on 13 15 63 or get in touch using the other details listed on our Contact Us page.
• If you think your account details or card details have been disclosed to a scammer, or if you receive a verification code that you didn't request, immediately contact ME on 13 15 63. 

 

We’ve been alerted to several phishing text messages that notify you that ME Bank has noticed an unusual payment from your account. The text message requests you to call +61390008776 if the transaction is not recognised, and it appears to come from the ME Bank user ID. The phone number provided takes you through to a scammer, who may ask you for your personal information, or to verify a One Time PIN sent to your mobile.

• If you receive an unexpected call or SMS requesting payment, never click the link in the message or provide card or account information
• Contact the company directly using a verified phone number or trusted channel to confirm the request
• Never share or disclose verification codes with a third party

If you think your account or card details have been disclosed to a scammer, or if you receive a verification code that you didn’t request, call ME on 13 15 63.

Ahead of Christmas is the busiest time of the year for online shopping, with enticing deals linked to Black Friday, Cyber Monday and the festive season appearing in our inboxes and in the media.

Online shopping scams continue to be one of the most common threats to Australians. These scams carry significant risks, exposing individuals and businesses through fake product listings, payment requests and non-secure payment avenues.

The increased storage of personally identifiable information, including card details on sites visited at this time of year, continues to elevate the risk by exposing individuals and businesses to data hungry cybercriminals. Once they have your bank details, you’ll lose more than the goods you thought you purchased. You’ll also lose your identity and bank information.

What to look out for:

• Requests for payments via bank transfer or virtual currencies
• Links in emails asking for bank details or other information
• Emails and messages about items yet to be delivered, or a fee required to release a ‘failed’ delivery
• Inadequate information about privacy, conditions of use, dispute resolution or contact details

Protect yourself:

• Use secure devices, and avoid public wi-fi networks
• Protect your payment information and accounts – avoid saving your payment details to online shopping accounts
• Use trusted sellers
• Know the warning signs
• If you receive any suspicious emails or messages, don’t click any links or provide your card details
• Be wary of online shopping deals and discounts – if it looks too good to be true, it probably is

If you have any concerns about the legitimacy of correspondence, call ME on 13 15 63.

Report a cybercrime or cyber security incident to the ACSC via ReportCyber or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

Scams and fraud can happen to anyone. That’s why our Financial Crimes Operations (FCO) team monitors customer accounts for any suspicious activity, like the recent Optus data breach.

For more information on the Optus data breach and what this may mean for you, see tips from the national identity and cyber support service, IDCARE.

Protect yourself:

• Don’t click on links within unsolicited text messages, emails or social media messages – go to directly the app or website by entering the correct details yourself
• When it comes to unknown phone calls, check the number and call the organisation directly using their legitimate details
• Update your passwords, using a strong password not used for other accounts
• Add two-factor authentication (2FA) to internet banking and personal accounts
• Monitor your transactions regularly, consider using PayID and review the payment transfer limits on your accounts
• Explore more online security fraud via reputable sources like Scamwatch, the Australian Cyber Security Centre (ACSC) and IDCARE

If your identity has been compromised, or to report a fraud or scam, call ME on 13 15 63.

We’ve received reports of scams involving an SMS message using the brand of well-known companies like Netflix and Linkt. These scams target customers to gain their personal information and card details by saying that your payment information needs to be updated, you have unpaid tolls, or your account has been suspended due to a payment failing.

The SMS contains a link to a legitimate looking website and prompts you to enter your card information. These details are being used to register the card information to a digital wallet on the mobile device of the scammer.

To complete the digital wallet registration, a verification code is sent via SMS. When this code is obtained by the scammer, they can successfully register the victim’s card to their own digital wallet and make purchases.

Protect yourself.

• If you receive an unexpected call or SMS requesting payment, never click the link in the message or provide card/account information
• Contact the company directly using a verified phone number or trusted channel to confirm the request
• Never share or disclose verification codes with a third party

If you think your account details or card details have been disclosed to a scammer, or if you receive a verification code that you didn’t request, call ME on 13 15 63.

There’s been an increase in reports where victims are being contacted by individuals claiming to be a family member requesting financial assistance to help pay invoices, outstanding bills or to repay debts.

These requests are being received via a range of popular messaging services where the sender advises they have recently changed phone numbers and to request you to delete and block their old number.

Once this has been completed, they will request you to provide or lend funds or even hand over login credentials to your internet banking.

As a recent publication from the Australian Communications and Media Authority explains: "These messages often begin with a "Hi Mum" and could provide several different reasons why they are using a different phone number including switching providers or having a lost or broken phone."

Protect yourself.

• If you receive a request similar to this, contact that family member via a trusted channel to validate the request

If you have any concerns about the legitimacy of any correspondence, or think you’ve paid money to a scammer, call ME on 13 15 63.

A scam trend has emerged where you may be contacted via Whatsapp, SMS or other social media from individuals claiming to be family or children who are in urgent need of money.

Yahoo!News reports victims receiving messages stating, ‘Hi Mum’ or ‘Hi Dad’. The scammer then claims that their phone has been lost, stolen or damaged and the number they are contacting them on is their new contact number, and request their victim to save the new number.

The scammer, purporting to be a family member, may claim that they are in trouble with an authoritative figure such as the police, or that they have urgent payments or bills which they are unable to pay due to their phone being lost or broken. The scammer urgently requests the victim to make the payment on their behalf as soon as possible and that they will return the money promptly.

Protect yourself.

• Be cautious of all approaches you didn’t initiate, especially if you’re asked to send money online
• Messages requesting money may become more desperate, persistent, or direct – if you do send money, they continue to ask you to send more
• Do not respond to the contact unless you are 100% sure they’re genuine
• Confirm the identity of the contact by calling the supposed family member directly via a reliable or previously known contact number
• Don’t conduct any payments or transfers instructed by the third party until you have verbal confirmation over the phone from the intended recipient/family member
• Don’t provide your banking, debit or credit card details or your personal information to anyone over messages, especially on a message that you didn’t initiate

If you have any concerns about the legitimacy of any correspondence, or think you’ve paid money to a scammer, call ME on 13 15 63.
 

Fundraising appeals often occur in the aftermath of a disaster. Unfortunately, some of these are scams.

Scammers may pretend to be government agencies providing information on flood/disaster relief through text messages and emails ‘phishing’ for your information. These contain malicious links and attachments designed to steal your personal and financial information.

Scammers are also pretending to be government agencies and other entities offering to help you with applications for financial assistance or payments for disaster relief.

Protect yourself.

• Be cautious of all approaches you didn’t initiate, especially if you’re asked to send money online
• Confirm the identity of the contact by calling the organisation directly – don’t respond to the contact if you’re not 100% sure
• Don’t disclose personal information in a phone call, like sharing your bank account screen, reading out passwords, or providing personal information or login details to MyGov
• Trusted organisations will not ask for an upfront payment to process recovery payments – requests from Services Australia and government departments can be verified with a call to hotlines on their websites
• If you donate to an established charity or not-for-profit organisation, make sure it’s registered by searching through the Australian Charities and Not-for-profits Commission Charity Register
• Learn more from trusted resources like the National Emergency Management Agency

If you have any concerns about the legitimacy of any correspondence, or think you’ve paid money to a scammer, call ME on 13 15 63.

Apple have identified two vulnerabilities in the operating systems of multiple devices (e.g. iPhone, iPad, Apple Watch, MacBook). This Australian Cyber Security Centre (ACSC) alert lists the operating systems affected.

Some vulnerable devices may be exposed to being infiltrated by hackers who can execute code to install malware or take other actions. All without the user clicking any links. This may enable criminals to steal personal data or interfere with, or compromise, banking services.

Protect yourself.

• Update your Apple mobile and laptop/personal computer devices immediately
• Setup automatic software updates on your mobile devices and laptops/personal computers
• Install reputable antivirus and anti-theft/loss protection software, only from official sources (like App Store or Google Play Store for mobile devices)
• On mobile devices, adjust settings to require a password before installing new applications
• Avoid letting your device automatically connect to new WiFi networks without confirmation
• Consider registering with the ACSC Alert Service

If you have any concerns of your banking services having been compromised, call ME on 13 15 63.