Four notices that turn up on a business’s board
-
A copy of your page
Scammers steal the name and branding of a real business to scam its customers, using fake websites and social media profiles.
Some make their phone number, email address or SMS sender ID look exactly like the business’s own, which Scamwatch calls spoofing.
-
A login that stops working
Scamwatch’s warning signs include being unable to log in to your social media and other online accounts, and unusual activity in your accounts.
The gaps it says scammers use include passwords that are reused or easy to guess, anti-virus software that is out of date, and wifi or Bluetooth connections left unsecured.
-
A bill for ads you never ordered
An invoice arrives for something nobody ordered: a directory listing, some advertising, a domain name renewal. Scamwatch says this is a common way scammers go after small businesses.
-
A helpful message from a “provider”
In phishing, scammers often claim to be a service provider verifying customer records because of a technical error, or a supplier running a customer survey. Once they have your details, Scamwatch says, they use them to get into your accounts or to pose as your business.
The phone number behind the password
A page’s login is often protected by a code sent to a phone. Scamwatch describes phone porting as a common example of identity theft: scammers gather personal information, then ask the mobile provider to transfer the number to a SIM card they control. Once it is ported, calls and messages, including two-factor codes, go to the scammer. Its warning signs include a phone that loses service and goes into SOS mode, and unexpected contact from your phone provider about your number changing.
Checklist: the page’s locks
From business.gov.au’s advice on keeping social media accounts from being hacked:
- Use strong passwords.
- Switch on multi-factor authentication.
- Make sure staff understand cyber security.
- Share the page’s passwords only with staff who need them.
- Change the passwords when a staff member leaves the business.
Checklist: your customers
A fake page works by fooling customers, so Scamwatch’s advice reaches them too:
- Tell customers how your business communicates with them, so they can recognise a fake message.
- Don’t use links in your texts and emails. Scamwatch says that if customers know you won’t send links, scams are easier to spot.
- Monitor how your business and brand name are used online.
- Give customers a clear way to report an impersonation to you, so you can act quickly.
- Make sure customer service staff know how to tell customers about scams that impersonate your business.
If someone has copied your page
Scamwatch’s steps for a business whose brand or website is being impersonated:
- For a fake website, find out who hosts it, then report it to the hosting provider and ask for it to be removed, including details of the impact on your intellectual property rights. Because the business and brand are your intellectual property, Scamwatch says the report is best coming from you.
- Where scam ads on social media use your brand, tell the platform as well.
- Warn customers wherever they meet you: your social media accounts, your website and app, and the point of sale, with links to Scamwatch so customers can report the scam and find advice.
If money or details have gone
Scamwatch’s steps if you have been scammed:
- Contact your bank or card provider immediately, and ask them to stop any transactions.
- Get help to recover. Scamwatch points to IDCARE, the national identity and cyber support service, which can help you make a plan to limit the damage, for free.
- Report the scam to Scamwatch, and make an official report to the police online through cyber.gov.au.
- Watch for follow-up scams, especially anyone offering to get your money back.
That last step is its own scam type. Scamwatch says money recovery scammers pose as government agencies, lawyers or charities and offer to recover stolen money for a fee, and that you won’t get any money back.