Search

Mistake in email causes Virgin Australia passenger to miss flight

A Virgin Australia passenger was left $800 out of pocket after he arrived at a closed check-in desk despite arriving well before the departure time, and he now believes that it's because of a mistake in the email he received from the airline. Max Cameron, 64, flies several times a week between Launceston airport in Tasmania and Melbourne for work, and received an email from the airline saying his flight was delayed back in January. "I got a text and an email from Virgin saying, very sorry to let you know your plane has been delayed by 45 minutes," he told Yahoo News Australia. The email also read "Check-in will now close 30 minutes prior to this time." "I thought, well done Virgin. You've come through… you've let me know when I have to be there. And as a result, I got out to the airport at 9:25pm for a 9:45pm closure of check-in," Cameron said. However when he arrived there was "literally not one person in the Virgin terminal," so he eventually had to leave, with no choice but to buy another flight ticket which cost him $800 including extra accommodation and transport costs. "I put my tail between the legs, went back and bought another ticket. I was very annoyed about that but I had no choice... check-in closed early," he said. After submitting an enquiry to the customer service team, they told him he had to arrive 30 minutes before the original departure time - a different instruction to what he received in the email, with the revised departure time. At the time, the enquiry was closed and the team said he would not receive any compensation. Cameron, who was unsatisfied with the response, then spoke to a supervisor at the airport, who told him: "Oh my God, it looks like they sent you the wrong email". According to Yahoo News Australia, Cameron reportedly did receive incorrect information which led him to miss his flight. Cameron has since been in touch with the airline and hopes to be reimbursed, but remains "unhappy" after what he had to go through. "It's not the money but the lack of accountability... there is no service mentality anymore," he said. "What Virgin has done to me is just so wrong". <em style="box-sizing: inherit; margin: 0px; padding: 0px; border: 0px; font-size: 16px; vertical-align: baseline; color: #323338; font-family: Figtree, Roboto, 'Noto Sans Hebrew', 'Noto Kufi Arabic', 'Noto Sans JP', sans-serif; background-color: #ffffff; outline: none !important;">Images: Yahoo News / Getty

Travel Trouble

"Eviction season": Real estate slammed for callous Christmas email

A real estate agency has been forced to apologise after tenants were sent a callous email about paying their rent on time over the Christmas period. The email, which is believed to be sent by Professionals Taylor Lakes in Melbourne, referred to the festive period as "eviction season", and encouraged renters to make timely payments to ensure "your living arrangements are not jeopardised over this festive period". "Christmas is a fantastic time of year and also a very busy time," the email begins. "Christmas time is also known in property circles as 'eviction season' as so many people choose to use their rental payments for Christmas spending instead of ensuring that their family accommodation remains top priority over this period. "We see so many tenants fall behind in their rent and then get into the position where they are not able to catch up, as this is their biggest financial obligation." The agency said it didn't want to be tasked with the "unfortunate job" of having to remove and evict them from their homes over Christmas. "We find this action very unpleasant for everyone concerned and we all enjoy our Christmas much less because of it," it said. "We urge you to pay careful attention and ensure that throughout December and January, you pay your rent on time, every time!" The email was met with a wave of backlash online, with many calling the message "thoughtless" and "not professional". "This is just appalling," Anti-Poverty Network SA wrote on Facebook. Professionals chief executive Katherine Gonzalez-Cork said the email was brought to her attention on Wednesday morning, and offered an apology to the recipients. "The email was distributed to tenants directly from the Taylors Lakes office and the content was not endorsed by me or the Board of Professionals and does not represent our company's expectations of communication with our property renters," she said. Image credits: Getty Images

Money & Banking

Hilarious reason dad couldn't be fooled by online scam

One savvy dad has outwitted a scammer who posed as his daughter, after the scammer made one hilarious error. Ian Whitworth, a dad from Sydney, took to his LinkedIn page to share the message a scammer texted him in a classic phishing scam that targets parents. He shared the photo of what he thought was the "funniest phishing text any parent has ever received". The text read, "Hey dad, dropped my phone in the sink while doing the dishes. Its unresponsive this is my new number for now just text me here x." Despite the terrible grammar and punctuation that would immediately alert anyone to the possibility of a scam, it was something else that caught the dad's attention. Instead, Whitworth said it was the fact his daughter would never do the chore mentioned by the scammers. Still, he thought it was worth sharing a photo of the text in a bid to warn others, which he uploaded along with the comment, "Cybersecurity update. I just got this." "Perhaps the funniest phishing txt any parent has ever received. 'Doing the dishes', yeah, for sure." In a reply to one of the people who commented on his post, Whitworth joked that his daughter "at age four emerged from my parents' kitchen with a shocked look on her face. 'What's pop doing?'. He was washing up in the sink." Another commenter wrote, "Haha! There is NO WAY this is from my son or daughter, that's for sure." Another commenter said the giveaway that it wasn't from his own child was that they didn't immediately ask for money, to which Whitworth replied, "Ha, yeah, the phishers are like the seven step ladder of confidence before the money issue gets raised. Actual kids: MONEY NOW." According to the federal government's Scamwatch website run by the Australian Competition and Consumer Commission (ACCC), the "Friends/Family Hi Mum" impersonation scam was common. "Scammers send messages pretending to be a family member or a friend desperate for money," it said. "They say they have a new phone and they need you to pay money to help them out of a crisis." Scamwatch warns: "Don't assume a person you are dealing with is who they say they are" and offers the following advice. "If someone you know sends a message to say they have a new phone number, try to call them on the existing number you have for them, or message them on the new number with a question only they would know the answer to," it said. "That way you will know if they are who they say they are." Image credits: Getty Images / LinkedIn

Legal

Why do I get so much spam and unwanted email in my inbox? And how can I get rid of it?

<a href="https://theconversation.com/profiles/kayleen-manwaring-8735">Kayleen Manwaring</a>, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a> Spam might not have brought an end to the internet or email, as some dire predictions <a href="https://www.zdnet.com/article/why-spam-could-destroy-the-internet/">in the early 2000s</a> claimed it could – but it’s still a massive pain. Despite all the spam being removed by spam-filtering technologies, most people still receive spam every day. How do these messages end up flooding our inboxes? And are there any legal consequences for the senders? <h2>What is spam?</h2> The Organisation for Economic Co-operation and Development (OECD) noted in 2004 “there does not appear to be a widely agreed and workable definition for spam” across jurisdictions – and this remains true today. That said, “spam” generally <a href="https://www.oecd-ilibrary.org/docserver/232784860063.pdf?expires=1693541947&id=id&accname=ocid177499&checksum=D0C5BDAC49951DF353618B8E38483253">refers to</a> unsolicited electronic messages. These are often sent in bulk and frequently advertise goods or services. It also includes scamming and phishing messages, according to the OECD. Most people think of spam in the form of emails or SMS messages. However, what we now call spam actually predates the internet. In 1854, a spam telegram was sent to British politicians advertising the opening hours of dentists who <a href="https://www.theguardian.com/technology/2013/aug/09/why-spammers-are-winning-junk-mail">sold tooth-whitening powder</a>. The first spam email came more than 100 years later. It was reportedly sent to 600 people on May 3 1978 <a href="https://web.archive.org/web/20080628205216/http://www.latimes.com/technology/la-fi-spam11may11001420,1,5168218,full.story">through ARPAnet</a> – a precursor to the modern internet. As for how much spam is out there, the figures vary, possibly due to the various <a href="https://www.spamhaus.org/consumer/definition/">definitions of “spam”</a>. One source reports the average number of spam emails sent daily in 2022 was about <a href="https://dataprot.net/statistics/spam-statistics/">122.33 billion</a> (which would mean more than half of all emails were spam). As for text messages, another source reports a daily average of 1.6 billion <a href="https://thesmallbusinessblog.net/spam-text-statistics/">spam texts</a>. <h2>Where do spammers get my details?</h2> Each time you enter your email address or phone number into an e-commerce website, you may be handing it to spammers. But sometimes you may even receive spam from entities you don’t recognise. That’s because businesses will often transfer customers’ contact information to related companies, or sell their data to third parties such as data brokers. Australia’s Privacy Act 1988 somewhat limits the transfer of personal information to third parties. However, these laws <a href="https://theconversation.com/accc-says-consumers-need-more-choices-about-what-online-marketplaces-are-doing-with-their-data-182134">are weak</a> – and <a href="http://handle.unsw.edu.au/1959.4/unsworks_75600">weakly enforced</a>. Some entities also use “address-harvesting” software to search the internet for electronic addresses that are captured in a database. The collector then uses these addresses directly, or sells them to others looking to send spam. Many jurisdictions (including <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s19.html">Australia</a>) prohibit these harvesting activities, but they are still <a href="https://www.projecthoneypot.org/statistics.php">common</a>. <h2>Is spamming against the law?</h2> Australia has had legislation regulating spam messaging since 2003. But the <a href="https://www.legislation.gov.au/Details/C2016C00614">Spam Act</a> surprisingly does not define the word “spam”. It tackles spam by prohibiting the sending of <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s15.html">unsolicited commercial electronic messages</a> containing offers, ads or other promotions of goods, services or land. However, if the receiver <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch2.html">consented</a> to these types of messages, the prohibition does not apply. When you buy goods or services from a company, you will often see a request to click on a “yes” button to receive marketing promotions. Doing so means you have consented. On the other hand, if your phone or inbox are hit by commercial messages you haven’t agreed to receive, that is a breach of the <a href="https://austlii.edu.au/cgi-bin/viewdb/au/legis/cth/consol_act/sa200366/">Spam Act</a> by the sender. If you originally signed up to receive the messages, but then unsubscribed and the messages kept coming after <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch2.html">five business days</a>, that is also illegal. Senders must also include a <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s18.html">functioning unsubscribe facility</a> in every commercial message they send. Spammers can be penalised for breaches of the Spam Act. In the past few months alone, <a href="https://www.acma.gov.au/articles/2023-06/commonwealth-bank-penalised-355-million-spam-breaches">Commonwealth Bank</a>, <a href="https://www.acma.gov.au/articles/2023-08/doordash-penalised-2-million-spam-breaches">DoorDash</a> and <a href="https://www.acma.gov.au/articles/2023-06/mycar-tyre-auto-penalised-1m-spam-breaches">mycar Tyre & Auto</a> were fined more than A$6 million in total for breaches. However, most spam comes from outside Australia where the laws aren’t the same. In the United States spam is legal under the <a href="https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business">CAN-SPAM Act</a> until you opt out. Unsurprisingly, the US <a href="https://talosintelligence.com/reputation_center/email_rep#spam-country-senders">tops the list</a> of countries where the most spam originates. Although spam sent to Australia from overseas <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s16.html">can still breach</a> the Spam Act – and the Australian Communications and Media Authority (ACMA) co-operates with overseas regulators – overseas enforcement actions are difficult and expensive, especially if the spammer has disguised their true identity and location. It’s worth noting that messages from political parties, registered charities and government bodies aren’t prohibited – nor are messages from educational institutions to students and former students. So while you might consider these messages as “spam”, they can legally be <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch1.html">sent freely without consent</a>. Factual messages (without marketing content) from businesses are also legal as long as they include accurate sender details and contact information. Moreover, the Spam Act generally only covers spam sent via email, SMS/MMS or instant messaging services, such as WhatsApp. Voice calls and faxes aren’t covered (although you can use the <a href="https://www.donotcall.gov.au/">Do Not Call Register</a> to block some commercial calls). <h2>Staying safe from spam (and cyberattacks)</h2> Spam isn’t only annoying, it can also be dangerous. Spam messages can contain indecent images, scams and <a href="https://www.cyber.gov.au/learn-basics/explore-basics/watch-out-threats/phishing-emails-and-texts">phishing attempts</a>. Some have <a href="https://www.cyber.gov.au/threats/types-threats/malware">malware</a> (malicious software) designed to break into computer networks and cause harm, such as by stealing data or money, or shutting down systems. The <a href="https://www.cyber.gov.au/protect-yourself/securing-your-email/email-security/protect-yourself-malicious-email">Australian Cyber Security Centre</a> and <a href="https://www.acma.gov.au/dealing-with-spam">ACMA</a> provide useful tips for reducing the spam you get and your risk of being hit by cyberattacks. They suggest to: <ol> <li> use a spam filter and block spammers – email and telecommunications providers often supply useful tools as part of their services </li> <li> unsubscribe from any emails you no longer want to receive – even if you originally agreed to receive them </li> <li> remove as much of your contact details from websites as you can and always restrict the sharing of your personal information (such as name, birth date, email address and mobile number) when you can – beware of pre-ticked boxes asking for your consent to receive marketing emails </li> <li> install cybersecurity updates for your devices and software as you get them </li> <li> always think twice about opening emails or clicking on links, especially for messages promising rewards or asking for personal information – if it looks too good to be true, it probably is </li> <li> use <a href="https://theconversation.com/what-is-multi-factor-authentication-and-how-should-i-be-using-it-191591">multi-factor authentication</a> to access online services so even if a scam compromises your login details, it will still be difficult for hackers to break into your accounts </li> <li> report spam to your email and telecommunications providers, and to <a href="https://www.acma.gov.au/dealing-with-spam#complain-or-forward-spam-to-the-acma">ACMA</a>. <img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/208665/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /> </li> </ol> <a href="https://theconversation.com/profiles/kayleen-manwaring-8735">Kayleen Manwaring</a>, Senior Research Fellow, UNSW Allens Hub for Technology, Law & Innovation and Senior Lecturer, School of Private & Commercial Law, UNSW Law & Justice, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a> Image credits: Getty Images This article is republished from <a href="https://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/why-do-i-get-so-much-spam-and-unwanted-email-in-my-inbox-and-how-can-i-get-rid-of-it-208665">original article</a>.

Technology

Devastating leaked email places Jenny Craig on brink of collapse

Weight loss firm Jenny Craig is reportedly closing its doors after four decades leading the industry. According to leaked staff communications, NBC News have shared that the company’s corporate and salaried field employees will face their final day of work on May 5, while their hourly staff will experience theirs on May 9. In the email, Jenny Craig explained that this was occurring “due to its inability to secure additional financing”. Employees were informed, however, that they would be receiving a “final pay cheque, including your full compensation earned through your last day of work and all accrued, unused paid time off”. Rumours have circled the company for some time, with Bloomberg reporting in just April 2023 that they were on the hunt for a buyer. The publication claimed that a source told them the company was “considering a bankruptcy filing” if their efforts to secure a buyer failed. Bloomberg also shared the news that the company was in around $250,000 USD in debt (~$376,000 AUD/NZD). Around the same time, corporate staff at the company’s California office received notice that they would be closing June 24, but that that day may actually be as soon as the next Friday. An FAQ was also released to them, alongside an explanation that they would be decreasing their physical operations to make way for their more e-commerce focussed business model. As a spokesperson told NBC News in the wake of the reports of potential layoffs, the company was “embarking on the next phase of our business to evolve with the changing landscape of today’s consumers. “Like many other companies, we’re currently transitioning from a brick-and-mortar retail business to a customer-friendly, e-commerce driven model. We will have more details to share in the coming weeks as our plans are solidified.” Despite this assurance, even coupled with the latest communications, it remains unclear whether or not that transition will still be taking place, with employees left in a state of limbo. The industry supergiant currently employs over 1,000 members of staff, with approximately 500 stores - both company-owned and franchised - across just the United States and Canada, with a further 600 around the rest of the world, including Australia. The company was actually founded in Melbourne in 1983, by husband and wife Jenny and Sidney Craig. The American couple went on to take their venture back to the states, but not until two years later in 1985. And while the situation looks dire overseas, an employee did tell Bloomberg that franchise-owned locations “may remain open”, though this is yet to be confirmed. Images: Getty

Body

How to declutter your inbox

Lisa Du is director of <a href="http://www.readytechgo.com.au/" target="_blank" rel="noopener">ReadyTechGo</a>, a service that helps people gain the confidence and skills to embrace modern technology. Is your inbox looking a little cluttered? Are you finding it hard to find past emails amongst the sheer mess that it already houses? There’s a solution, of course! Delete, delete, delete The first thing you should do? Delete stuff. Delete as much as you possibly can. And be ruthless about it. Don’t delete anything that you might need, obviously, like important receipts, password information, or reminders. But something like a notification from Facebook telling you that it’s someone’s birthday...yeah, that can go. For someone who doesn’t delete their emails, this will clear up your inbox considerably. In fact, it might take you a long while if you’re the type to leave hundreds of emails unread in your inbox. And for those of you who have thousands of unread emails, well... this process will be a lot more impractical for you. File away your emails Following this act of ruthless deletion, if your inbox is still looking a little too messy for your liking, there’s something else you can do: categorise. What this essentially means is that you can create different folders or labels for your emails, and then file your emails under each of these different folders accordingly. For instance, if you’ve been doing a little online shopping, and getting lots of confirmation emails for your orders, you might want to keep them in a folder called, “Shopping Receipts”. Though there are a lot of email hosts out there, the steps are generally the same. Here’s how to do it on a couple of sites. On Gmail.com: <ol start="1"> <li>Go to Gmail on your browser and login to your account</li> <li>You’ll see a sidebar on the left-hand side of your screen with different email categories, including “Inbox” and “Sent Mail”. Click on “More”</li> <li>This will expand the sidebar selection. You’ll see a section that says “Categories”. Click on “Create new label” under this section</li> <li>In the dialog box that pops up, type in the name of your label</li> <li>Now, you’ll see your new label under the left-hand sidebar</li> <li>Simply click and drag your emails into this label to file them</li> <li>From now on, when you want to find emails under this label, you’ll need to click into the label to see them</li> </ol> <img style="display: block; margin-left: auto; margin-right: auto;" src="../media/29156/gmail-declutter-inbox_499x445.jpg" alt="Gmail Declutter Inbox" width="499" height="445" /> On Outlook.com <ol> <li>Login to your email account on Outlook.com</li> <li>You’ll see a sidebar on the left-hand side of your screen titled "Folders" with different email categories, including “Inbox” and “Junk Email”. Hover your mouse over this title</li> <li>Beside the word “Folders”, you’ll see a plus sign. Click on this plus sign to create a new folder</li> <li>At the bottom of your sidebar, you’ll see a new entry for a new folder. Type the name of your new folder into this entry and press ENTER on your keyboard</li> <li>This entry will now be a new folder under the left-hand sidebar</li> <li>Simply click and drag your emails into this folder to file them</li> <li>From now on, when you want to find emails under this folder, you’ll need to click into the folder to see them.</li> </ol> <img style="display: block; margin-left: auto; margin-right: auto;" src="../media/29155/outlook-delclutter-inbox.jpg" alt="Outlook Delclutter Inbox" width="449" height="168" /> Being able to file your emails under different categories will not only clear up your inbox, but it will also introduce some order to your emails. Finding certain emails will be easier, your inbox will be less of an eyesore, and important emails will be less likely to become lost amongst a sea of spam. For more information about ReadyTechGo, visit their <a href="http://www.readytechgo.com.au/" target="_blank" rel="noopener">website here.</a> Images: Getty

Technology

Leaked email advises landlords to increase rent amid housing crisis

A real estate agency in Brisbane has come under fire over a leaked email in which landlords were advised to consider raising rents by more than 20 percent amid Australia’s worsening rental crisis. The email, sent by Ray White East End, asked landlords to consider whether their properties were being “under-rented” and advised them to increase rents by “above 20 percent” - more than double the rate of inflation - with potential earnings of an extra $10,000 a year. “Our property managers have been reviewing all our lease renewals and on average recommending a 17% rent increase on the leases renewed in October & November this year,” the email said, per <a href="https://www.theguardian.com/australia-news/2022/oct/17/brisbane-real-estate-agency-advises-landlords-to-increase-rents-by-over-20-amid-housing-crisis" target="_blank" rel="noopener">The Guardian</a>. “As we are planning December lease renewals, the average lease renewal recommendation is above 20%. This can be as much as $10,000 per year in additional rental income.” The agency said that “many landlords are not being provided with the information to make an informed decision” about rent increases, claiming that landlords were being advised to sign long-term leases with increases of $5 to $20 a week. The email also said that most tenants “are agreeable” to the increases and would understand that it is “fair and reasonable” based on what is available on the market. “On average, apartments in West End/Highgate Hill/South Brisbane/Brisbane CBD are renting for one bedroom $480 to $520+ [a week and for] two bedrooms $675 to $850+ [a week],” the email said. “If you are not achieving these rents (at a minimum), you should be asking why?” It comes as the Queenlsand government prepares to hold a housing summit to address rising homlessness and rental stress across the state. Penny Carr, the chief executive at advocacy organisation Tenants Queensland, said the email was an example of “opportunistic price-gouging” that is happening across Australia at the moment. “Rents are unaffordable for people at the moment and tenants are having to absorb increases because of fear of not finding another property or becoming homeless,” she said. “We should only allow rent increases above CPI if they’re justifiable and there’s been major work to the property or something’s had to be replaced.” Ms Carr said rent increases have been due to vacancy rates and supply and demand, and that the email dispels the myth that a land tax proposed by the government last year for interstate investors is to blame. Meanwhile, Ray White East End principal realtor Luke O’Kelly said rental affordability relies on investors. “Over the past 12 months, Brisbane has had some of the strongest population growth in the country and this has most clearly shown up in rental growth,” Mr O’Kelly said. “Right now, Brisbane doesn’t have enough homes for those that want to live here … with rents rising so quickly, Brisbane needs more property investors.” Fiona Caniglia, executive director of not-for-profit housing and homelessness organisation Q Shelter, said the timing of the email couldn’t be worse. “It is disappointing to hear this the week of the emergency housing summit to be honest,” she told <a href="https://www.news.com.au/finance/real-estate/renting/dont-have-enough-homes-rental-agency-ray-white-tries-to-increase-rent-by-20-per-cent/news-story/e4ff2ab4807fffe3b50b90fe81069156" target="_blank" rel="noopener">news.com.au</a>. “We already know that many vulnerable Queenslanders are struggling to secure a rental property in the first place.” “There are record numbers of people showing up for the small number of properties listed right across Queensland. Such an increase will only benefit those on higher incomes and will of course again negatively affect vulnerable Queenslanders, forcing more people into homelessness.” Ray White’s chief economist Nerida Conisbee defended the email in a statement shared with the outlet, saying that the market is currently ideal for investors. “Right now, Brisbane doesn’t have enough homes for those that want to live here,” she said. “This is making it tough for renters but does make it a good place to invest. While red hot house price growth is unlikely to start up again in the near future, yields are increasing as rents rise.” With Australians paying an extra $7.1 billion in rent over the past year and the average renter spending $62 more a week than this time last year, Greens housing and homelessness spokesperson Max Chandler-Mather said the email showed that urgent action is needed. “It’s this sort of flagrant price-gouging that demonstrates exactly why we need a national two-year freeze on rent increases,” he said. Image: Getty Images

Real Estate

Dream home turns into nightmare for scam victims

A Queensland couple who thought they had snapped up the home of their dreams have been left devastated after they lost almost $40,000 to a “cunning” email scammer instead. When Mitch Wilson and Penny Davies received an email from what appeared to be their real estate agent’s email address, they believed they were following their agent’s advice to then transfer the deposit for their house into a bank account. “It plays over and over in my head all of the time,” Ms Davies said. “We got an email from the real estate agent we had been dealing with, from their email account, saying in light of the contract please pay money to this account,” Mr Wilson told 9News. <img src="https://oversixtydev.blob.core.windows.net/media/2022/08/receipts.jpg" alt="" width="1280" height="720" /> The couple lost nearly $40,000 after receiving the fraudulent email (left), realising their costly mistake while messaging the actual real estate agent (right). Images: 9News After transferring the $39,000 sum, they thought nothing of it until the agent contacted them several days later asking where the funds were. “We went back and forth, we exchanged screenshots and emails from their side and ours, and what was obvious is the money didn’t go where it was supposed to go which was their account,” Mr Wilson said. “(It) ended up in some fraudster‘s account and then offshore to a crypto account.” But, the couple aren’t the only victims of this kind of scam, which police refer to as an email compromise scam. The scammers infiltrate an email account and use it to send emails to victims - making it difficult to identify that they are being scammed. Constance Hall, a mummy blogger, told news.com.au she felt “stupid” after losing thousands of dollars to the scam after she transferred money via a link sent from the real estate agency that managed the rental property she believed she was paying a deposit for. When she contacted the bank, she was told that the chance of recovering the funds was minimal as she had authorised the transaction, and that she should report it to the police. In the end, only $7.57 was recovered. “To have it all stolen in an instant … felt unbelievably unfair,” she said. Ian Wells, of Queensland Police’s Cyber Crime Group, told 9News: “These people with these skills, they‘re very cunning, they’re very calculated.” Police are advising home buyers to contact the business before paying invoices online to confirm bank account numbers, as the hackers change the bank accounts in invoices sent by business owners before forwarding the altered invoices to unsuspecting customers. Victims are also urged to contact their bank as soon as possible to report the fraudulent transaction. As for businesses impacted by the scams, the Australian Cyber Security Centre advises that they report the incident at <a href="https://www.cyber.gov.au/acsc/report" target="_blank" rel="noopener">https://www.cyber.gov.au/acsc/report</a>, alert other employees and clients, and report the breach to their email service provider. Image: 9News

Real Estate

Beauty brand praised for “thoughtful” opt-out email

Beauty brand Mecca has received a divisive response after sending out a marketing email giving subscribers the chance to opt out of Father’s Day promotions. The email, which was sent to all members of the Australian site last week, gave those who didn't celebrate Father's Day due to poor relationships or death a chance to opt out of further emails. “An option to opt out,” the email subject read. “Sometimes it's nice to choose which emails you see from us. In the lead up to Father's Day, we understand if you don't want to receive emails on the subject - so we've made it easy to opt out.” Thousands of Mecca customers flocked to Facebook to praise the brand's initiative, as many revealed that they had difficult relationships with their fathers. “I'm so glad for this email because I was burnt pretty hard by my dad and I don't need any reminders,” one woman said. “Even if it's not a go-to place for Father's Day gifts it's still great to see the initiative! I just hope they do the same for Mother's Day because I also don't have her around and it hurts to see,” she added. While the brand received a lot of praise for the email, others slammed it as a “shameful marketing stunt” and condemned people for being “overly sensitive”. “I think a lot more thought could have gone into it,” wrote one disgruntled customer. “I understand the sentiment but the specific reference to Father's Day was a bit weird.” “I don't remember getting one of these for Mother's Day. Why not a general email with a list of holidays allowing customers to choose which ones they want to opt out of?” she asked. While some people opposed the emails, the reception was largely positive, with customers calling on other brands to do the same. Image credits: Supplied

Beauty & Style

How QR codes work and what makes them dangerous – a computer scientist explains

Among the many changes brought about by the pandemic is the widespread use of QR codes, graphical representations of digital data that can be printed and later scanned by a smartphone or other device. QR codes have a <a href="https://www.forbes.com/sites/forbescommunicationscouncil/2021/03/25/how-the-pandemic-saved-the-qr-code-from-extinction/" target="_blank" rel="noopener">wide range of uses</a> that help people avoid contact with objects and close interactions with other people, including for sharing <a href="https://www.cnbc.com/2021/08/21/qr-codes-have-replaced-restaurant-menus-industry-experts-say-it-isnt-a-fad.html" target="_blank" rel="noopener">restaurant menus</a>, email list sign-ups, car and home sales information, and checking in and out of medical and professional appointments. QR codes are a close cousin of the bar codes on product packaging that cashiers scan with infrared scanners to let the checkout computer know what products are being purchased. Bar codes store information along one axis, horizontally. QR codes store information in both vertical and horizontal axes, which allows them to hold significantly more data. That extra amount of data is what makes QR codes so versatile. Anatomy of a QR code While it is easy for people to read Arabic numerals, it is hard for a computer. Bar codes encode alphanumeric data as a series of black and white lines of various widths. At the store, bar codes record the set of numbers that specify a product’s ID. Critically, data stored in bar codes is redundant. Even if part of the bar code is destroyed or obscured, it is still possible for a device to read the product ID. QR codes are designed to be scanned using a camera, such as those found on your smartphone. QR code scanning is built into many camera apps for Android and iOS. QR codes are most often used to store web links; however, they can store arbitrary data, such as text or images. When you scan a QR code, the QR reader in your phone’s camera deciphers the code, and the resulting information triggers an action on your phone. If the QR code holds a URL, your phone will present you with the URL. Tap it, and your phone’s default browser will open the webpage. QR codes are composed of several parts: data, position markers, quiet zone and optional logos. <figure class="align-center zoomable"><a href="https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img src="https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px" srcset="https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=372&fit=crop&dpr=1 600w, https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=372&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=372&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=467&fit=crop&dpr=1 754w, https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=467&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/451140/original/file-20220309-17-1jkfl5t.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=467&fit=crop&dpr=3 2262w" alt="a black-and-white pattern with four numerical markers attached to arrows pointing to portions of the pattern" /></a><figcaption>The QR code anatomy: data (1), position markers (2), quiet zone (3) and optional logos (4). Scott Ruoti, <a class="license" href="http://creativecommons.org/licenses/by-nd/4.0/" target="_blank" rel="noopener">CC BY-ND</a></figcaption></figure> The data in a QR code is a series of dots in a square grid. Each dot represents a one and each blank a zero in binary code, and the patterns encode sets of numbers, letters or both, including URLs. At its smallest this grid is 21 rows by 21 columns, and at its largest it is 177 rows by 177 columns. In most cases, QR codes use black squares on a white background, making the dots easy to distinguish. However, this is not a strict requirement, and QR codes can use any color or shape for the dots and background. Position markers are squares placed in a QR code’s top-left, top-right, and bottom-left corners. These markers let a smartphone camera or other device orient the QR code when scanning it. QR codes are surrounded by blank space, the quiet zone, to help the computer determine where the QR code begins and ends. QR codes can include an optional logo in the middle. Like barcodes, QR codes are designed with data redundancy. Even if as much as 30% of the QR code is destroyed or difficult to read, <a href="https://www.businessinsider.com/what-is-a-qr-code?op=1" target="_blank" rel="noopener">the data can still be recovered</a>. In fact, logos are not actually part of the QR code; they cover up some of the QR code’s data. However, due to the QR code’s redundancy, the data represented by these missing dots can be recovered by looking at the remaining visible dots. Are QR codes dangerous? QR codes are not inherently dangerous. They are simply a way to store data. However, just as it can be hazardous to click links in emails, visiting URLs stored in QR codes can also be risky in several ways. The QR code’s URL can take you to a phishing website that tries to <a href="https://www.ic3.gov/Media/Y2022/PSA220118" target="_blank" rel="noopener">trick you</a> into entering your username or password for another website. The URL could take you to a legitimate website and trick that website into doing something harmful, such as giving an attacker access to your account. While such an attack requires a flaw in the website you are visiting, such vulnerabilities are <a href="https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting" target="_blank" rel="noopener">common on the internet</a>. The URL can take you to a malicious website that tricks another website you are logged into on the same device to take an unauthorized action. A malicious URL could open an application on your device and cause it to take some action. Maybe you’ve seen this behavior when you clicked a Zoom link, and the Zoom application opened and automatically joined a meeting. While such behavior is ordinarily benign, an attacker could use this to trick some apps into revealing your data. It is critical that when you open a link in a QR code, you ensure that the URL is safe and comes from a trusted source. Just because the QR code has a logo you recognize doesn’t mean you should click on the URL it contains. There is also a slight chance that the app used to scan the QR code could contain a vulnerability that allows <a href="https://www.lifewire.com/how-to-protect-yourself-from-malicious-qr-codes-2487772" target="_blank" rel="noopener">malicious QR codes to take over your device</a>. This attack would succeed by just scanning the QR code, even if you don’t click the link stored in it. To avoid this threat, you should use trusted apps provided by the device manufacturer to scan QR codes and avoid downloading custom QR code apps.<img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/177217/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /> <a href="https://theconversation.com/profiles/scott-ruoti-1318954" target="_blank" rel="noopener">Scott Ruoti</a>, Assistant Professor of Computer Science, <a href="https://theconversation.com/institutions/university-of-tennessee-688" target="_blank" rel="noopener">University of Tennessee</a> This article is republished from <a href="https://theconversation.com" target="_blank" rel="noopener">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/how-qr-codes-work-and-what-makes-them-dangerous-a-computer-scientist-explains-177217" target="_blank" rel="noopener">original article</a>. Image: Getty Images

Technology

Woman scammed out of $730,000

A woman has lost an eye-watering $730,000 after opening an email from who she thought was her settlement agent. The victim was in the process of purchasing a property in Western Australia and had clicked on the email which asked for money to be deposited into an account they were in control of. After filling out the “authentic-looking documents”, the scammers were able to take control of $730,000. Consumer Protection WA confirmed that the settlement agent’s email was hacked by the scammers in what is described as payment redirection scams. Payment redirection scams are almost impossible to tell the difference between the real and the fake thing. In this instance, the woman did not think twice that the email would have been a scam after the agent reminded her of the payment. Consumer Protection executive director Trish Blake said the hack is sophisticated and can make it difficult to know when the hacking took place. “These scams usually involve the hacking into someone’s email account or computer system but it can be difficult to determine exactly where the hack has occurred,” she told <a href="https://www.news.com.au/technology/online/hacking/woman-loses-730000-after-one-scam-email-while-buying-property/news-story/0eabd0fcc189dc3a0bd7c472f0034150" target="_blank" rel="noopener">news.com.au</a>. “The hackers may have successfully guessed the password or installed spyware or malware on computers or laptops after recipients open attachments or click on links in scam emails. “The losses from these scams can be extremely devastating to the victims who may have lost their home deposit that they have been saving for many years and may not be able to buy the home of their dreams. Or it may be a business doing it tough that can least afford to lose such a large amount of money.” Image: Shutterstock

Money & Banking

Man rejected from interview through accidental email to management

Alexander Wood was refused an opportunity to be interviewed for a position he applied for thanks to an accidental HR email. This was the third time Alexander applied for a barista position at Utica Coffee Roasting Company in New York. He was interviewed by the company in April 2021 and was offered the role but was unable to accept due to his living circumstances. In December 2021, after reapplying, HR got in touch with Alexander saying they will set up a time for an interview…but no one got back to him. After applying again recently in March 2022, Alexander was rejected from any interview after he was CC’d in an email from HR saying he never showed up last time. “Well, today is the first time I got CC'ed on an email I should not have been,” he wrote on Facebook on March 15. “It was an email an HR employee meant to send to management about how I never showed up for an interview and I was CC'd into their responses.” He explained that he was at an “all-time low in my life, I had just left downstate after being rendered homeless for over a week, I had left my toxic relationship, and I was legally tied to an apartment that I did not feel safe living in.” After sorting out his life, Alexander applied once again, only to randomly check his phone and saw the “triggering email” from the company. “I got hopeful and checked when I could only to find out it was an email meant for the other managers talking about how I never showed up for an interview,” he continued. Sharing a screenshot of the email thread, HR had informed management that Alexander had allegedly not shown up for a previous interview. “Well that’s interesting ok so lets reject him…” management responded. Alexander said he would “never no-call, no-show an interview, especially at that point in my life.” Shocked at their unprofessionalism, Alexander responded with proof of their emails showing that someone from HR would get in contact with him but didn’t. “I am absolutely astonished at the carelessness in this situation. Needless to say, I will not get a job there and will most likely never step foot in the establishment again. “I'm confident in my skills and I hold enough pride not to put up with this kind of absolute garbage. These are the things you don’t do with your business.” Image: Facebook

Money & Banking

Serious claim about Ben Roberts-Smith’s most private emails

Ben Roberts-Smith’s lawyers <a rel="noopener" href="https://www.abc.net.au/news/2021-09-17/ben-roberts-smith-ex-wife-accesses-email-101-times/100469928" target="_blank">have accused</a> his ex-wife Emma Roberts of accessing the veteran’s email more than 100 times, as the case between the former couple continues in court. The case is running at the same time as his defamation proceedings against several newspapers. During the defamation case, Mr Roberts-Smith’s opponents issued a notice to produce specific documents. His legal team suspects the notice may have been issued following access to an email address he used for confidential correspondence. They have accused Ms Roberts of accessing the account and passing confidential information on to third parties, with Telstra records suggesting a close friend of Ms Roberts may have accessed the account. Arthur Moses SC, Mr Roberts-Smith’s barrister, applied to add Ms Roberts’ best friend Danielle Scott and her husband as respondents in the case currently being heard in the Federal Court. Mr Moses claimed that Telstra records established that either Ms Scott or her husband accessed a “hosting account” of RS Group Australia, the company Mr Roberts-Smith owns. He told the court the account was accessed “on at least 101 occasions” between January 2020 and May 2021. “The RS Group Australia email hosting account … is password-protected and enables a person, once logged on, to access the email account of any RS Group user, including the applicant’s,” Mr Moses said. The accusations come after Mr Roberts-Smith previously swore in an affidavit that neither Ms Scott or her husband had been given the password. Mr Moses said the Telstra records raised new issues, such as how the couple found the password, whether they had accessed Mr Roberts-Smith’s specific account, or whether they had shared confidential information with other parties. “If Ms Scott and her husband are not joined to these proceedings then the applicant [Mr Roberts-Smith] would have a basis to commence separate proceedings against them,” Mr Moses said. He continued, saying he would have included the pair as respondents when the case began, had his client been aware of the records. Justice Robert Bronwich reserved his decision. The defamation trial against the newspapers is currently on hold until at least November 1, and is expected to continue into 2022. Image: Getty

Legal

An elaborate phishing scam targets rental applicants

An elaborate phishing scam has left Australian rental applicants out of pocket, after real estate listing portal, Domain, was hit by a cyber attack. Domain CEO Jason Pellegrino confirmed in a statement that an unauthorised third party had gained access to the site’s administrative systems. This resulted in some users who had made rental enquiries being contacted by the scammers via email with requests to pay a deposit to secure their desired property. “We have identified a scam that used a phishing attack to gain access to Domain’s administrative systems to engage with people who have made rental property enquiries,” Pellegrino said. “We understand the scammers then contacted some of these people by email to suggest that they pay a ‘deposit’ to secure a rental property on a website nominated by the scammer. “While this is a serious matter, at this point our investigation shows only a small number of people may have engaged with the scam. “Clearly, people are becoming more aware of how to spot suspicious online behaviour and taking protective measures not to engage in such activity. “Unfortunately, since COVID, scams like these have been on the rise. It is disappointing for us to find out that after such a challenging past twelve months for many of us, some see this as an opportunity to take advantage of others.” Since the incident, Pellegrino said Domain had implemented “several additional security controls” and had “elevated our level of monitoring even further”. “We continue to implement further ways to identify and prevent phishing and have engaged external security consultants to provide further expertise in the management and prevention of online scams,” he said. Phishing scams attempt to trick individuals into sharing personal information such as bank account numbers, passwords, and credit card numbers with scammers. According to the Australian Competition & Consumer Commission’s ScamWatcch, $227,872 had been lost to 4460 scams in April alone.

Retirement Income

Woolies shoppers warn of major $250 voucher scam

Woolworths customers are being warned to avoid a major scam email that can be easy to fall for. The email has made its way into the inboxes of many unsuspecting customers and appears to have the supermarket’s branding to inform customers that they have the opportunity to receive a $250 Woolies gift card for just $1. Customers are told the voucher will be delivered through mail in just three days, as long as a first name, last name, postcode, and credit card details are provided. <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7841474/woolies-2.jpg" alt="" data-udi="umb://media/5c5ffdb3eb4e43209ae93bfc78741f96" /> The phishing scam is just one of the latest that have been dropped into the inboxes of naïve, unsuspecting shoppers. Website criminals use highly sophisticated scams that trick customers into giving out personal information. Woolworths told <a href="https://au.news.yahoo.com/woolworths-shoppers-warned-over-250-voucher-scam-003535085.html">Yahoo News Australia</a> the emails that claim to be offering the $250 voucher is not an authorised message from the supermarket. "As always, we encourage our customers to be vigilant of online and text phishing scams, which seek to imitate well-known brands to collect personal information," a spokesperson said in a statement. "We never ask customers for their personal or banking details in unsolicited communications."

Caring

Urgent email warning to Aussies over China hackers

<div class="post_body_wrapper"> <div class="post_body"> <div class="body_text redactor-styles redactor-in"> Australians are being urged to check their emails after a major Chinese infiltration of Microsoft's email system has left many exposed. There are fears that 7,000 servers are impacted by the threat in Australia after the Chinese state-backed hacker group known as HAFNIUM hit more than 30,000 servers in the USA. The campaign led by the hackers found recently discovered flaws in Microsoft Exchange software and stole emails while infecting computer servers with tools that left hackers to take control of the servers remotely. Brian Krebs, a cybersecurity expert, has reported on this massive breach. “At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organisations,” Krebs wrote in the <a rel="noopener" href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank">post</a>. One insider close to the incident explained whose been hit. “It’s police departments, hospitals, tons of city and state governments and credit unions,” said one source who’s working closely with federal officials on the matter. “Just about everyone who’s running self-hosted Outlook Web Access and wasn’t patched as of a few days ago got hit with a zero-day attack.” A zero-day attack is where hackers exploit potentially serious software security that the developer might be unaware of. The Microsoft Threat Intelligence Center (MSTIC) attributed the attacks with "high confidence" to a "state-sponsored threat actor" based in China which they named Hafnium. Microsoft is urging network owners to download the security patches available as soon as possible. It told customers "the best protection" was "to apply updates as soon as possible across all impacted systems". However, if your Microsoft Exchange servers have already been compromised, the patches are not "full protection against attack". You can find out <a rel="noopener" href="https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/" target="_blank">more information here.</a> </div> </div> </div>

Legal

Leaked emails reveal patient zero for Victoria's second wave disaster

Leaked emails have determined who patient zero is in regards to the resurgence of the disastrous second wave of COVID-19. It has been revealed that the spread of the deadly infection has been linked back to a night duty manager at the Rydges hotel on Swanston Street - not actually a badly behaved security guard. Leaked information shows that the night manager reported on Monday, May 25, that he had come down with a fever. The following day Department of Jobs, Precincts and Regions officials were told the hotel employee had tested positive. It is presumed he caught it from a returned traveller, who has not been identified. The emails show a commendable effort was made to stop the spread of the infection, however their efforts were proven futile. <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7837356/rydges-3.jpg" alt="" data-udi="umb://media/2c0bedc41c174b068038e22744c9635f" /> Seven security guards who were hired to patrol the hotel were stood down immediately and told to go home, isolate and get tested. Another small number of hotel staff and health workers were told to do the same. An email headed “Hotel staff member status and exposure to staff” reported on May 26 that the night manager himself was “now isolating at Rydges” and “feeling as well as can be expected”. Unfortunately, it was already too late and attempts to curb the spread of the infection failed. Five of the original seven guards, all from contractor Unified Security, soon returned positive COVID-19 tests. The disease was spread to their families in the northern and western suburbs of Melbourne, which helped seed the second wave that has infected 15,863 Victorians, including 7866 active coronavirus cases as of Thursday. As of Thursday, 275 people have died of COVID-19 in the state. Officials assumed it was a security guard who had been the first one to contract the disease however as it turns out, it was the night manager. There is no suggestion from any party that the hotel manager partook in any improper behaviour. Victoria’s Health Minister Jenny Mikakos was running the operations of the crisis, however former Health Minister and Attorney General Jill Hennessy has taken charge. “The suggestion that security guards ever had responsibility for infection control is one of the biggest myths of this debate,” a source closely involved in the hotel quarantine program told The Age. “Private and public hospitals use security guards, but those guards don’t deliver babies, perform surgery or oversee infection control. Full responsibility for infection control lay with the authorised officers who were brought in from various government departments.” Victoria Premier Daniel Andrews has created a board of inquiry to investigate the shortcomings in the hotel quarantine program. Chief Health Officer Brett Sutton has previously revealed that genomic sequencing carried out by Melbourne’s Doherty Institute shows that most, if not all of Victoria’s second-wave cases, may be traceable back to breaches in hotel quarantine. “Clearly there has been a failure in this program,” Professor Sutton said in July.

News

Warnings over Australia Post scam amid coronavirus delivery rush

Australia Post has warned customers of online scams as the postal service continues to struggle with unprecedented demand during the coronavirus pandemic. A fraudulent email is circulating which prompts the recipients to click on a phishing link. The link leads to a fake Australia Post website, which requests personal and financial information. “The email claims that your parcel was unable to be delivered and overweight, and asks for a payment to retrieve your package,” the company said. <iframe src="https://www.facebook.com/plugins/post.php?href=https%3A%2F%2Fwww.facebook.com%2Faustraliapost%2Fposts%2F10158359308595667&show_text=true&width=552&height=482&appId" width="552" height="482" style="border: none; overflow: hidden;" scrolling="no" frameborder="0" allowtransparency="true" allow="encrypted-media"></iframe> A previous alert also warned customers against fake websites branded with the Post Billpay logo. “Please note that Australia Post will never email or text message you asking for personal information, financial information or a payment.” Australia Post advised customers who have sent any personal or financial information to a scam email address or website to call ID CARE on 1300 432 273. The scam alerts came as Australia Post continues to deal with increased parcel volumes. In late April, the postal company said its parcel deliveries had <a href="https://thenewdaily.com.au/finance/consumer/2020/04/22/australia-post-parcels-coronavirus/">doubled in the past month</a> as online department store purchases rose <a href="https://www.abc.net.au/news/2020-04-22/waiting-on-a-parcel-from-australia-post-why-its-taking-so-long/12172772">473 per cent</a>. Many Australians waiting for deliveries at home have seen their online orders delayed for weeks. “We are doing everything possible to keep delivering during the Coronavirus pandemic,” Australia Post said on its website. “The challenges presented by the pandemic mean there are delays as our business adopts additional safety measures to protect our people and customers. “Other factors contributing to delays include fewer domestic flights, international delays and increased volumes as more people start shopping online.”

International Travel

Commonwealth Bank issues urgent warning over phishing scam

Commonwealth Bank has issued an urgent warning telling customers of an email scam that has hit thousands of unsuspecting inboxes across Australia. The scam, which contains the words “CommBank” was detected on November 29 by anti-virus software company Mailguard. Customers have received an email asking them to verify recent transactions on their card. “We encourage our customers to stay vigilant and look out for fraud and scams,” a spokesperson told<a rel="noopener" href="https://7news.com.au/business/banks/commonwealth-bank-issues-urgent-warning-on-new-email-scam-hitting-inboxes-right-now-c-587199" target="_blank"> 7NEWS.com.au</a>. “We offer our customers the benefit from our 100 per cent guarantee against online fraud where they are not at fault. “Where there is fraudulent activity, our process is to fully reimburse our customers as quickly as possible to minimise inconvenience.” <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7833028/commbank.jpg" alt="" data-udi="umb://media/881a4a09c8e34134bef991afd5b851ab" /> A blog shared by Mailguard about the phishing scam gave clear signs customers can follow to check if their emails from banks are authentic or not. The blog warned to check for spelling errors, and be aware if it takes you to the actual bank website or not. “This is another reminder for those who utilise online banking, to pay close attention to the emails they receive from their banks,” the post read. “To best protect yourself, it is imperative that you do not click any link contained within an email, especially if it does not address you by name.” Anyone who believes they have been scammed is urged to contact Commonwealth Bank.

Technology

PayID data breaches show that Aussie banks need to be more vigilant

When we think of a bank robbery, we might imagine a safe with the door blown open. But nowadays it might be more accurate to picture criminals accessing our bank account online from another country. Bank robbers don’t need balaclavas and shotguns anymore. Australian banks have long provided convenient ways for customers to transfer funds. But the process of remembering and entering BSB and account numbers is prone to human error. Enter <a href="https://payid.com.au/">PayID</a>. PayID allows customers to attach their mobile phone number or email address to their bank account. They can then simply provide these details to other people, providing a convenient way to receive payments. It can only be used for incoming payments, rather than outgoing ones. So you might think that makes it less of a tempting target for hackers. But that’s not necessarily the case. <a href="https://www.nppa.com.au/wp-content/uploads/2018/12/New-Payments-Platform-Financial-Services-Media-Release.pdf">Launched in February 2018</a> by <a href="https://www.nppa.com.au/the-company/">New Payments Platform Australia</a>, an alliance of 13 banks, PayID is reportedly available to <a href="https://www.nppa.com.au/wp-content/uploads/2019/02/NPP-One-year-on.pdf">more than 52 million account holders</a> across almost all major financial institutions. By February 2019, some 2.5 million PayID identifiers had been created, and 90 million transactions totalling more than A$75 billion had been processed. When entering a PayID mobile phone number to make a payment, the full name of the account holder is displayed, so the person making the payment can ensure they are sending it to the right PayID account. Shortly after the service launched, Twitter users began pointing out that this means you can enter random phone numbers and, if that number has been linked to a PayID account, the account holder’s name will show up – rather like a phone book in reverse. <a href="https://images.theconversation.com/files/292436/original/file-20190913-8687-1rizahf.png?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img src="https://images.theconversation.com/files/292436/original/file-20190913-8687-1rizahf.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" alt="" /></a> Twitter posting of PayID details. @anthonycr0 The following day, on February 17, 2018, NPP Australia acknowledged this issue in a <a href="https://www.nppa.com.au/wp-content/uploads/2018/12/PayID-privacy-statement.pdf">media release</a>, but effectively dismissed users’ concerns: <blockquote> While unfortunate for the individuals involved, the discussion highlights the choice and benefits to be considered by users when they opt in to create a PayID. </blockquote> This is not exactly reassuring for bank customers whose details were publicly posted. And developments this year suggest that the underlying problems persist. Better luck next time? In June 2019, around <a href="https://www.businessinsider.com.au/100000-australians-reportedly-at-risk-of-fraud-as-hackers-attack-westpacs-payid-platform-2019-6">98,000 PayID details were obtained</a> after hackers used several online bank accounts to carry out <a href="https://www.smh.com.au/business/banking-and-finance/australians-private-details-exposed-in-attack-on-westpac-s-payid-20190603-p51u2u.html">more than 600,000 PayID lookups over the course of six weeks</a>, reportedly by simply entering phone numbers in sequential order. It is not clear who was to blame, although there are allegations of a <a href="https://www.theage.com.au/business/banking-and-finance/australians-private-details-exposed-in-attack-on-westpac-s-payid-20190603-p51u2u.html">leaked memo pointing the finger at US-based fraudsters</a>. The exact motive is unclear, but any personal data has value in the underground economy. In this case, the data could potentially be used as part of a more complex phishing scam designed to steal further information from account holders. Although this is clearly a very simple attack involving nothing more sophisticated than simple trial and error, it appears the PayID system did not detect the large number of lookups – an average of 14,000 per account – or the speed with which they were undertaken. To give a real-world example, it would be like going into your bank 14,000 times and handing over a different piece of identification each time. This high volume of lookups should have raised significant security concerns. While legitimate users could be forgiven for needing a couple of tries to punch in the right number, no one should need thousands of attempts. It should have been a simple security step to add lookup limits and to identify this as highly abnormal behaviour. Yet neither the bank concerned nor NPP Australia had implemented mechanisms to detect or prevent this form of misuse. After a security breach this size, the banks might reasonably be expected to take urgent steps to prevent it happening again. But it did happen again, two months later. In August 2019, a further <a href="https://www.canstar.com.au/online-banking/payid-hack-which-bank-accounts-hit/">92,000 PayIDs were exposed</a>. In this case, it was reported that the breach happened <a href="https://www.nppa.com.au/uplifting-cybersecurity-controls/">within the systems of a financial institution connected to the NPP Australia systems</a>. Worryingly, this breach reportedly revealed users’ full name, BSB and account number. Banks were quick to <a href="https://www.nppa.com.au/uplifting-cybersecurity-controls/">reassure customers</a> that this does not allow transactions to be undertaken. However, it did deliver yet more valuable information into the hands of cyber criminals – further enabling phishing opportunities. While affected customers have been contacted, the only option to remove this risk is to stop using PayID. This is easily done but removes the convenience factor for most bank customers. What’s the real risk? Because the system enables payments into accounts, rather than authorising withdrawals from them, the risk may seem minor. Indeed, many in the banking sector have dismissed it as so. But there is a deeper risk. <a href="https://theconversation.com/phishing-scams-are-becoming-ever-more-sophisticated-and-firms-are-struggling-to-keep-up-73934">Phishing</a> is a form of cyber crime in which victims are tricked into revealing confidential information through convincing-looking emails or SMS messages. Unfortunately, there are already examples of this in relation to PayID. <img src="https://images.theconversation.com/files/292438/original/file-20190913-8674-1cbmg07.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" alt="" /> Real examples of PayID-related SMS phishing messages. canstar.com The approach depicted above is not particularly sophisticated. But imagine a more tailored email message quoting examples of identifiable information (PayID, full name) or, as with the most recent breach, BSB and account number. Coupled with the correct branding and reassuring words of your bank, it would be easy to convince an unsuspecting user of the need to “login to change your PayID for security reasons”. Just a few minutes of creativity on a computer can produce convincing results. The image shown below was created to show how easy this process is. It uses genuine branding, but the “login” button could easily be set to direct users to a website designed to steal login credentials. <img src="https://images.theconversation.com/files/292440/original/file-20190913-8701-1nq3pl8.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" alt="" /> Mock-up of a potential PayID-related phishing email. With the <a href="https://www.mebank.com.au/news/household-financial-comfort-report/">ME Household Financial Comfort Report</a> indicating that almost 50% of households have at least A$10,000 in savings, there is a clear incentive for cyber criminals to target our bank accounts. As with any phishing attack, it only takes a few people to succumb to make the enterprise worthwhile. Although bank customers can do little more than think twice before responding to messages, the real power is with the banks. Simply being alert to unusual patterns of behaviour would have prevented these security breaches. This is not new territory for financial institutions, who routinely look for <a href="https://www.cnbc.com/id/46907307">unusual patterns in credit card transactions</a>. Perhaps it is time to apply these same concepts in other scenarios and better protect Australia’s banking customers.<img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important; text-shadow: none !important;" src="https://counter.theconversation.com/content/123529/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /> <a href="https://theconversation.com/profiles/paul-haskell-dowland-382903">Paul Haskell-Dowland</a>, Associate Dean (Computing and Security), <a href="http://theconversation.com/institutions/edith-cowan-university-720">Edith Cowan University</a> This article is republished from <a href="http://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/payid-data-breaches-show-australias-banks-need-to-be-more-vigilant-to-hacking-123529">original article</a>.

Money & Banking

Our Partners

Over 60

News

Shop

Catalogues

Newspaper

Contests

Entertainment

Travel

Health

Lifestyle

Finance

Property

Compare

Games

Information

Keep up to date

Search

Mistake in email causes Virgin Australia passenger to miss flight

"Eviction season": Real estate slammed for callous Christmas email

Hilarious reason dad couldn't be fooled by online scam

Why do I get so much spam and unwanted email in my inbox? And how can I get rid of it?