Commonwealth Bank, CBA and nbn scams targeting customers

That's the ominous warning from scammers as they begin targeting Commonwealth Bank customers in a vicious email scam.

"We've reached out to you before about confirming your personal details, and we've noticed that we haven't received confirmation of your details in NetBank or the Commbank app," the scam email states.

"If you don't confirm your personal details within the next 48 Hours, we may restrict access to your banking until you do."

The email has what looks like a CBA logo on it and states it's from from the 'Commonwealth Bank of Australia', but look closely and the email address is wrong.

IN OTHER NEWS

This reporter received one of the scam emails on Monday morning. The email address it came from was: ReubenHill@inyunmingoce.onmicrosoft.com

CBA is aware of the scam and warns emails and SMS messages are not from them.

"We'll never send you an email or SMS asking for banking information like your NetBank client ID, password, or NetCode; or include a link to login directly from an email or SMS," the bank said in its customer alert.

"These fraudulent communications inform recipients that their NetBank will be stopped or restricted if they fail to login and complete other actions such as verifying details or unlocking their account, by clicking on a malicious link within the email and entering their credentials or completing a verification process."

Meanwhile, fake nbn impersonation scams have targeted 4386 customers from January to September this year, with more than $1.58 million stolen from Australians.

NSW residents have suffered the biggest financial loss in this scam with $553,204 stolen. Queenslanders have had $470,191 taken, residents in Western Australia have lost $254,909 and Victorians $216,234 in the nbn impersonation scam.

nbn chief security officer Darren Kane said only around 13 per cent of victims report any type of scam to Scamwatch and he fears "the prevalence of nbn impersonation scams and losses is far greater than this".

While the number of nbn impersonation scams are down on the 6458 reported from January to September last year, an additional $151, 738 has been stolen.

Australians might have lost more than $2 billion to scammers in 2021, but this year it could almost double to $4 billion.

The Australian Competition and Consumer Commission's (ACCC) Scamwatch received more than 166,000 reports between January and September this year, showing a 90 per cent increase in losses to $424.8 million over the same period last year.

These numbers vastly understate real losses as only about 13 per cent of victims report to Scamwatch.

Take your time before giving money or personal information to anyone.

Scammers will offer to help you or ask you to verify who you are. They will pretend to be from organisations you know and trust like a business you deal with, police, government or fraud service.

Ask yourself could the message or call be fake?

Never click a link in a message and ask a trusted friend or family member what they would do. Only contact businesses or government using contact information from their official website or through their secure apps. If you're not sure say no, hang up or delete.

Act quickly if something feels wrong.

Contact your bank immediately if you lose money or personal information or if you notice some unusual activity on you cards or accounts. Seek help from organisations like IDCARE (idcare.org) and report online crime to ReportCyber (cyber.gov.au). Help others by reporting scams to Scamwatch.

Make your accounts as safe as your home. Set up extra steps on your accounts to stop people getting in.

Add more steps to show who you are when you log into your online services and apps. This is called multi factor authentication.

This could be a code sent to your phone, a token or secret question. Your face or fingerprint or voice can also be the key to let you into your accounts.

Ask your banks and service providers how to add more checks so no one can pretend to be you. And don't forget to tell them if you have been in a data breach.