As a keen participant in online surveys and competitions, Mia Tang was not that surprised to receive a call telling her she had won a Coles Myer survey competition.
It was only when the caller started asking, "if [she] had a mortgage," and "what [her] husband did for work," that alarm bells started ringing.
"I said, I don't understand why these questions are relevant. But the caller just said she needed to know to deliver the prize," Ms Tang said.
"I asked for some time to think about it, and spoke with my husband. And straight away he said it sounded like a phishing scam."
This year so far phishing scams have netted almost $260,000 from Australian consumers, and been the subject of more than 11,000 reports to the Australian Competition and Consumer Commission's Scamwatch.
Phishing scammers use techniques via phone or email to trick victims into handing over valuable personal information such as bank account details, passwords, credit card numbers or even driver's licence numbers.
Phishing scams are the most common reported to Scamwatch, with reports 63 per cent higher than the next most common category. Australians aged over 65 are the most vulnerable.
"A lot of major organisations are moving online, bringing an end to the issue of paper bills. Therefore we are getting used to online communication from government, utilities and telcos," said ACCC acting chair Delia Rickard.
"Combine that with legitimate surveys online ??? offered by genuine retailers who do offer prizes and gift cards, and it's almost impossible to tell the difference between the real thing and scams."
In a second recent case, Melanie* unwittingly handed over her myGov account username, password, date of birth and credit card details to an email scammer purporting to be from myGov.
"Prior to getting the email I had been interacting with Centrelink and had provided my documents and credit card details to a Centrelink office," she said.
"So two weeks later, when I got an email from myGov asking me to verify my identity ... I thought there might have just been something wrong with the documents."
After she entered all her personal details, Melanie went back to check the URL in the original email, only to find it was registered to a server in southern Italy.
"It was pretty frightening because myGov has so much personal information about me," she said.
Ms Rickard said phishing scammers sought a range of personal details in order to put together "as complete a picture of you as possible".
"Scammers can find different parcels of information of the same person, put it all together and sell it ??? they are developing personality profiles," she said.
"Delete any email or hang up on a phone call that you receive out of the blue that is asking for your personal information, even if it purports to be from a well-known business or government organisation that you trust."
IDCARE is Australia's only national identity and cyber support service, launched in 2014 to assist victims of identity theft in reclaiming their personal details.
The not-for-profit organisation offers a free community service to anyone who believes their personal information is at risk.
"Often the biggest harm a person confronts is the bureaucratic melee they will have to confront across industry and government, after the fact ... so we develop a tailored response plan, " said spokesman Dave Lacey.
IDCARE estimates it will have assisted 35,000 Australians by the end of this year.
"On average, financial exposure for a client would be just shy of $10,000. But the most [harmful] we see are investment scams ... where you are looking at six figures," Mr Lacey said.
*Name has been changed on request
