Bora Seker cuts through the latest cyber threats and answering your most pressing scam questions.
You lock the front door. You shut the gate. There’s a sign saying “Private”.
Then someone walks around the side of the house and tries the window.
Except this wasn’t a burglar… it was a computer program.
In June, an AI agent using technology developed by OpenAI, the company behind ChatGPT, accessed a Medicare statistics website after initially being denied access.
It had been asked to find statistics about Australia. When the website said no, the agent found another way in. In Prime Minister Anthony Albanese’s words, it “didn’t accept no for an answer”.
Two things are important.
First, this was not your personal Medicare record. The website contained aggregate statistics, such as the number of doctor visits that were bulk-billed. The Government says no names, Medicare numbers or medical histories were compromised.
Second, there is no suggestion somebody instructed the AI agent to break in. OpenAI says it “took actions we did not intend”.
You might think this is a story for Canberra and Silicon Valley.
It isn’t.
Whenever a big security story hits the news, scammers have an opportunity to exploit the confusion around it.
Don’t be surprised to see texts or emails saying something like: “Medicare data breach: confirm your details to protect your account.”
They’ll look official. They’ll sound urgent. That’s the point.
You don’t need to do anything about this incident, and nobody needs your personal information to “fix” it.
Services Australia says if you receive a text claiming to be from myGov containing a link, it’s a scam. A legitimate myGov text may tell you there’s a new message in your Inbox, but it won’t include a link.
Open the myGov app yourself or type my.gov.au directly into your browser.
And if somebody calls claiming to be from Medicare or myGov about the incident, hang up. Don’t give them information and don’t call a number they provide. Contact Services Australia independently if you’re concerned.
The computer program didn’t know when to stop.
You do.
That’s one advantage a scammer can’t take from you.
Q: I saw a Facebook ad for a new place called Blackstone Country Retreat advertising Devonshire teas and afternoon teas. When I asked where it was, they said they couldn’t give me the address until I’d paid because it was also a private home. I was hesitant and checked with ChatGPT, which suggested it could be a scam. Have you heard of it? – Wendy
A: Wendy, you did exactly the right thing, and in the right order. Something felt off, you stopped, and you checked before a cent left your account.
I can’t tell you for certain whether that particular business is legitimate, but what you were told contains some serious scam warning signs.
Think about a real tea room. It wants customers to find it. An address, contact details and information about the venue should be readily available.
Being told you’ll only discover where you’re going after you’ve paid is a very good reason to stop.
The explanation that “it’s also a private home” may sound reasonable, but it doesn’t remove the risk.
Next time you see an ad like this, make three quick checks.
No address, no booking. Ask where the business is before handing over money. If you can’t independently verify where you’re going, don’t pay.
Look it up yourself. Search the business name and town on Google Maps. Look for an established online presence and independent reviews. A brand-new place with no trace anywhere isn’t automatically a scam, but it’s a reason to wait.
Check the business details. If they claim to be an Australian business, ask for their ABN and check it yourself through the Australian Business Register
Be particularly cautious if you’re asked to pay by gift card, cryptocurrency or another unusual method.
Asking ChatGPT was a useful way to gather more information, but AI can get things wrong. Treat it as a second opinion rather than the final word.
Your gut got there first.
One last thing: report suspicious ads. On Facebook, use the three-dot menu on the ad to report it, and report suspected scams to Scamwatch. Those individual reports can help stop the same scam reaching somebody else.
Q: With all the technology these days, why can’t these scammers be tracked, hunted down and then sent to prison?
A: Phil, it’s one of the questions I get asked most often, and it’s a fair one.
Here’s the frustrating answer: scammers often can be tracked. It’s the “hunted down and sent to prison” part that’s difficult.
Picture a burglar who robs your house without ever leaving his own country. He uses a phone number that changes regularly. The money he takes passes rapidly through multiple accounts. And the person who actually calls you may be working for somebody else entirely.
Many scams targeting Australians originate overseas. Some operate from highly organised scam compounds, particularly in South-East Asia. In some cases, the people making the calls and sending the messages are themselves victims of trafficking or coercion, while the people running the operation are somewhere else.
Australian police can’t simply knock on a door in another country. They need cooperation from authorities there, and that can make investigations and prosecutions difficult.
That doesn’t mean nothing is being done.
Australian authorities work with banks, telecommunications companies, technology platforms and overseas law-enforcement agencies to take down scam websites, block phone numbers, interrupt payments and identify the people behind these operations.
But scams continue to cost Australians billions.
For now, one of our strongest protections remains surprisingly simple: stop, check and report.
If something doesn’t feel right, don’t let somebody else’s urgency become yours.
And report attempted scams even if you haven’t lost money. Every report to Scamwatch can help authorities connect one scam with another and identify larger operations.
Take a look at your email signature.
Plenty of us automatically put our mobile number at the bottom of every email. It’s convenient, but if somebody you’ve emailed has their account compromised, a scammer could potentially get your name, email address and phone number together.
That’s enough information to make their next approach sound much more convincing.
Consider leaving your mobile number off everyday emails and giving it directly to people who need it.
Services Australia Scams and Identity Theft Helpdesk: 1800 941 126
Scamwatch: scamwatch.gov.au
Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371)
IDCARE: 1800 595 160
If you’ve already sent money, contact your bank immediately using the number on the back of your card — never a number supplied in a suspicious message.
Bora Seker is a cybersecurity expert and host of the Dumb Ways to Get Hacked podcast, explaining online safety in plain English. Received a suspicious text or email? Seen an online offer that doesn’t look right? Worried you’ve been scammed, hacked or had your personal information compromised?
Send your question to askbora@startsat60.com and Bora may answer it in an upcoming Ask Bora column. Find Bora at @dumbwaystogethacked on YouTube, Instagram and LinkedIn.
Comments 0
Join the conversation. Comments are reviewed before they appear.
Be the first to comment.
Join the conversation
Tell us who you are to post a comment. We'll remember you next time.