Skip to main content

Before you click - verify. What one farming client's $45,000 scam can teach us all

Scams are getting harder to spot, even for people who consider themselves careful with money online.

One of our RFCS NSW clients found this out the hard way. She's switched on, financially literate, and not the type you'd expect to be caught out. But after receiving what looked like a genuine email from her bank, then a follow-up email appearing to come from the Australian Federal Police, she lost $45,000 from her farm partnership account.

How it happened

An email appearing to be from her bank asked the client to approve a payment, or call the number provided if she didn't. She called and reached a well-spoken scammer posing as a bank employee, who said her accounts were compromised and needed a password reset, which he'd "help" with. Her accounts were drained soon after. 

She's not alone. News.com.au recently reported on a Victorian farming couple who lost close to $100,000 after their bank was alerted to suspicious activity but took hours to act, by which point most of the money was already gone. Their case, now several years on, is still tied up in disputes over who's responsible for the loss.

These are two of many scam experiences that’ve devastated lives. Which is why we’re sharing them, as a timely reminder to be vigilant.

These scams work because they look real

Fake emails and texts from "your bank", or from agencies/authorities like the AFP or ATO, are designed to create urgency and panic so you act before you think. They often ask you to "verify" your account, click a link, or call a number provided in the message itself.

What you can do to protect yourself

  • Never click links in emails or texts claiming to be from your bank, the ATO, or police - go directly to the official app or website instead, or call the number on your recent statement.
  • If a message pressures you to act urgently, treat that as a red flag, not a reason to hurry.
  • Never give anyone remote access to your computer, even if they say they're from Microsoft, your bank, or a government agency.
  • Talk to someone - a partner, family member, or even your rural financial counsellor - before acting on any unexpected request involving money.
  • If you think you've been scammed, contact your bank immediately and report it at scamwatch.gov.au.

For a broad rundown of the scam types currently doing the rounds, Scamwatch is a good starting point: scamwatch.gov.au/types-of-scams.

What our IT specialists want you to know

Our RFCS NSW IT team put together the following, more detailed guidance - worth reading slowly, even if you think you already know the basics.

A familiar name or number doesn’t prove who contacted you. Scammers can disguise email addresses and phone numbers, and texts can appear in an existing conversation with your bank. Hang up and call the number on your bank card or use the official banking app.

Don’t rely on spelling mistakes or poor presentation. Scam emails can have professional wording and copied logos. Check the full sender address, but don’t assume an email is safe just because it looks correct.

Never share passwords, PINs or one-time security codes with someone who contacts you unexpectedly. Don’t approve a sign-in notification you didn’t initiate, even if the caller says it will stop fraud.

Don’t transfer money to a “safe account”. Your bank will never ask you to move money to another account to protect it from scammers. Scamwatch’s bank impersonation advice explains these tactics.

Check changes to supplier bank details by phone. If an invoice or email gives you new payment details, call your usual contact on a number you already trust before paying. Don’t use the number in that email, as it may have been changed too.

An accent isn’t a security check. Don’t assume a scammer will have an overseas accent or poor English. A well-spoken caller with an Australian or British accent can still be a scammer. AI can also generate convincing voices and imitate people you know. There is no “safe” accent. Scamwatch explains how scammers use AI.

Never reuse passwords. If one service is breached, criminals can try the stolen password on your email, banking and other accounts. Use a different, strong password for every account. A password manager can generate and remember them for you.

Check whether your details have appeared in a known data breach. Visit haveibeenpwned.com and enter your email address to see which recorded breaches it appears in and the types of information exposed. This doesn’t necessarily mean someone has accessed your email account, and a clear result doesn’t guarantee you haven’t been compromised. Change any exposed passwords and anywhere else you’ve reused them.

Don’t leave scanned identification sitting in your email or ordinary cloud folders. Copies of your driver licence, passport or other identification can help criminals impersonate you if they access the account. Remove copies you no longer need, including email attachments in Sent Items. If you need to retain digital copies, use a secure encrypted vault with additional access protection.

Regularly check your account sign-in history. Review recent activity in your email and other important accounts, particularly successful sign-ins from devices you don’t recognise. Locations can be approximate, and failed attempts don’t mean someone didn’t get in. An account can be compromised without obvious symptoms. For Microsoft accounts, this can also expose files synced or backed up to OneDrive. If you find an unfamiliar successful sign-in, secure the account immediately and get help from your IT provider.

Suddenly losing mobile service could indicate a SIM swap. If your phone unexpectedly loses calls, texts and data and there’s no obvious outage, contact your provider immediately using another phone, Wi-Fi chat or a store. A criminal may have impersonated you to obtain a replacement SIM or transfer your number. This can let them receive security codes and reset access to accounts, including banking. If a SIM swap is suspected, notify your bank immediately too.

Turn on multi-factor authentication wherever it’s available. Prefer an app such as Google Authenticator or Microsoft Authenticator over SMS or email codes, which are more vulnerable to interception or account takeover. If SMS is the only option, it’s still better than no MFA. Passkeys or security keys offer stronger protection against phishing where supported. The Australian Cyber Security Centre’s MFA guide explains the options.

Looking out for our farming community means being there for more than just financial advice; it's why we want you to have this information before you need it. Remember to Stop. Check. Protect. Find out more at Scamwatch.