Name & Shame
Scammers

phishingNational

RMS Cloud Holiday Park Booking Phishing

I'm in Australia. I book stays at holiday parks. On 26 October, guests with upcoming bookings started getting WhatsApp messages, texts and emails about those stays. On 27 October, RMS Cloud confirmed it. RMS Cloud is the booking system used by a lot of Australian holiday parks, including parks in the BIG4, Reflections Holidays, G'day Parks and Summerstar Tourist Parks networks. The messages quote real booking details. That can be a name, the stay dates, or a confirmation number. They ask you to confirm card details or to make a payment. They say the booking will be cancelled unless you act quickly. The link opens a website that is not run by RMS Cloud and not run by the park. RMS Cloud says the messages are not from them. Guest names, contact details and booking details were accessed. Credit card and payment details were not. BIG4 said a breach of that third-party platform led to fraudulent messages asking for a credit card or payment details. Reflections Holidays told future guests that phishing emails were claiming a booking payment had failed, and said not to click links or share payment details. Summerstar Tourist Parks said fraudulent emails and WhatsApp messages that look like they come from Summerstar ask you to click a link to verify the booking. A message that already knows the stay is still a scam if it asks for a card or a payment through a link. The real booking does not change because a text arrived. If one of these messages lands with you, do not click the link and do not reply. Do not type in a card number. Open the park's own website and call the number published there, or use the confirmation you already have. If you already entered card details, call your bank on the number printed on your card. Report it to Scamwatch. Anyone who later offers to recover a payment for a fee is another scam.

phishingNational

Fake Etsy Sale Email via Snappy

I'm in Australia. I sell on Etsy. Early on 19 October, three emails arrived that looked like they were about my shop. I have never used Snappy. The shop had no orders. The first email arrived at 03:19. The subject was "You have a new order". The sender was FormSubmit. The message said someone had submitted a form on formsubmit.co. It was dressed up as an Etsy receipt for custom coasters, with an order total of $7.77, and it said the payment had cleared. The details link was written as https://etsy.com@tinyurl.com/43ndedvs. That is not an Etsy address. The words before the @ sign are decoration. The link opens on tinyurl.com. The second email arrived at 03:36. The sender name was "Etsy via Snappy". The subject was "Your account has been blocked". It said the account was temporarily suspended until identity verification was finished, and that listings were on hold. The link was written as etsy@t.co/JCpEpbckvl. That is a t.co short link, not etsy.com. The mail app hid the images and said the message looked suspicious. The third email arrived at 06:04. The sender name was "Etsy Team via Snappy", with the Snappy logo. The subject was "Confirm Sale". It said an item had just been purchased, and that I had to open a secure page before I could see a shipping invoice. The page was https://id9779312.shop/LQWhc. It said that after verification the funds would land on my card straight away, and that I had 24 hours. It was signed "The Etsy Team". I did not open any of the links. I did not type in a shop login, a card number, or ID. Etsy does not send sale mail through FormSubmit or Snappy. A real Etsy message comes from an address on etsy.com, or it sits inside the Etsy app. A link that puts etsy.com, or the word etsy, in front of an @ sign is a trick. The site that opens is the one after the @ sign, or a short link such as t.co or tinyurl.com. If this email lands with you, do not click the link and do not reply. Open Etsy by typing etsy.com yourself, or use the app you already have. If the shop shows no order, the email was fake. Report it to Etsy and to Scamwatch. If you already opened the link, or typed in a password, card, or ID, change the Etsy password from the real site and call your bank on the number printed on your card. Anyone who later offers to recover a payment for a fee is another scam.

phishingNational

Fake ATO Crypto Asset Disclosure Email

I'm in Australia. On 7 October an email arrived that looked like it was from the Australian Taxation Office. The subject was "Legal Requirement: Mandatory Crypto Asset Reporting". The sender name was the Australian Taxation Office. Inside, it called itself an official notice of requirement. The notice ID was ATO-2026-CRYPTO-4831692. It cited Taxation Ruling TD 2014/26 and TR 2014/7. The email said Australian residents have to disclose crypto. That included holdings on trading platforms, holdings in self-managed wallets, and income from staking, lending and mining. It gave 14 days to complete a mandatory crypto asset disclosure form. A second email the same day used the same story. It warned of fines up to $10,000 and prosecution under the Taxation Administration Act 1953 if the form was not completed. I did not open the form. I did not enter wallet balances, passwords or ID. The links were not on ato.gov.au, and they were not a message in myGov. The first link was a file on Amazon S3. The host was secure-connection-envelope-fbim8tayaz.s3.ap-southeast-1.amazonaws.com. The second email used a Backblaze address, secure-member-method-3davr2twvr.s3.us-east-005.backblazeb2.com. The ATO does not send a crypto disclosure form as a file on cloud storage. I do not use the myGov app. A real ATO message still turns up in the myGov inbox, or it comes in the post. It does not arrive as an email with a button that opens a disclosure form. If this email lands with you, do not click the link and do not reply. Forward it to ReportScams@ato.gov.au and report it to Scamwatch. If you already opened the link, or typed in holdings, sign-in details or ID, call the ATO on the number published at ato.gov.au. Do not use a number printed in the email. Call your bank on the number printed on your card.

phishingNational

PayID Wrong-Number $32 Text Scam

I'm in Australia. On 1 October I got a text saying someone had accidentally sent me $32 through PayID. The message said the money was meant for their partner, that they had typed the number wrong, and asked me to send it back. I checked the old bank account that is still linked to my PayID. I do not use that account. The $32 was there. Nothing else was in it. The same morning I also had missed calls, and nobody left a message. I did not send the $32 back, and I did not reply. PayID is a real Australian way to pay someone. A text is not how a mistaken payment gets fixed. If the money really went to the wrong account, the sender asks their own bank to recall it. If you transfer it back yourself and the bank later reverses the original payment, that $32 comes out of your money. The person texting you may also want it sent to a different number from the one that paid you. Leave the money where it is. Do not reply to the text. Do not return a missed call from a number you do not know. Call your bank on the number printed on your card, or the number inside your banking app, and let them handle it. If an old account is still attached to your PayID, move the PayID to the account you actually use, then close the old one. Report the text to Scamwatch.

otherNational

Fake Cloudflare Check on the Fienza Website

I'm in Australia. I was looking at a page on Fienza, the Australian bathware site fienza.com.au. A box popped up that looked like Cloudflare. It said human verification had failed, and that I had to finish steps on the keyboard before the page would continue. A real Cloudflare check stays in the browser. It does not ask you to open a command window, paste anything, or run a program. I closed it and did not follow the steps. I reported the page. The fake box is no longer on the Fienza homepage. Fienza is a real bathware business. This was not a message from them. Someone had placed a fake verification over their site. The page was set up to download and run a program on the computer. That kind of program is used to take saved passwords and sign-in codes. If any site asks you to press keys, paste, or run a command to prove you are human, close the tab. If you already did that, disconnect the computer from the internet, call your bank on the number printed on your card, and change important passwords from a different device. Report it to Scamwatch and ReportCyber. Anyone who later offers to fix the computer or get money back for a fee is another scam.

otherNational

Instagram Terminally Ill Dog Donation Scam

I'm in Australia. I came across an Instagram account calling itself Lisa the black dog. It posts videos of a black dog and claims the dog is a lymphoma warrior that needs chemo. The bio asks people to donate $6,000. Any amount helps, it says. The videos are stolen. They were taken from a real dog owner's account and reused to tell a completely different story and collect money. The fake account deletes comments that point this out. I have not donated. I am posting this so other Australians do not. Do not send money. Do not click a donation link. Do not join a GoFundMe if they post one. Report the account on Instagram. If you already paid, contact your bank or PayPal and report it to Scamwatch. Anyone who later offers to recover the money for a fee is another scam.