LevelUp 2026: Staying Safe Online – Phishing, Fake Login Pages and Password Resets

Phishing is the scam Australians report most often. A typical attack is a short message about an “unusual sign-in” or a “locked account”, a link, and a login page that copies a real brand down to the logo. The only reliable difference is usually the address bar.

At LevelUp we want every player to know how these attacks work before they meet one. Below: the current numbers, the warning signs in messages and on pages, how genuine password resets work, and two checklists for before and after a suspicious click.

How big the problem is in Australia

The National Anti-Scam Centre’s Targeting Scams report covers the calendar year 2025. Its key figures:

•       AUD 2.18 billion in combined scam losses, up 7.8% on 2024
•       481,523 scam reports across Scamwatch, ReportCyber, IDCARE, AFCX and ASIC
•       Phishing was the most reported scam to Scamwatch, with 65,361 reports
•       AUD 97.6 million lost to phishing, up 15.5% year on year

Australians aged 65 and over make up about 17.1% of the population but account for 26.5% of losses reported to Scamwatch. Betting and sports investment scams, sometimes called “scambling”, caused AUD 2.4 million in losses, and reports in that category rose 19.6% compared with 2024. Gambling accounts are clearly a target.

The real figures are likely higher. According to the ABS, around 30% of Australians who get scammed never report it.

How to avoid phishing scams: spot the fake before you log in

Most phishing attacks follow one pattern. A message creates time pressure, a link leads to a copy of a real page, and the details you type go straight to the scammer.

Warning signs in the message

Time pressure comes first: “24 hours”, “final notice”, “account locked”. Next comes a link you didn’t ask for, and a sender address that is close to the real one but not identical, such as support@secure-account-help.co. Generic greetings like “Dear customer” are another sign. A request to read back a code you were just sent is always a scam, because no legitimate company needs that code from you.

Warning signs on the page

The padlock used to be a useful sign. Today almost every phishing site runs on HTTPS, because certificates are free.

New links sent in messages

Scammers also send “new links” to gaming and banking sites through Telegram groups, comments and text messages. Some of these pages exist only to collect logins and card details. We publish our address only on our own site and in official emails. Treat any new address that reaches you through a message as suspicious until you’ve checked it through a channel you already trust.

Password resets: how the real ones work

A genuine reset follows a fixed sequence. You request it, the email arrives within a minute or two, the link expires quickly, and you set the new password on the company’s own domain.

A reset email you didn’t request means one of two things: someone typed your email address into a login form, or the email is fake. In both cases, don’t click the link. Open the site yourself, log in normally and change your password in the account settings.

Legitimate support teams never ask for your password or a verification code, whether by email, chat or phone. If someone asks, end the conversation and contact support through the site itself.

Checklist: before you type a password

☐  Open the site from a bookmark or type the address yourself

☐  Check the domain letter by letter

☐  Skip the ads at the top of search results

☐  Let your password manager fill in the login. If it stays silent, the domain may be wrong

☐  Turn on two-factor authentication wherever the site offers it

☐  Use a password that is unique to this site

A password manager only autofills on the exact domain it saved, so it works as an automatic address check. The same habit applies to your levelup login: save the real page as a bookmark once and log in only from there, not from a link in a message.

Checklist: if you think you’ve been phished

Act quickly. The first hour matters most.

☐  Change the password on the real site, and everywhere else you’ve used it

☐  Turn on two-factor authentication where available, or reset it if it was already on

☐  Log out of other active sessions if the site gives you that option

☐  Call your bank if you entered card or banking details

☐  Contact the site’s support team so they can watch the account

☐  Report it to Scamwatch, and to ReportCyber at cyber.gov.au if money was taken

☐  Call IDCARE on 1800 595 160 if you shared ID documents

FAQ

Is SMS two-factor authentication good enough?

It’s much better than no second factor. SMS codes can still be intercepted through SIM swap scams, where someone convinces your carrier to move your number to their SIM. An authenticator app or a passkey gives stronger protection. If SMS is your only option, ask your carrier to add a PIN to your account.

What are passkeys, and should I use them?

Yes, wherever they’re offered. A passkey replaces your password with a key stored on your phone or computer and unlocked with your fingerprint, face or PIN. It’s tied to the real domain, so a fake site can’t use it.

I got a data breach notice from a company. What should I do?

Change that password straight away, plus any other account where you reused it. Then expect more phishing. Breached email lists often lead to targeted scam emails that mention real details, like your name or a recent order.

Can I report a scam even if I didn’t lose any money?

Yes, and we recommend it. Scamwatch uses reports without losses to spot new campaigns and get fake sites taken down faster. A report takes about five minutes.