Scam alerts
Plain-English warnings about scams and online threats, checked against official sources.
Last updated: 23 Oct 2026
Scams change fast, and the official advice can be hard to find when you need it. Each alert here explains what's happening and who's at risk, then gives you simple steps to take and tells you where to report. Every alert lists the sources we used, so you can check them yourself.
We're a small Sydney studio, not a government agency, bank or police service. When an official source says something different from us, follow the official source.
Think you've been scammed? Act now. It's not your fault.
- Lost money or shared bank details? Call your bank or card provider straight away and ask them to stop any transactions. Use the number on the back of your card or in your banking app.
- Report it to Scamwatch (scamwatch.gov.au/report-a-scam).
- Cybercrime (hacked account, stolen money or data, extortion)? Report it to police through ReportCyber (cyber.gov.au/submit-a-report).
- Your identity details have been misused or stolen? Call IDCARE free on 1800 595 160.
- Need urgent cyber help? Call ASD's Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371). It's open 24 hours a day, 7 days a week.
- Someone is in danger right now? Call 000.
Be careful of anyone who offers to get your money back for a fee. That is usually another scam.
Alerts
-
Website owners: update PHP now to fix the "PHP2Shell" flaws
Two serious flaws were found in PHP, the software behind WordPress and many other websites. Fixes are out, and security companies report attack attempts. If your site uses PHP, ask your web host or developer to update it now.
-
Fake crypto "investment" sites: what a US$833 million crackdown tells us
US authorities say they've halted about US$833 million linked to overseas crypto investment scams. The same kinds of scams target Australians, who lose more money to investment scams than to any other type of scam.
-
Criminals are using AI to scale up attacks. Your logins are the target.
A security firm says a crime group used several AI tools to attack more than 400 banks and other financial targets in Latin America. The lesson for us is simple: protect your logins, and never hand over a code.
Prefer paper? Every alert has a print version. Use the Print button on any alert page.
About these alerts
Who writes these
SEVNworks, a Sydney studio that builds websites and AI workflows. Each alert is drafted, then fact-checked against its sources, then approved by a person before it's published.
How we check facts
- We prefer official sources, such as Scamwatch, ASD's ACSC (cyber.gov.au), ASIC's Moneysmart, CISA and the US Department of Justice, and the software makers' own advisories.
- Research from security companies is labelled as such, because those companies also sell products.
- We say what isn't known.
- We never link to live scam sites.
Disclaimer
These alerts are general information to help you stay alert. They are not financial, legal or technical advice, and they don't cover every situation. We check each alert against the sources listed, but scams change quickly, so always check the official source too. If you think you've been scammed, contact your bank first, then report it to Scamwatch or ReportCyber. SEVN Works Pty Ltd (ABN 84 677 263 035) is a Sydney web and AI studio. We are not a government agency, bank or police service.
Corrections
Spotted an error? Email victa@sevnworks.com with the alert's name and what you think is wrong.
- We fix confirmed errors within 2 business days.
- We fix serious errors the same day, such as a wrong phone number or advice that could cause harm.
- Corrections are shown at the bottom of the alert, for example "Corrected 23 Oct: we said X; it is Y." We don't make silent edits.
- If the alert went out in The Heads-Up, we correct it in the next issue, or send a short correction email if it's serious.
- The "Last checked" date shows when we last re-checked an alert's sources.
- Alerts older than 90 days show a banner: "This alert is from [month]. Advice may have changed."