Days after last week’s issue went out, my mum got a text “from ANZ” saying her rewards points were about to expire. It had a link, of course. She didn’t tap it. She doesn’t even have ANZ rewards, and it came from a number she didn’t recognise. Plus, she’d just read about this exact scam. If you got one too, now you know what it was.
This week’s scam is harder to spot. The scammers know things about you that only the real business should know.
// Scams & awareness
The “booking payment failed” scam
What it looks like
You’ve booked a holiday park for summer. Then a message arrives by email, text or WhatsApp. It has your name, the park’s name and your exact dates. It says your payment didn’t go through, and your booking will be cancelled unless you update your card details using the link.
Everything in it is right, except who sent it.
This is happening right now. A company called RMS Cloud runs the booking software used by thousands of hotels and holiday parks, and it was hacked. Guests of BIG4, Reflections, G’day Parks, Discovery Parks and others are now getting these fake messages, as the ABC reported this week. The parks themselves have been warning guests not to click.
How it plays out
The link takes you to a page that looks like the park’s booking page. You enter your card number to “save” your booking. The scammers then use your card, and some go on to call you pretending to be your bank, ready to “help” with the fraud they just committed.
Your real booking is usually fine. It was never in trouble.
Why it works
We’ve all learned to be wary of messages that get our name wrong or talk about things we never did. This one gets everything right. Real dates and a real booking make it feel genuine, and nobody wants to lose a summer holiday they’ve been looking forward to.
The giveaway
A payment “failed” on a booking you’ve already made, with a threat to cancel it.
A link asking you to re-enter your card details.
It arrives on WhatsApp, or from a number or email address you don’t recognise.
Remember: correct details don’t prove a message is genuine. After a data breach, scammers have the same details the business does.
What to do
Don’t tap the link or reply.
Call the park using the number on your original booking confirmation or their official website. Search for it yourself and don’t use any number in the message.
If there’s a real problem with your payment, they can sort it out on that call.
Report the message at scamwatch.gov.au.
Already entered your details?
Call your bank straight away using the number on the back of your card. Then let the park know. It’s never your fault, and the sooner you call, the more your bank can do.
// Quick tech tip
Why am I getting so much spam?
Someone close to me gets a pile of junk email every day and wondered why. The most likely answer is a data breach, like the one above.
How a breach turns into spam
When a company is hacked, the criminals usually take its customer list. That’s often thousands or millions of names and email addresses in one go.
Those lists are worth money. They get sold or traded online, then combined with other stolen lists into even bigger ones. Spammers buy them cheaply and send emails to every address, knowing only a tiny number of people need to reply or click for it to pay off.
The catch is that a list never goes away. Once your address is on one, it gets copied and sold again for years. That’s why spam can keep arriving long after you’ve forgotten the company that leaked it.
Find out where yours leaked
There’s a free website that shows you which breaches your email address has turned up in. It’s called Have I Been Pwned. “Pwned” is gamer slang for “beaten”, and it rhymes with “owned”.
It’s run by Troy Hunt, a security expert on the Gold Coast. When the FBI shut down a criminal marketplace selling stolen logins, it told the victims to check his site. The ABC told his story here if you’d like to read more.
I usually tell you never to type your details into a website. This one is an exception. It only asks for your email address, never a password, and it only tells you what’s already out there.
Step 1: Go to the website
Open your web browser and type haveibeenpwned.com into the address bar at the top yourself. Don’t search for it, so you know you’ve got the real site.
Step 2: Check your email
Type your email address into the box on the page and tap the button next to it.
Step 3: Read the results
You’ll either get good news, or a list of companies that have had a breach involving your email address. Each one shows when it happened and what was taken, such as names, phone numbers or passwords.
Don’t panic if the list is long. If you’ve had the same email address for years, that’s normal. On its own, a leaked email address only means more junk mail. The thing to watch for is a leaked password, which is covered below.
What to do about it
Look for “Passwords” in the list. If a password was leaked and you still use it anywhere, change it there, starting with your email account.
Keep your email address. You don’t need a new one. A leaked address mostly means more junk.
Use “Junk” or “Spam”, not “Delete”. Marking junk this way teaches your email to catch more of it.
You don’t need to read your spam folder. Your email has already sorted those messages out, and many of them are scams. Only check it if you’re expecting an email that hasn’t arrived, and then just look at who it’s from. If a real email has landed there, mark it Not spam. Never click links in anything in that folder.
Don’t click “Unsubscribe” in emails from companies you never signed up with. It tells the sender your address works.
Want a heads up next time? Tap Notify me on the website, and it’ll email you if your address shows up in a new breach.
One catch: it doesn’t include every breach. This week’s holiday park hack isn’t in there, so a clean result doesn’t mean you’re in the clear.
// This week’s habit to keep
A message that knows your details hasn’t earned your trust. Contact the business yourself.
That’s it for this week.
Let me know if there's something you want to know more about. Reply to this email, I read every one, and it might help someone else too.
Until next time,
John
P.S. Know someone with a summer getaway booked? Forward this before their “payment fails”.
New here? Subscribe to get it straight to your inbox every week.
