They only took your name and email. What can scammers do with that?

On the night of Tuesday 6 October, Australians using the ASOS app got a push notification. Not an email that might be fake. Not a text from an unknown number. A notification from the app they installed themselves, on the lock screen, where the real ones come from.

It said ASOS HACKED, and underneath: We have fully compromised the Snowflake instance. Engage with us, or we will leak it.

Australian users saw it at about 8pm AEDT, which is the same moment London saw it at 10am. ASOS has not confirmed the attacker's claim about its Snowflake environment. Hours later the company apologised for the unauthorised notification and told customers not to click or engage with the link it contained.

In its statement to the market that day, ASOS said it was investigating unauthorised activity involving third-party platforms it uses to communicate with customers, that it had restricted access to those platforms, and that it was working with internal and external specialist advisers and all relevant authorities. On the data, it said that basic personal information including name and contact details may have been accessed, and that we do not believe that payment-card information or account passwords, were impacted. The stray comma is ASOS's.

Read the second half of that and most people relax. Two things are worth holding on to. It is the company's own assessment hours into an investigation rather than a verified finding, and even taken at face value it is narrower than it feels. Nothing was taken that you can change.

What can scammers do with your name and email address?

They can make the next message believable. That is the entire answer, and it is worth more to them than your password.

A password is a problem you can solve in ninety seconds. You change it, and the stolen one is now a worthless string. A card number is a problem the bank solves for you; they cancel it and post you a new one.

Your name is not like that. Neither is the email address you have had for eleven years and that every account you own points at. Neither is your mobile number, which is attached to your bank, your myGov, your two-factor codes and your kids' school.

So the useful question after a breach is not what did they take. It is what can they now do that they could not do last week. With a name, an email address, a phone number and the knowledge that you shop somewhere, somebody can write to you about a delivery you are actually expecting, from a shop you actually use, to an address you actually read. None of that requires a password. All of it is substantially more convincing than the generic rubbish most of us have learned to ignore.

This is why we keep coming back to the same point. The scam that gets you is not the one that looks like a scam. It is the one that knows something true about you.

The notification came from the real app

There is a second lesson sitting inside that incident, and it is bigger than one retailer.

Nobody had to spoof anything. The message did not have to look like it came from ASOS, because it came from ASOS: the genuine app, the genuine notification channel, the genuine icon on your home screen. ASOS has said the unauthorised activity involved third-party platforms it uses to communicate with customers, which is the ordinary machinery almost every company you deal with uses to reach you.

Hold that next to the advice most of us were given, which is to look at the message carefully and decide. On 7 October, a UNSW professor of computer science, Sanjay Jha, put the old version of that advice in its place:

We used to tell people to look for spelling mistakes.

Professor Sanjay Jha, UNSW, quoted by SBS News, 7 October 2026

Used to. In the same article, UNSW's professor in cybercrime and cyberwar, Richard Buckland, went considerably further, and his conclusion is the most interesting thing said in Australian consumer security this month. He argues that large financial institutions should stop contacting customers by phone and email at all, because neither channel can confirm who is really on the other end. In his words, companies have to stop doing it.

Whether or not the banks ever take that advice, notice what it concedes. A professor in cybercrime, reaching for a fix, concluded that the channel is the problem and that the customer cannot be expected to solve it.

Which is the same conclusion we reached from the other direction in the piece about an email that passed every authentication check because it was sent through the company's own mail provider. You cannot verify a message from inside the message. Last week's incident extends it by one uncomfortable step: you cannot verify a message from inside the app either.

Job scams: what your own profile tells a scammer

If you want to see contact details and public information turned into money, look at what happened to Australian jobseekers.

On 6 October the ABC reported that the ACCC received 138 scam reports relating to LinkedIn across July and August 2026, with reported losses of up to $254,449. Two months, one platform.

The mechanics are worth describing, because there is no dodgy sender anywhere in them. Fraudsters pose as recruiters or consultants, often using cloned profiles of real recruiters, and approach people with roles that match their profile. The ACCC's position is that these scammers often pretend to represent large companies or recruitment firms, and may ask for money to start a job or to pay for a course or training. One Australian jobseeker interviewed by the ABC, a former tech executive who had applied for more than 400 jobs over the past three years, was asked for $1,000 for a resume upgrade, then offered the same service for $50 when he refused, and separately received an email purporting to come from the engineering firm Aurecon. The ABC established that nobody from Aurecon had contacted him and that the sender had cloned a real Aurecon employee's profile. Aurecon told the ABC that fraudsters sometimes misuse its brand name, that it interviews candidates formally before making offers, and that it would never ask candidates for upfront payments.

Two details make this the clearest illustration of the whole problem.

The first is targeting. A tech recruiter quoted in the same piece, Trevor Churchley, said of jobseekers who signal that they are looking: They're the perfect target to approach because … all of a sudden, they gain the attention of recruiters. The ABC notes that many applicants add LinkedIn's open-to-work banner for exactly that reason. Nothing was breached to find them. They published it, for an excellent reason, and it was read by the wrong person.

The second is where the conversation goes next. LinkedIn's own platform data, published in its Job Search Safety Pulse on 6 May 2026, is that 90 per cent of reported scams involve an attempt to move the conversation off the platform, and that more than half of those attempts happen in the very first message. Those are global figures, not Australian ones.

The Australian numbers come from a companion release in June 2026, reported as a survey of 500 Australian professionals: 61 per cent had seen a job they suspected was a scam, 27 per cent had come close to falling for one, and 16 per cent said they had been a victim, rising to 25 per cent among Gen Z. Forty-nine per cent said financial stress would make them more likely to take risks when applying for jobs.

That last figure is the one to sit with. The defence most advice assumes you have, which is calm judgement, is exactly the thing that is in short supply in the people being targeted. Scammers are not finding the careless. They are finding the stretched.

Why the channel is no longer the proof

Put those two stories side by side and they are the same story.

Neither of those is defeated by reading more carefully. Both are defeated by the same unglamorous habit, and it is the one this month's national theme makes room for. Cyber Security Action Month asks Australians to take a second; this is what the second is for. Leave the message where it is, and go to the organisation yourself, through a route you found rather than one you were given.

It is worth being exact about why that works, because it is not a matter of being suspicious. It works because it does not depend on the message being detectable. A forgery you cannot tell from the real thing is still a forgery you never acted on, if the only thing you ever act on is a channel you opened.

What to do when your contact details are out

Here is the part that is usually missing. Almost all advice after a breach assumes something was taken that you can reset. When the answer is name and contact details, the standard checklist does not apply and people are left with nothing to do, which is why most of them do nothing.

You cannot recall an email address. So you harden what it unlocks, and you change what you expect to arrive.

1. Treat your mobile number as an account, not a label

Your number is not just how people reach you. It is a credential sitting in front of your bank, your myGov and your email recovery. Scamwatch published an alert on this in April 2026, and it specifically notes that people who know or suspect they were in a data breach may be at greater risk.

The warning signs it lists, in its order: unexpected alerts about changes to your mobile account; verification codes you did not request; login attempts or password reset emails you did not start; and your phone suddenly stopping, showing no signal, or switching to SOS only.

That last one is the serious one, and people mistake it for a network outage. If your phone loses service for no reason and the person next to you still has bars, treat it as an incident and not an inconvenience.

2. Get your codes off SMS where you can

A code by text is much better than nothing and the weakest of the options, because it can be intercepted and it can be talked out of you. An authenticator app is better. A passkey is better again, and for one reason that matters more than the cryptography: there is no code for you to read out, so there is nothing for the urgency to take.

If you only do this on one account, do it on the email address that was in the breach, because that is the account that can reset the others.

3. Split your identity email from your shopping email

This is the single highest-leverage change available to an ordinary household, and nobody mentions it.

Use one email address for the things that matter, which is banking, super, government, insurance and your domain registrar, and a different one for retail, loyalty programmes, apps, newsletters and anything with a sign-up form. The second address is the one that ends up in breach lists, and when it does, nothing of consequence is attached to it. It costs an afternoon and it permanently reduces the size of the thing you have to defend.

4. Expect the follow-up, and distrust the notification itself

When a breach is in the news, two things arrive in your inbox: the company's real notice, and other people's imitations of it. The imitations are easy to write, because the event is public and the details are in the paper.

So the rule applies to the breach notification as much as to anything else. Read it, believe nothing in it that asks you to act, and then go to the company the way you normally would. A legitimate notice never loses anything by being verified ten minutes later. And in the ASOS case, the company's own instruction was not to click or engage with the link in the notification at all.

One thing not on this list, because precision matters more than thoroughness: our view is that a name and an email address on their own are not a reason to ban your credit report. A ban is free and runs 21 days, so nobody is harmed by placing one, and the test in law is whether you believe on reasonable grounds that you have been or are likely to be a victim of fraud. But the control is built for the case where identity documents are exposed, such as a licence, passport or Medicare number, and reaching for the heaviest tool every time is how people end up ignoring all of them. We covered the mechanics in the piece on switching off your driver's licence.

How much this is costing Australians

For the scale of it, the national figures. The first four rows are self-reported and are therefore floors rather than ceilings. The last row is the ACCC's count for one platform over two months, and the ABC reports it as a ceiling rather than a floor, so it is written here the way the ABC wrote it.

One report every six minutes is the figure worth repeating at a dinner table, and $33,000 is the one worth repeating to anybody who thinks this is a small inconvenience that happens to other people. That is an average, so for a great many of those households it was considerably worse.

One second, still

It is still Cyber Security Action Month, and the national theme has not changed since last Monday.

Take a second. Stay secure.

Department of Home Affairs, Cyber Security Action Month stakeholder toolkit

Last week we argued that the pause is not a good habit sitting beside your real defences, it is the defence, because speed is the mechanism every scam depends on. We wrote that up in the piece on why every scam needs you in a hurry.

Last week's two stories say what the pause is for. It is not for squinting at the message. It is for getting out of the message, because the message, the sender, the app and the profile can all be wrong at once, and none of them is something you can check from where you are standing.

If you think you have been caught

Quickly, and in this order.

1. Contact your bank straight away and tell them it was a scam. Ask them to try to recall the payment and to stop any card involved. This is the step where minutes genuinely matter.
2. Change the password on your email first, then on anything that shared it, and turn on multi-factor authentication while you are in there.
3. If your phone has lost service or you are getting codes you did not request, ring your bank, then your telco. Scamwatch's order, not ours.
4. Report it to Scamwatch at scamwatch.gov.au. It is quick, and it is what the alerts are built from.
5. Ring IDCARE if identity documents are involved. It is free, it is a registered Australian and New Zealand charity and the national identity and cyber support service, and it will build you a response plan rather than sell you something. 1800 595 160, or +61 7 3555 5900 from outside Australia.

And the thing worth saying every time: being scammed is not a character flaw. A single changed letter in a settlement agent's real email thread nearly took $1.2 million off a first-home buyer in Perth, and what saved her was not her own vigilance but a banker who paused over the tone of the message. The targets in both of those stories were people buying clothes and people looking for work. Neither is a lapse in judgement.

If you want to know which of your addresses and numbers are already circulating before you decide what to harden, that is what our Digital Identity Health Check is for.

Related reading

• Why do scammers know your name and address?
• How to tell if an email is really from a company
• Driver's licence in a data breach? You can switch it off

SelfCybr helps Australian individuals and families see what's exposed, fix it, and learn how to stay ahead of it. No jargon, no shame, no data sold — ever. Australian-owned, Australian-hosted.

The ASOS incident

• ASOS PLC — Update regarding cyber incident, regulatory statement, 6 October 2026
• ABC News — ASOS and authorities investigating phone message sent saying online retailer had been hacked, 6 October 2026
• SmartCompany — ASOS HACKED: Aussie shoppers receive scary notification from UK fashion giant, 7 October 2026

The warning signs are changing

• SBS News — Think you can spot scam red flags? The warning signs are changing, 7 October 2026

Job scams

• ABC News — Jobseekers exploited by recruitment scammers on LinkedIn, 6 October 2026
• LinkedIn — The LinkedIn Job Search Safety Pulse: 2026, 6 May 2026, for the global platform figures
• The Australian Job Search Safety Pulse figures as reported by HR Leader and Digital Reviews, June 2026

Mobile fraud

• Scamwatch — Scam alert: Watch out for mobile fraud, 7 April 2026

National figures

• Minister for Defence — Annual Cyber Threat Report highlights persistent threat to individuals and across the Australian economy, 14 October 2025, for the Australian Signals Directorate figures
• ACCC — Continued action critical to combat fraud as annual scam losses exceed $2 billion, 30 March 2026

Cyber Security Action Month

• Department of Home Affairs — Cyber Security Action Month 2026 stakeholder toolkit

Support

• IDCARE — the national identity and cyber support service, a registered Australian and New Zealand charity