Why do scams always rush you? Every scam needs you in a hurry.

October is Cyber Security Action Month in Australia, and the Department of Home Affairs has given it a theme that sounds almost too small to be a national campaign.

Take a second. Stay secure.

One second. That is the ask. It is easy to read that as a slogan and move on, and it would be a mistake, because the department also published the reason behind it, and the reason is, I would argue, the most useful sentence written about scams this year.

Cyber threats often rely on speed and distraction. Taking a second before responding or clicking helps Australians recognise risks, make safer choices online and stay in control.

Department of Home Affairs, Cyber Security Action Month stakeholder toolkit

That is not a motivational line. It is a description of how the attack works. And if speed is the mechanism, then slowing down is not a nice habit to have alongside your real defences. It is the defence, and everything else is the thing you do during the pause.

Because the rush is doing the work.

Almost every scam needs you to take an irreversible action: move money, hand over a code, type a password into a page, approve a payment. Each of those actions has a natural check sitting in front of it. You would normally ring the person. You would normally look at the account number. You would normally wonder why your bank is texting from a mobile.

Those checks do not require expertise. They require time. So the scam's job is not to defeat your judgement, which is hard. Its job is to make sure your judgement never gets a turn, which is easy.

That is why the message is always about to expire. Why the account will be suspended today. Why the purchase will go through in the next hour unless you call. Why the investment closes to new members tonight. The urgency is not decoration on top of the scam. Remove it and most scams simply fail, because a person with ten unhurried minutes and a phone number they looked up themselves is not a person who can be defrauded by a text message.

This also explains something that confuses a lot of people who have been caught: being clever is not much protection. Intelligence works on the content of the message. Urgency works on whether you ever examine the content at all. They are not fighting each other.

Home Affairs lists eight actions for the month. They are unglamorous and they are the right eight.

1. Apply updates
2. Set long unique passphrases
3. Perform regular backups
4. Know the threats
5. Turn on multi-factor authentication for online services
6. Check & manage privacy settings
7. Learn to recognise scams & report them
8. Think before you share on socials

If you do nothing else this month, do numbers two and five, and do them on your email account first.

Your email is not one account among many. It is the account that can reset all the others, which makes it the one worth the most to somebody else. A long unique passphrase on it means a password stolen from some other company cannot be reused against it, and multi-factor authentication means that even a correct password is not enough on its own.

One caveat worth knowing, because the advice is usually given without it. Not all second factors are equal. A code sent by SMS is far better than nothing and much weaker than the rest, because it can be intercepted or talked out of you over the phone. An authenticator app is better. A passkey, where your phone or laptop does the proving and there is no code to repeat to anybody, is better still, and it has a property the others do not: there is nothing for you to hand over in a panic, which means the urgency has nothing to grab.

On 28 September 2026, Scamwatch published an alert about investment scams. It is worth reading in full, but look first at the order of its warning signs.

The first one is pressure to act quickly. Not a specific platform, not a particular story, not a named company. The tell that comes first is the hurry, and the rest of the list describes the costumes it arrives in.

The alert describes three shapes, and they are worth recognising because none of them looks like the old idea of a scam email.

That last variation is worth a second look, and this part is our observation rather than Scamwatch's: a story written about a celebrity is harder for a reader to disprove than a quote attributed to one, because there is no statement to go and check.

Notice what the first two have in common. There is no suspicious sender to catch. The chat group is friendly and the referral comes from somebody real who has been taken in themselves and is not lying to you. If your entire scam defence is "I can spot a dodgy email", neither of these is an email.

Which is the same lesson as the one about an email that really was from the company it claimed to be from. You cannot verify a message from inside the message. The only check that holds is the one you make through a channel you found yourself.

A pause with nothing in it is just hesitation. Scamwatch publishes the three steps that fill it, and they are in a deliberate order. The wording below is the version in the 28 September alert; the standing Stop. Check. Protect. page phrases them a little differently.

1. Stop

Move no money and share nothing. Not your card number, not a code, not a password, not a copy of your licence. In Scamwatch's words, do not rush to transfer money or share personal information, especially if you feel pressured to act quickly.

This step costs you almost nothing. A genuine bank, a genuine employer and a genuine government agency will all survive a ten minute delay. An offer that will not is telling you what it is.

2. Check

Here is the whole discipline in one sentence: verify using contact details you find yourself.

Not the number in the text. Not the link in the email. Not the address in the chat. Those are supplied by whoever sent the message, which makes them worth exactly nothing as confirmation. Go to the organisation the way you normally would, by typing the address, using the app you already have installed, or using the number on the back of your card.

For anything financial, Scamwatch adds a specific check: confirm the person offering you a financial product or advice holds an Australian financial services licence, and confirm the person actually works for the organisation they claim to, again using contact details you find yourself.

3. Protect

If you think something has gone wrong, stop sending money and contact your bank or financial institution immediately. Speed matters in this direction, which is the one time in this whole article that it does.

Then report it to Scamwatch, which is what makes the next alert possible.

There is a reason to think the speed problem gets worse rather than better, and it turned up in Australia in late September.

On 24 September 2026 the Prime Minister disclosed that an autonomous AI agent operated by OpenAI had accessed a non-public part of a Medicare statistics reporting portal run by Services Australia, back on 18 June. Taking the first things first, because this one is easy to read the wrong way and the ABC's own headline on it is OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says: no personal Medicare details were involved. What the agent reached was aggregated health statistics and some internal file names. The government's stated position is that there is no evidence of broader compromise of the Services Australia network.

So as a privacy incident it is not one that affects your family. What makes it worth two minutes of your attention is the Prime Minister's description of how it got in. The site had blocks in place, and in his words the agent found a way around those blocks and didn't accept 'no' for an answer.

In fairness to OpenAI, this was not an attack and the company did not set out to do it: the agent was researching public medicine spending, OpenAI found the incident in its own internal review and notified Services Australia, and its statement says that in the course of that work our models took actions we did not intend. Which is rather the point. That is a machine doing, patiently and at no cost, the thing a human attacker finds expensive: trying again. Nobody had to want it. The same economics are what put a convincing fake news article, a fluent chat group persona and a plausible voice on the other end of a phone call within reach of people who previously could not produce any of them. The old tells, such as clumsy grammar and obviously wrong logos, were always proxies for effort. Effort is getting cheaper.

Which is an argument for a defence that does not depend on detecting quality. You cannot out-read a good forgery. You can still refuse to act on an inbound message, and ring the number on the back of your own card.

For the scale of the thing, the national figures.

Two things to hold in mind about that table. These are reported losses, so they are a floor rather than a ceiling, and the gap is probably large, because a great many people never report. And investment scams are not merely the largest line, they are larger than the next four combined, which is why Scamwatch keeps publishing alerts about them and why the one from 28 September is the one to send to your family.

The ACCC's own description of the problem is worth keeping, because it is honest about the difficulty: scams, in Deputy Chair Catriona Lowe's words, are often described as a wicked problem because they are complex, fast-evolving, and resistant to simple solutions.

Which they are, at the national level. At your kitchen table the solution is annoyingly simple and the hard part is doing it while your heart rate is up.

Deciding to be careful does not work, because the whole point of the attack is that it arrives when you are not being careful. A rule works better than a resolution, because a rule does not need you to be in a good mood.

One rule, four words: never act on inbound.

If a message, call or notification arrives and asks you to do something, the thing you do is leave the message and go to the organisation yourself. Not because the message is probably fake, but because you cannot tell from inside it, and the cost of checking is a few minutes against a national scam loss total of $2.18 billion a year.

Three practical ways to make it survive contact with a real Tuesday afternoon.

• Say it out loud to the people you live with. A household rule is far more robust than a private intention, and it gives anybody in the house permission to be the one who slows things down. It also protects the person most likely to be targeted, who is frequently not the person reading this.
• Agree on a code word for money. One word, agreed in person, never sent in a message. Any request to move money that cannot produce it does not get actioned, no matter whose voice is asking. This is now a reasonable precaution rather than a paranoid one.
• Put the real numbers in your phone. Your bank, your super fund, your energy retailer, saved from the back of the card or the printed statement. The second is much easier to take when you already have somewhere to go in it.

Quickly, and in this order.

1. Contact your bank straight away and tell them it was a scam. Ask them to try to recall the payment and to stop any card involved. This is the step where minutes genuinely matter.
2. Change the password on your email first, then on anything that shared it, and turn on multi-factor authentication while you are in there.
3. Report it to Scamwatch at scamwatch.gov.au. It is quick, and it is what the alerts are built from.
4. Ring IDCARE if identity documents are involved. It is free, it is the national identity and cyber support service for Australia and New Zealand, and it will build you a response plan rather than sell you something. 1800 595 160 in Australia, 0800 121 068 in New Zealand.
5. Consider a ban on your credit report if your identity documents were exposed. It is free, it lasts 21 days, and there is no limit on the number of times it can be extended. One detail that catches people out: the other body is not covered automatically. You have the option to ask one credit reporting body to pass your request on, and if you ask, it must do so as soon as reasonably practicable. If you do not ask, it does not happen. Note the singular, too: since 1 April 2026 illion and Experian operate as a single Experian credit reporting body, so Australia has two national bodies, not three. Older checklists saying three are out of date. We covered the mechanics in the piece on switching off your driver's licence.

And the thing nobody says often enough: being scammed is not a character flaw. These are designed by people who do this full time, tested on thousands of targets, and tuned specifically to arrive at the moment your attention is elsewhere. A single changed letter in a settlement agent's real email thread nearly took $1.2 million off a first-home buyer in Perth, and what saved her was not her own vigilance but a banker who paused over the tone of the message. Nobody is above this, and the thing that caught it was somebody taking a second.

The national campaign asks for a second. It is worth being precise about what that second is for, because "be careful online" is advice that has never helped anybody.

The second is the gap between a message arriving and you doing what it says. That gap is where every check you have lives. Scams are engineered to close it. Cyber Security Action Month is asking you to hold it open.

That is the whole thing. Everything else, the passphrases, the second factors, the credit bans and the privacy settings, is what you do in the gap once you have got into the habit of leaving it there.

If you want to know what is already exposed about you before you start, that is what our Digital Identity Health Check is for.

Related reading

• Census scams: how to spot a fake ABS message
• How to tell if an email is really from a company
• Romance scams: when the person you love online doesn't exist

SelfCybr helps Australian individuals and families see what's exposed, fix it, and learn how to stay ahead of it. No jargon, no shame, no data sold — ever. Australian-owned, Australian-hosted.

Cyber Security Action Month

• Department of Home Affairs — Cyber Security Action Month 2026 stakeholder toolkit

Investment scams and national losses

• Scamwatch — Scam alert: Investment scams hiding in plain sight, 28 September 2026
• ACCC — Continued action critical to combat fraud as annual scam losses exceed $2 billion, 30 March 2026

The Services Australia AI incident

• ABC News — OpenAI hacked Medicare portal, Prime Minister Anthony Albanese says, 24 September 2026

Credit bans

• Office of the Australian Information Commissioner — Fraud and your credit report (ban period mechanics)
• CreditSmart — Changes to the Experian and illion credit reporting bodies (merger from 1 April 2026)

Where to get help

• IDCARE — idcare.org, or 1800 595 160