Just last year, Noosa Council lost nearly $2million in an alleged international fraud attack in which perpetrators reportedly used artificial intelligence capable of “imitating personalities”. Now, artificial intelligence (AI) is giving scammers new ways to sound convincing, look legitimate and impersonate people we know, and Sunshine Coast residents and businesses are increasingly finding themselves in the crosshairs. Secure Access IT director Jason Garland and Federal Member for Fisher Andrew Wallace reveal the latest warning signs and how to protect yourself.
Q&A WITH JASON GARLAND
Sunshine Coast Tech Industry Alliance chair, Secure Access IT director.
How often are you hearing from Sunshine Coast residents or businesses who have been hacked, scammed or had their data compromised?
Unfortunately, we are hearing about cyber incidents far more frequently than most people would expect. Although our primary focus is working with businesses, we also receive regular calls from local residents who have fallen victim to scams, hacking attempts or data breaches. It’s a concerning trend that reinforces the importance of proactive cyber security measures and ongoing education for everyone using technology today.
Are there particular scams or hacking attempts you are seeing more often on the Coast?
Absolutely. The most common threats we’re seeing on the Sunshine Coast aren’t typically sophisticated hacks like you see in the movies. They’re scams that exploit people and business processes.
The biggest increase is in phishing emails, fake Microsoft 365 login pages, and business email-compromise scams, where hackers impersonate trusted suppliers, customers or executives to redirect payments or gain access to company systems.
We’re also seeing a rise in invoice fraud and payment redirection scams, where a business receives what appears to be a legitimate request to change bank account details. One missed verification step can result in significant financial losses. We suggest that you always call and speak with someone to confirm the change before making payments of
any size.
Another growing concern is the use of AI by cybercriminals, making phishing emails, fake websites and impersonation attempts much harder to detect. What we’re finding is that many incidents start with simple human mistakes such as clicking a malicious link, reusing passwords or not having multi-factor authentication enabled.
The key message for Sunshine Coast businesses is that size doesn’t matter. Small and medium businesses are often targeted because they’re seen as easier to compromise than larger organisations with dedicated security teams. As digital technology becomes increasingly important across our region, cyber security is no longer just an IT issue, it’s a business-risk issue.
What are the biggest cybersecurity vulnerabilities you see among small and medium-sized
Coast businesses?
Really, it’s everyday issues like: clicking on phishing emails; weak, shared or reused passwords; lack of multi-factor authentication (MFA); and staff training.
Often, it’s staff being tricked into transferring money or sharing sensitive information. The good news is that most of these risks can be significantly reduced through basic cyber hygiene, including MFA, regular staff awareness training, strong access controls, software updates and reliable backups. Cybersecurity is no longer just an IT issue. It’s a business risk that every organisation, regardless of size, needs to actively manage.
Have you noticed an increase in AI-generated scams, fake websites or impersonation scams among your Coast clients?
AI has supercharged cyber scams. The fake emails, websites and impersonation attempts we’re seeing today are far more convincing than they were even 12 months ago, which means Sunshine Coast businesses and residents need to be more vigilant than ever. The key message for Sunshine Coast residents and businesses is to slow down, verify requests independently and be cautious of any unexpected communication asking for money, passwords or sensitive information. A healthy level of scepticism is now one of the best cyber security tools we have.
Federal Member for Fisher Andrew Wallace says: “Almost every week, our office hears from someone in Fisher who has been scammed. More and more of them are careful, capable, financially literate people. Scams have changed, and the old advice about watching for bad spelling protects nobody now.
“I’m providing some practical information you can use to protect yourself, as well as understand how scams got so convincing, what to do in the first 24 hours if you are caught, and what to do if your details end up on the dark web.”
6 habits that do most of the work
1 Turn on multi-factor authentication for email, banking and myGov. Your email can reset everything else, so protect it first.
2 A different password for every account. One stolen password should not open anything else.
3 Never install remote-access software because a caller asked. No bank, telco or government agency ever will ask.
4 Agree on a family code word. Voice cloning is good enough now that an urgent call from a relative asking for money needs verifying.
5 Read your statements monthly. A small, unfamiliar amount is often a test before a large one.
6 Treat unexpected contact as suspect, however much the caller knows about you. Knowing your details proves nothing.
8 steps to follow if you’ve been scammed
Step 1. Call your bank immediately.
Do this before anything else, at any hour. Ask to stop or recall the payment, freeze the account and reissue your cards.
Step 2. Call IDCARE on 1800 595 160. It is free.
IDCARE’s head office is in Caloundra, in the Fisher electorate.
Step 3. Report it to Scamwatch.
Go to scamwatch.gov.au. Report it even if you lost no money at all.
Step 4. Report it to police through ReportCyber.
Go to cyber.gov.au. You will be given a reference number. Keep it somewhere safe, because you will often need it later to extend a ban on your credit file.
Step 5. Tell the right government agencies.
If myGov, Centrelink or Medicare details are involved, call the Services Australia Scams and Identity Theft Helpdesk on 1800 941 126. If your tax file number is involved, call the ATO Client Identity Support Centre on 1800 467 033.
Step 6. Put a ban on your credit file.
This is the step most people miss, and it is the one that stops a criminal taking out a loan or a phone plan in your name.
Step 7. If your bank will not help, escalate.
Make a formal complaint through the bank’s internal dispute-resolution process first, in writing. If you are not satisfied with the outcome, take it to the Australian Financial Complaints Authority – free to consumers.
Step 8. Look after yourself.
If being scammed has knocked you around, Lifeline is on 13 11 14 and Beyond Blue is on 1300 224 636.
WHAT YOU CAN DO
STOP: pause before you give anyone money or personal information. Urgency is manufactured, because urgency stops you thinking. Say no, hang up, delete.
CHECK: hang up and then call back on a number you found yourself: the official website, the back of your card, an old statement – never the number, link or address in the message itself.
PROTECT: ring your bank the moment something feels wrong. Change any password that may have been exposed. Report it even if you lost nothing: the report protects the next person.
BY THE NUMBERS
- In 2025, reports of online scams involving a loss rose 31.8 per cent. Scam text message reports collapsed, from 77,365 to 29,058. The dodgy SMS is out. Fake websites, social media profiles and paid advertising are in, because they look legitimate.
- Those five scam ‘vehicles’ described above represent 60 per cent of all reported losses. The most reported scam of any kind is phishing: 65,361 reports to Scamwatch.
- Australians aged 65 and over are about 17.1 per cent of the population, yet represent 26.5 per cent of all losses reported to Scamwatch.
