How to read a phishing email in 2025 without getting hooked
Phishing in 2025 looks nothing like the clumsy "Nigerian prince" letters of twenty years ago. Attackers now lean on generative AI to craft flawless grammar, mimic brand voices with eerie accuracy, and tailor lures using data harvested from earlier breaches. The result is a message that can pass a casual glance, even on a small phone screen.
Australia has become a favourite testing ground. Scamwatch data routinely shows locals losing hundreds of millions each year, with the ATO, MyGov, Australia Post, and the big four banks (CBA, Westpac, ANZ, NAB) used as bait. Melbourne and Brisbane residents report surging fake toll-road notices and energy bill threats, while Perth small businesses face waves of fake invoice redirects. The volume is high, and the quality keeps climbing.
Speed matters because the gap between receiving a lure and losing money can be a single distracted tap. Account takeovers cascade into crypto wallets, super funds, and home-loan redraws. Treating the inbox as a triage queue, rather than a to-do list, is the simplest habit shift that protects you.
Reading a suspicious email quickly is a teachable skill. It comes down to knowing which parts carry the most signal and which parts attackers have learned to polish so you miss the real red flags.
The sender line still tells the most truth
The display name is the first thing your eye lands on, and the easiest thing for a scammer to fake. A name can read "ATO Online" or "NAB Fraud Team" while the address behind the colon is noreply@ato-refund-claim.help or security@cba-verify.id.au. Hovering or long-pressing on mobile takes a second and usually exposes the impersonation.
Legitimate Australian senders almost always use their own corporate domain. Genuine ATO mail comes from @ato.gov.au, real Australia Post notifications from @auspost.com.au, and bank alerts from the institution's primary domain, not a lookalike with an extra hyphen. If the domain does not match, the message is not from whom it claims to be.
A subtler trick is spreading: legitimate first-party domains that have been compromised. An Adelaide florist or a Darwin tradesperson might have their real address used to send a perfectly worded invoice to contacts. When the sender is real but the request is unusual, confirm out-of-band through a channel you already trust.
Subject lines engineered to spike your heart rate
Urgency is the oldest lever in phishing, and AI has refined it. Subject lines now reference specifics: an outstanding toll from EastLink, a parcel redelivery fee after a missed delivery in Parramatta, or a tax refund flagged for review the week before EOFY. Specificity builds trust, even when the rest of the message is fabricated.
Watch for emotional triggers such as fear ("suspicious login detected"), greed ("$250 Coles gift card waiting"), curiosity ("see the photo of you from Friday night"), or authority ("HR directive: review by 5pm"). Attackers A/B test subject lines the same way marketing teams do, and winners get recycled across industries.
A practical rule from the Australian Cyber Security Centre: if a subject line makes you feel you must act in the next ten minutes, treat it as a signal to verify, not a signal to click. The urgency is the payload.
The body copy that AI has made almost convincing
Generative AI has crushed the tells we used to rely on: odd phrasing, broken English, weird formatting. A 2025 phishing email can mention a Bunnings sausage sizzle fundraiser, reference a Melbourne Cup sweep, or quote a recent ACCC ruling with convincing accuracy. Tone matches the brand being impersonated, and small details such as dates and ABN formatting are often correct.
That is why the analysis has shifted from style to substance. Ask whether the request makes operational sense. Would the ATO actually ask you to confirm a refund by clicking a link in an unsolicited email? Would your HR team email a policy update as a PDF attachment without prior notice? Most phishing collapses the moment you test it against real-world logic.
| Signal | Common in legitimate email | Common in phishing |
|---|---|---|
| Sender domain | Matches the brand's primary domain (@auspost.com.au) |
Lookalike, hyphenated, or unrelated domain |
| Urgency framing | Reasonable deadlines, business hours | "Act within 24 hours" or threats of account closure |
| Request type | Routine, predictable, matches prior behaviour | New payment details, gift cards, credential resets |
| Personalisation depth | Real account number or full name | Generic "Dear customer" or scraped partial data |
| Attachment or link target | Internal systems, expected workflows | External portals, QR codes to unknown URLs |
When every signal lines up with the phishing column, the message deserves a second look. Even a couple of mismatches should be treated as a stop sign.
Links, QR codes and the files they ask you to open
URLs were once easy to check by hovering, and that habit still pays off in desktop clients. On mobile, attackers increasingly rely on QR codes because they bypass link previews entirely. A "document from your accountant" might land as a PNG of a QR code, which scans straight to a credential-harvesting page. Treat any QR code in an unsolicited message like an unknown attachment.
Attachments have also evolved. Password-protected ZIPs slip past basic mail filters, with the password conveniently included in the body. Macro-enabled Office documents, HTML files that mimic login pages, and calendar invites linking to malicious URLs are all on the rise in Australia this year.
A solid personal rule: never log in from a link inside an email. Open the app or type the address yourself. For documents you were not expecting, reply through a separate channel to confirm before opening. Some defenders are rethinking the device lifecycle, and the rise of modular smartphones can they actually reduce e waste points to a future where hardware itself becomes part of the defence.
A quick triage you can run in thirty seconds
Whenever an email makes you hesitate, run a fast mental sequence: read the domain behind the display name, look for urgency or fear in the subject, test whether the request makes operational sense, inspect links and QR codes, and confirm out-of-band before acting on money or access.
If two or more checks feel off, forward the message to reportascam@scamwatch.gov.au, then delete it. Reporting costs nothing and protects the next person in the queue.
The trick is repetition. A thirty-second routine, run on every message that feels off, builds a reflex that becomes faster than the temptation to tap.
Even sharp eyes miss a lure now and then. The single most useful next step is to forward any suspicious message, with full headers, to reportascam@scamwatch.gov.au and wait for confirmation before clicking.