Online Safety In Government Services
When it comes to being safe in government digital services there is a straightforward rule: check the web address, use the official service and think twice before you put any personal information out there. The portals run by the Australian government are there for you to sort out your tax, Medicare, licences, payments and so on, yet scammers have an uncanny way of making their imitations look the part.
I am Adelaide Crowe. In my time assisting people with systems they do not know, I have come to see that pressure is what gets most online safety issues started. You get a message to the effect that your account is being closed, or a caller will insist on payment now, or a login page seems just right. Don’t be in a panic about it. The thing to do is halt and verify, then take the safer option.
The Official Service
There is no better way to sidestep a phony portal than to make sure you are on the right app or website. And when you need support, the official services have all the security requirements and contact methods laid out for you. See the Australia digital services inclusion policy for more context.
Do not expect to have to put a matter of some consequence to rights via a link in a text from who knows where. Should a message put you on the spot, consider it as you would a mozzie at your ear: it is persistent and annoying but you cannot trust it.
Digital Front Door
Make a habit of putting the service address in your browser or going to a bookmark you have set up after due diligence. A .gov.au domain is standard for the Australian government but a logo that looks familiar is no guarantee of authenticity.
Be on the lookout for odd punctuation, superfluous words and misspellings. Or a domain with “gov.au” in it that is not at the end; a devious address might have “mygov” or “government” in it and still be something else entirely. And while a padlock means the connection is encrypted, it says nothing of the organisation on the other side. For sound advice on cyber security, the Australian Cyber Security Centre has it on its site through its official online safety and cyber security advice. Put a bookmark on that instead of whatever you see forwarded on social media.
Trusted Apps
You can get your government apps from Google Play or the Apple App Store but have a good look at the developer name and the reviews. An advertisement or an app that is merely a lookalike may well be the first thing to come up in a search, so don’t be taken in.
And update your phone and its apps. It is a security weakness to put off the updates. If one does not care to pore over software menus on a Saturday, let them be automatic.
Login Details
Reusing a password for your bank, email and government accounts is unwise. A data breach at some unconnected site could hand a criminal the keys to more than one of your accounts. Multi-factor authentication is an extra hurdle; a stolen password will not necessarily be enough to gain entry.
Good Habits
For your more important accounts a unique, long passphrase is best. There is a certain logic in using a password manager to keep track of the different ones, unless you like having your head feel like a tumble dryer full of socks.
If someone you do not expect is in touch, a one-time code is not to be given out. A support worker of the genuine article will not want you to recite a verification code in order to “secure” or “cancel” something. The code is to confirm what you have done.
Your email should be secured too, particularly if it is tied to your government services. With control of the inbox a criminal can reset passwords. Put multi-factor authentication on your email and cull any old numbers or addresses from your recovery details.
Beware of Login Traps
It is the timing of it that will have you in: you have been doing some business with the government and then a scam message arrives and you think the follow-up must be in order. The fake pages will have the same colours and logos, even a help message or two. Do not click on a link in the message to see if it is for real. Go to the service in a new window on your own terms and you will see any alert once you are signed in properly.
Spot Scams Before They Spread
Scams of this ilk are usually about fines, refunds, visa issues, benefit reviews or an overdue payment. While the story put before you may be different, the pressure applied is of a piece.
Scammers are apt to have your name, where you live or some of your account information. They will have sourced it from social media, public records or a data breach. Such particulars give an air of authenticity to a message but are no proof as to who is behind it.
Warning Signs
- An insistence that you act at once or face the prospect of being arrested, losing money or having your account shut down.
- Any overtures for gift cards, cryptocurrency, bank transfers, one-time codes or passwords.
- Links to a login page that is not part of the government’s own domain.
- The introduction of screen sharing or remote-access software you did not expect, or an attempt to take the discussion to a private app.
- Language of a threatening or highly emotional nature designed to cloud your judgement.
It is true that a government agency can reach you by post, phone, email or text. Yet if a message is unanticipated, the prudent course is to put it aside and get in touch with the agency using details you have found for yourself. Wait to call the number provided until you have verified it via the official site or a statement on file.
A Pause Routine
If there is a sense of urgency to a message, adopt this brief routine: put the message down and close it, then open the service in question separately to check your account and ring the agency should anything be in doubt. A screenshot is in order if you think you will want to make a report, though do not pass the scam along to friends without putting them on notice.
Should you have clicked on a link, there is no need for embarrassment; prompt action will contain the damage. Put in a new password for the affected account, get in touch with your bank if you have put in payment details and turn to the appropriate cyber safety channels for counsel.
Share Only What Is Necessary
In the course of providing a service a government body will require sensitive information and the request should be in keeping with the circumstances. Before you upload a document, find out why it is needed, if the entirety of it is and if there is a more secure way to do so through the official channels. An identity document has more to it than the service wants to see; a licence will have your photograph, date of birth, address and number. To put that on an unverified site is to invite risk.
Limit your uploads
Ordinary email is not the way to send identity documents unless the agency has told you to. Go to the portal. And scrutinise the recipient address character for character. Make note of the reference number, date and purpose of what you submit and keep a copy. On a shared computer, be sure to delete superfluous downloads and store the rest properly. With a public machine, remove files from the desktop and downloads folder, close the browser and sign out completely.
Refrain from putting screenshots of government correspondence online where your customer or reference number, barcode or name can be seen. It is not enough to crop out an obvious detail; a scammer can put the pieces together.
Digital Inclusion
Part of being safe online is to ensure people are not forced into workarounds that are not. For those in rural areas, older Australians, anyone with a disability or limited English or who cannot count on an internet connection, there must be an alternative. The Australia digital services inclusion policy is founded on the idea that access has to be practical to be safe. If one cannot use assistive technology or afford the data or make head or tail of the instructions, the service is not inclusive.
Access Points That Are Safer
One does not require a home office or a laptop of distinction to deal with the government in safety, but a degree of privacy and a means of verification are called for. There is assistance to be had at community organisations, public libraries and government service centres. Enquire as to whether staff will put you through the motions without handling your security codes.
Plan Your Digital Route
| Situation | Safer option | What to check | Fallback |
|---|---|---|---|
| At home on a private device | Secure home network and a bookmarked site | Multi-factor authentication, screen lock and updates | Official contact details for the agency |
| Library computer | Private session, no saved passwords | Delete any documents and sign out | Privacy support from the library |
| Public Wi-Fi | Stick to general information | No account changes or sensitive uploads | Mobile data or a trusted network |
| When you are of assistance to another | Have them put in their own code and password | Get consent to look at documents | Nominee or authorised process |
An online service will not put a charge on you for fuel or parking, yet you may be out of pocket for data, transport, the odd print or scan or simply time lost from work. Before you put money down with a private concern to have a government form filled in, find out if the service has a paper, phone or in person alternative.
Supporting Someone Safely
You do not have to make yourself the account owner to be of assistance to a friend, parent or neighbour. The individual should keep hold of the passwords and authentication codes and be the one to make final submissions. You can put the screen in front of them, read over the instructions or go through contact details with them but leave the account alone.
For more protracted help, look into what the agency has in the way of formal accessibility or representative arrangements. While it is tempting to share passwords informally for the sake of efficiency, it leaves room for confusion as to who is responsible for a change and whether there was consent.
When A Mistake Is Made
A dubious call or an errant upload or link is not tantamount to having your identity stolen. Most would be better served by putting self-recrimination aside and acting on it than to let the matter go and hope for the best.
Make a note of it while you can still recall the particulars: the date and time, website, number, any information or payment given. Your bank and the agency in question will want that record to make sense of the incident.
Steps To Recover
- Put an end to any communication with the suspicious party and shut the page.
- From the official site, put in a new password for the affected account; employ another device you trust to do so.
- If card or other payment details have been put forward, the bank should be called without delay.
- Go to the government agency concerned via details you have verified for yourself.
- Have a look at your banking, email and government accounts for anything out of the ordinary.
- Use the proper Australian channel to report any scam or cybercrime.
Should your mobile service come to a halt or someone has taken your number, get in touch with your telco at once; a criminal could be after your security messages. If any identity documents have been seen, enquire with the issuing authority as to what protection they can offer.
Safety As A Habit
It is no good making a drama of online safety; a routine is preferable. Once a month is enough to go over your devices, passwords and account activity and spot trouble before it gets costly. I have a simple rule: take the official route, keep logins private, give the least amount of information and do not be hasty. Not as much fun as going after a refund message you are not sure of, but then neither is the paperwork that follows.
Some Questions Put To Rest
Is every message from a government agency a scam?
Not at all. They will send one to put you in mind of something or point you to a service, but you should verify an unexpected message. Do not just follow the link or number provided. Get to the agency on your own and see what your account says.
Does a padlock make a website safe?
It does not. All that means is the browser and site are talking in encrypted terms. It is no guarantee the site is a government one. See to it you are using an independently verified address and check the domain in full.
What about public Wi‑Fi for government business?
Fine for some general info but you would be wiser to use a home or private mobile connection for sensitive matters such as changing account details or uploading an ID.
Give a family member my password to help out?
No. Have them guide you as you put in the password and code. Better to make use of the service’s nominee arrangements for any long term help.
I have already put some information out there, now what?
Do something about it. Alter the passwords, tell the bank if it was financial in nature, put the government agency in the picture and file a report. And make a record of when and how it happened.
The Onus Is On You
There is no need to be a cybersecurity whiz to be safe with a government digital service. One must know where to turn for help, limit the personal information on show and be wary of pressure. Verify before sharing and have a second option at hand if the technology is uncooperative. A moment’s pause before clicking will safeguard your identity and finances and save you the bother of having to get them back later.
