• Steal your login details for MyLearn, email or banking
• Trick you into sharing personal info like your student ID or date of birth
• Get you to open fake invoices or download malware
• Lure you into job or prize scams that ask for money or gift cards

• Weird sender address – looks almost right but not quite, like student-services@torrens-support.com instead of @torrens.edu.au.
• Generic greeting – “Dear Student” or “Dear User” instead of your name.
• Spelling mistakes or awkward language – legit uni or company emails are usually well-written.
• Too good to be true – “You’ve won an Apple Watch!” or “Easy job from home – $300 a day.”
• Urgent tone - “Your account will be locked in 24 hours!” or “Click now to keep your access.”
• Odd links or attachments - hover over a link before you click; if it doesn’t end in something you trust (like .edu.au), don’t open it.

A student received an email saying their university account would be disabled unless they confirmed their details. It looked official and used the uni logo. They clicked the link and entered their password and within minutes, their account was compromised and spam was sent to classmates.

Even if it looks familiar, stop and think before you click.

• ACSC: Update your devices
• Have I Been Pwned? Check if your email is in a breach

When you delay updates, you’re leaving the door open for cyber criminals. Regular software and app updates patch weaknesses before attackers can exploit them.

• Turn on automatic updates wherever possible.
• Restart your devices after updates so changes apply properly.
• Update your browser, antivirus software, and mobile apps regularly.

A data breach happens when personal information, like your email, password, or payment details, is accessed or stolen without permission. Breached data can end up for sale on the dark web and used for scams or identity theft.

• Visit Have I Been Pwned? to see if your email has appeared in a known breach. 
• If it has, change your password immediately and don’t reuse it anywhere else. 
• Turn on Multi-Factor Authentication (MFA) to add extra protection. 
• Run updates on all your devices and apps. 
• Keep an eye out for suspicious log-ins or password-reset notifications. 

• ACSC: Update your devices
• ACSC: Protect yourself from data breaches
• Stay Smart Online

Even if it looks familiar, stop and think before you click.

Cyber criminals use stolen password lists and software that can guess thousands of passwords per second. If you reuse or pick short, simple passwords, they can break into multiple accounts in minutes.  

Have you ever wondered how quickly your current password could be hacked? Use this free tool to find out. https://bitwarden.com/password-strength/  

Forget random characters, a passphrase is easier to remember and harder to crack. 
 Try using: 

• Four or more random words (e.g. koala-pizza-rocket-ocean) 
• A mix of upper and lowercase letters, symbols, and numbers 
• Unique phrases for every account. Never reuse the same one no matter how tempting 

With all those unique, long and complex passwords, how are you meant to remember them? Password managers store all your login details securely and help you create strong, unique passphrases for every site and take the brain work out of memorising them. 
Some popular options include: 

• Bitwarden 
• 1Password 
• LastPass 
• Dashlane

You only have to remember one strong master password to access them all. 

• Turn on Multi-Factor Authentication (MFA) wherever possible. 
• Never share passwords, even with friends. 
• Update old or reused passwords today.  

Learn more 

• ACSC: Create strong passwords and passphrases 
• Stay Smart Online: Password protection 

Most cyber attacks start with stolen or guessed passwords.

MFA blocks over 99% of these attacks.

It’s one of the easiest and most effective ways to protect your data.

There’s more than one way to verify your identity. Choose the method that works best for you: 

1. Text message (SMS)
   Receive a one-time code by text when you sign in. Simple and fast, but slightly less secure than other options.
2. Authenticator app
   Use an app such as Microsoft Authenticator, Google Authenticator, or Authy to generate a time-sensitive code or approve sign-ins. This is the most secure and recommended option.
3. Phone call verification
   Get an automated call asking you to confirm your login attempt.
4. Biometric verification
   Some devices and apps support fingerprint or facial recognition as an additional factor.

Once MFA is on, you’ll be prompted to verify your identity only when needed - for example, when logging in from a new device or location. 
It’s quick, easy, and one of the best defences against account compromise.