Centrelink warning as 270,000 emails sent out in attack related to Medicare, superannuation and tax benefits

2025-11-18 · Source: Welcome to the Artificial Intelligence Incident Database · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning · Depth: Fundamental Awareness, quick

Summary

A large-scale phishing campaign is targeting Australians with over 270,000 malicious emails detected in the past four months by human risk management platform Mimecast. These emails impersonate Centrelink and Services Australia, leveraging artificial intelligence to create "super clones" with perfect grammar, syntax, and layout, making them extremely difficult to distinguish from legitimate communications. The scam emails mimic information about benefits such as superannuation, JobSeeker payments, Medicare, and Family Tax Benefits. Cybercriminals aim to trick recipients into clicking links and entering personal details, which can lead to data theft, malware installation, ransomware infections, and identity theft through credential stuffing. Services Australia confirms it will never send links, attachments, or QR codes in emails or text messages, and official government websites always end in ".gov.au".

Key takeaway

For Australians managing personal data or government benefits, the rise of AI-powered phishing means you must abandon traditional scam detection methods. Do not click any links in emails claiming to be from Services Australia or Centrelink. Instead, manually type official URLs like my.gov.au into your browser or use the official app. Verify all urgent messages directly within your official account or by calling the agency. Implementing passkeys and two-factor authentication significantly enhances your account security against credential theft.

Key insights

AI-powered phishing campaigns now produce "super clone" emails, rendering traditional grammar-based scam detection ineffective.

Principles

• AI significantly elevates phishing realism.
• Official government communications avoid embedded links.
• Scammers exploit urgency and emotional triggers.

In practice

• Manually type official website URLs.
• Verify all notifications within official apps.
• Implement two-factor authentication and passkeys.

Topics

• Phishing Campaigns
• AI-powered Scams
• Identity Theft
• Services Australia
• MyGov Security
• Credential Stuffing

Best for: CTO, VP of Engineering/Data, Executive, General Interest, IT Professional

Related on AIssential

• Inland Revenue’s top boss used in AI-generated scam, prompts warning — Scammers exploit AI-generated content and social media algorithms to impersonate authorities for identity theft.
• Forg365 industrializes Microsoft 365 phishing with AI-generated lures — Forg365 industrializes Microsoft 365 phishing through AI-assisted lures and advanced evasion techniques, complicating traditional incident response.
• Your fridge could be a threat to national security — AI enhances both cyberattack sophistication and defensive capabilities in the evolving threat landscape.
• How Amazon Bedrock catches AI-generated phishing — AI-generated phishing requires behavioral analysis and contextual understanding beyond traditional surface-level email filters.
• The average tax scam victim loses $1,020 - and they're younger than you'd think — AI-enhanced tax scams are increasingly sophisticated, leading to significant financial losses and identity theft for taxpayers.
• “Vercel Hack Exposed: How a Simple AI Tool Led to a $2M Data Breach” — The Vercel breach demonstrates how compromised third-party OAuth tokens can enable long-term, deep supply chain attacks.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Welcome to the Artificial Intelligence Incident Database.