Latest security alerts

NAB is aware of current SMS phishing campaigns targeting customers. Please see two examples below.

The messages claim to be from NAB stating your debit card or Internet Banking services may be suspended, and to confirm recent activity or verify your device. These lead to fake NAB websites asking for personal information and banking credentials.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

When sending phishing text messages, criminals sometimes set the sender name as “NAB”, meaning that fraudulent text messages can appear in the same conversation as legitimate messages from NAB. This is not a sign that NAB systems have been breached in any way– it simply means a criminal is impersonating our brand.

If you have received this type of text message, please forward it to 0476 220 003 (047 NAB 0003) or take a screenshot, email it to phish@nab.com.au and then delete it.

If you have received this type of email or text message, and have clicked on the link or entered your details please contact your local branch or call 13 22 65 immediately.

Text version of example phishing messages

Image 1: NAB - Your Internet Banking services have been suspended pending device verification. Visit <phishing link> to perform verification.

Image 2: Your debit card may be suspended. To confirm recent activity, simply log into your account. No further action is needed: <phishing link>

NAB is aware that Australians are being targeted with investment scams promising lucrative returns. In 2019, Australians reported to the Australian Competition and Consumer Commission (ACCC) a loss of $61 million from investment scams.

The ACCC advises that these fake investment companies are proactively contacting Australians online or by phone, and claiming to be stock brokers offering investment advice, promotions, and hot tips or offering free investment seminars.

The ACCC advises the fraudster will claim what they are offering is low-risk, and will provide you with quick and high returns, or encourage you to invest in overseas companies. The offer may sound very legitimate, with resources to back up their claims. They may say you need to act quickly and invest, or you will miss out.

Before transferring any money to an investment company, check the Australian Securities and Investments Commission’s (ASIC) list of companies that you should not deal with. You can learn more about investment scams on the ACCC’s Scamwatch website, and by reading our investment scams article.

If you believe that you have paid money to an investment scam, please contact NAB immediately on 13 22 65.

NAB is aware of current scam phone calls targeting Australians.

You may receive a call where the caller pretends to be from organisations like your bank, Telstra, NBN, Microsoft, ATO or the police, or receive a text message asking you to call your bank due to security concerns. Once on the call, the caller may request remote access to your computer and bank accounts, or ask you to provide personal or banking information.

Below is an example of a text message stating there is a problem with a credit card, asking the recipient to call the number to protect their accounts. This leads to a scam call.

Never give an unsolicited caller remote access to your computer or online bank accounts, or provide personal or banking information.

Ensure you read any SMS codes sent to you in full. If it states “Your NAB secret code is xxxxx. Do not provide this to anyone, even NAB”, do not disclose this code to anyone.

If you ever have concerns as to the legitimacy of a call, hang up and call the company back on a publicly available number (e.g. NAB’s number is available on the back of your card).

If you have provided information on this type of call, please contact your local branch or 13 22 65 immediately.

For more information on scam calls, read our article 'How to spot scam phone calls'.

NAB is aware of current phishing email campaigns targeting customers.

The email claims to be a message from NAB stating your account has been suspended, and to click on a link to update your account information. This leads to a fake NAB website asking for personal information and banking credentials. Please see an example below.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

If you receive this type of email or text message, please forward it to phish@nab.com.au and then delete it.

If you have received this type of email or text message and have clicked on the link or entered your details, please contact your local branch or call 13 22 65 immediately.

Text version of example phishing message

From: support ssl_data8822066@police.sa.gov.au

Date: 4 November 2020 at 10:54:46 am AEDT

Subject: NABID Important Notification 11/3/2020 5:54:45pm

[NAB Logo]

Welcome to National Australia Online Banking.

This email contains important information for the security of your Online Banking.

Security Notice, Ensuring your safety while banking online is our priority.

Your account has been suspended due to incorrect validation of your account.

What you need to do :

• Log into your account by clicking the URL here.
• Enter your Bank Card and informations (that you selected during the online enrollement process).
• Enter the requested verification informations.
• Your Account will be active and validated within 24 hours, or visit any of our branch near your locality.

Thank you for Banking with us.

NAB is aware of current SMS phishing campaigns targeting customers. Please see two examples below.

The messages claim to be from NAB and ask you to verify your device. These lead to fake NAB websites asking for personal information and banking credentials.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

When sending phishing text messages, criminals sometimes set the sender name as “NAB”, meaning that fraudulent text messages can appear in the same conversation as legitimate messages from NAB. This is not a sign that NAB systems have been breached in any way– it simply means a criminal is impersonating our brand.

If you have received this type of text message, please forward it to 0476 220 003 (047 NAB 0003) or take a screenshot, email it to phish@nab.com.au and then delete it.

If you have received this type of email or text message, and have clicked on the link or entered your details please contact your local branch or call 13 22 65 immediately.

NAB is aware of purchasing scams targeting Australian consumers, with scammers active on both the buying and selling sides of transactions. These scams take place on the common platforms used by people to buy and sell goods and services, such as eBay, Gumtree, Facebook Marketplace and Carsales.

If you’re selling an item, a scammer may send you a fake or altered receipt claiming they have transferred funds into your account. After you send or hand over the item, they will cease communication without having paid you.

If you’re purchasing an item, a scammer posing as a legitimate seller may post an item for sale which appears to be a good deal. They may put up an advertisement that is fake, or sell items that aren’t rightfully theirs. When you start communicating with them, they may send you pictures of the item which appear to be legitimate. However, these images are often stolen from the Internet or from other legitimate advertisements. Once you pay them, the seller will stop communicating and you won’t receive the item.

Tips to avoid a purchasing scam

Be cautious of buyers and sellers asking for identification documents such as your driver’s license, passport and Medicare card number. Never provide these to someone you don’t know, as it may be used to commit identity fraud.

If you’re purchasing an item, try to meet the buyer in person where possible. If this is not possible, ask them to video call you so you can inspect the item more closely. Conduct a ‘reverse image search’ for the photos of the item you’re buying- you may find the picture of the item already exists on a legitimate ad, or other fake ones.

If you’re selling an item, wait for the funds to arrive in your bank account before you hand over the goods, or accept cash at handover. Don’t rely on receipts provided as they may have been altered.

Read our online shopping article for more information on staying safe while shopping online, or visit the Australian Competition and Consumer Commission’s Scamwatch website.

If you are a NAB customer and believe you may have fallen victim to a scam, please call 13 22 65 immediately and ask for the Digital Fraud and Scams Team.

NAB is aware of COVID-19 themed text messages circulating which contain malicious software or lead to phishing sites. Please see an example below.

The text messages may purport to be from legitimate organisations, including government agencies, and request you to click on links, or download files.

Do not click on the link.

If you receive a message of this kind and click on the link, the malicious software may infect your device and allow unauthorised access to your accounts.

If you have clicked on links or attachments in a suspicious email or SMS, or notice anything unusual on your Internet Banking, including the above:

Do not enter your NAB ID or password, or proceed with any transactions. Immediately close your web browser.

• Call NAB on 13 22 65 to advise your device is infected with malicious software
• NAB will assist you to remove the malicious software from your device, and confirm your recent payments to ensure they are valid.

If you receive a suspicious message, do not click on any links or attachments. If you have received this type of text message, please forward it to 0476 220 003 (047 NAB 0003) or take a screenshot, email it to phish@nab.com.au and then delete it.

NAB is aware of current phishing email campaigns targeting customers.

The email claims to be a message from NAB requesting you to update your account password, or verify a credit card transaction. This leads to a fake NAB website asking for personal information and banking credentials.

There is a range of sender email addresses and subjects being used for these phishing emails, please see an example below.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

If you receive this type of email or text message, please forward it to phish@nab.com.au and then delete it.

If you have received this type of email or text message and have clicked on the link or entered your details, please contact your local branch or call 13 22 65 immediately.

NAB is aware of current SMS phishing campaigns targeting customers. Please see an example below.

The message claims to be from NAB and asks you to verify your billing information. This leads to a fake NAB website asking for personal information and banking credentials.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

When sending phishing text messages, criminals sometimes set the sender name as “NAB”, meaning that fraudulent text messages can appear in the same conversation as legitimate messages from NAB. This is not a sign that NAB systems have been breached in any way– it simply means a criminal is impersonating our brand.

If you have received this type of text message, please forward it to 0476 220 003 (047 NAB 0003) or take a screenshot, email it to phish@nab.com.au and then delete it.

If you have received this type of email or text message, and have clicked on the link or entered your details please contact your local branch or call 13 22 65 immediately.

NAB is aware of current scam phone calls targeting Australians. The caller may claim to be from an organisation that can assist you to get early access to your superannuation. The caller may ask for your personal and superannuation details.

In another example, the caller may claim to be from the Department of Health and Human Services (DHHS). The caller may request credit card details for a testing kit. Please be aware that this is not a legitimate call from the DHHS, and contact tracers will not request payment.

If you ever have any concerns as to the legitimacy of a call, hang up and call the company back on a publicly listed number.

If you have received this type of call and have provided information about your superannuation, please contact your super fund immediately. If you have provided personal or banking details, please also contact NAB on 13 22 65.

If you receive a text message saying your superannuation fund is going to release your super, and you did not request this, contact your superannuation fund immediately.

You can also visit the Scamwatch website for more information about other COVID-19 related scams.

For more information on NAB’s response to Coronavirus, visit nab.com.au/coronavirus.

NAB is aware of current phishing email campaigns targeting customers. Please see examples below.

The emails claim to be a message from NAB requesting you to verify your account details. This leads to a fake NAB website asking for personal information and banking credentials.

Do not click on the link.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

If you receive this type of email or text message, please forward it to phish@nab.com.au and then delete it.

If you have received this type of email or text message and have clicked on the link or entered your details, please contact your local branch or call 13 22 65 immediately.

NAB is aware of text messages circulating which contain malicious software. The messages may appear to be a request to share photos or to download Adobe Flash Player. Please see two examples below.

If you receive a message of this kind and click on the link, the malicious software may infect your device and allow unauthorised access to your accounts.

If you have clicked on links or attachments in a suspicious email or SMS, or notice anything unusual on your Internet Banking, including the above:

• Do not enter your NAB ID or password, or proceed with any transactions. Immediately close your web browser.
• Call NAB on 13 22 65 to advise your computer is infected with malicious software
• NAB will assist you to remove the malicious software from your device, and confirm your recent payments to ensure they are valid.

If you receive a suspicious message, do not click on any links or attachments. Please forward it to phish@nab.com.au and then delete it.

NAB is aware of emails circulating which contain malicious software. The emails may purport to be from legitimate businesses, requesting you to open attachments such as Excel (.xls/.xlsx) files. Please see an example below.

If you receive an email of this kind and click on the links or attachments, the malicious software may infect your computer and allow unauthorised access to your accounts. When making a funds transfer, the malicious software may manipulate the recipient bank account details.

Before authorising any payments, carefully check the account details listed match the account you intended to pay. If the bank account details listed are different, do not proceed.

If you have clicked on links or attachments in a suspicious email or SMS, or notice anything unusual on your Internet Banking or NAB Connect account:

• Do not proceed with any transactions
• Call NAB on 13 22 65 (Internet Banking) or 1300 888 413 (NAB Connect) and advise your computer may be infected with malicious software.
• NAB will assist you to remove the malicious software from your computer, and confirm your recent payments to ensure they are valid.

To help protect your computer against malicious software, keep software on your computer up to date, including the latest anti-virus and security updates. Take advantage of NAB’s anti-virus offers for customers: ‘Anti-virus offer for customers’.

Learn more about adding extra security to your account by using a security token, dual authorisation and segregation of duties: ‘Security for NAB Connect Customers’.

Please report suspicious messages to phish@nab.com.au.

NAB is aware of COVID-19 themed emails and text messages circulating which contain malicious software, lead to phishing sites or asking you to donate money to a bank account.

The emails and text messages may purport to be from legitimate organisations, including government agencies, and request you to click on links, open attachments or donate money to a bank account. Please see three examples below.

If you receive an email or text message and click on the links or attachments, your computer may be infected with malicious software which may allow unauthorised access to your accounts. When making a funds transfer, the malicious software may manipulate the recipient bank account details. Before authorising any payment, carefully check the account details listed match the account you intended to pay. If the bank account details listed are different, do not proceed.

If you have clicked on links or attachments in a suspicious email or SMS, or notice anything unusual on your Internet Banking, including the above:

• Do not enter your NAB ID or password, or proceed with any transactions. Immediately close your web browser.
• Call NAB on 13 22 65 to advise your computer is infected with malicious software
• NAB will assist you to remove the malicious software from your device, and confirm your recent payments to ensure they are valid.

If you have sent funds based on a request received from a suspicious email:

• Call NAB on 13 22 65 to advise that you have transferred funds after receiving an email asking you to do so.

NAB will never ask you to confirm, update or disclose personal or banking information via a link in an email or text message.

If you receive a suspicious message, do not click on any links or attachments. Please forward it to phish@nab.com.au or 0476 220 003 (047 NAB 0003) and then delete it.

You can also visit the Federal Government's Australian Cyber Security Centre website for more information about COVID-19 related scams.

For more information on NAB’s response to Coronavirus, visit nab.com.au/coronavirus.

NAB is aware of invoice scam attempts targeting Australian businesses.

An invoice scam is when a business receives an emailed invoice from a supplier whose email account has been compromised by a criminal. The criminal will alter the payment details on the invoice to a fraudulent or mule account. As the invoice looks legitimate, the business doesn’t question the payment details, and sends the payment to the fraudulent account.

Another variation of an invoice scam is when a business receives a request advising a supplier’s or employee’s payment details have changed, and to make payments to a new account.

Before processing invoices, check the payment details against the last invoice. If they have changed, or you receive a request to update payment details:

• Do not proceed with the transaction(s), and
• Call the supplier/sender to confirm the legitimacy of the request, using a known contact or publicly listed number. Do not call the number on the new invoice/email.

If you have received an email of this type and actioned the request, please contact NAB on 13 22 65 and ask for the Anti-Scam Investigations Team.

Whilst the bank will make every effort to recall funds, recovery is not guaranteed.

Speak to your banker about adding extra security to your account by using a security token, dual authorisation and segregation of duties: ‘Security for NAB Connect Customers’.

To learn more about protecting your business from invoice scams, read this article and visit nab.com.au/security.

NAB is aware of phishing emails purporting to come from Australian Government agencies, including the Australian Tax Office and Medicare. Please see two examples below.

The emails may state that you have a tax refund available, or ask you to verify your details in order to receive Medicare rebates. The links in the emails lead to fake websites requesting personal and banking information.

Do not click on the links.

If you receive an email or text message of this type, please forward it to phish@nab.com.au and then delete it.

If you have received an email or text message of this type and have clicked on the links or entered your details, please contact NAB on 13 22 65 and the relevant authority immediately.

NAB is aware of mobile phone porting attempts targeting Australians.

What is mobile phone porting?
Mobile phone porting describes when your mobile phone number is ported (transferred) to a new telecommunications provider without your permission. This may enable criminals to receive SMS authentication codes sent by your bank, in order to authorise online banking transfers without your knowledge.

How does it occur?
In some cases, all that is required to port a phone number is an account or phone number, and date of birth.

What to look for
If your mobile phone service is suddenly disconnected, it may show ‘SOS only' where the carrier name usually appears on the screen. This could be a warning sign that your mobile phone has been transferred to another provider without your authorisation. If your service does not return in a short period, contact your mobile provider immediately to confirm why your mobile service is not working.

If your mobile has been transferred to another provider without your permission, please contact us on 1300 651 656.

You can learn more by reading our mobile phone porting article.

NAB is aware that scammers are attempting to trick individuals and business customers into accepting and on-forwarding fraudulent funds by criminals who are posing as genuine customers. For example, the scammer may send fraudulent funds to someone who is told it is a legitimate payment or received by mistake; the customer is asked by the scammer to on-send those funds to another account. Customers who accept and onforward these payments are acting as money mules and may be facilitating money laundering, which is a criminal offence.

Only accept payments for your products or services: NAB recommends to never accept payments that need to be forwarded to a third party. Businesses should only accept payments for services or products you supply, and are expecting to receive.

Know your customers: Have a process in place to be able to identify your customers and fully understand the nature of the transactions they are looking to participate in.

Only obtain finance from legitimate sources: It may be tempting to look for lenders with low rates or easy application processes, but make sure that any finance agreements are with accredited financial institutions.

Stop and Think: If something doesn’t seem right about a customer’s request, do some research and ask questions until you are satisfied that the transactions is genuine. You can reserve the right not to proceed with a customer’s request.

More information on business’ obligations can be found here: http://www.austrac.gov.au/businesses

The Australian Competition and Consumer Commission (ACCC) has issued a warning regarding scam phone calls targeting Australian mobile numbers.

They warn that overseas scammers are calling Australian mobile numbers at random, and immediately hanging up. The intent is for the recipient to call them back; this call back is charged at premium rates.

In another variation, recipients receive an email or text message which directs them to call a premium number (e.g. 1900 xxx xxx) to claim a gift voucher. Callers are purposely held on the line which increases charges to their phone account.

The ACCC advises not to respond to text messages or missed calls that come from numbers you don’t recognise, especially from overseas destinations. If you receive an unexpected missed call from an unknown overseas number, do not return the call.

If you have been impacted by either of these scams, contact your mobile phone service provider.

Fraudulent emails that appear to be from us or other legitimate businesses may attempt to trick you into providing personal information such as your mobile phone number, NAB ID, Internet or Telephone Banking password, credit card details, etc. NAB will never send you an email asking for your password or send you a link to login to Internet Banking.

Don't respond to any email requests for this information and don’t click on any links within these emails, even if they appear to have come from us. We'll never ask you to disclose your details in this way.

For more information on phishing messages, read 'Spam and Phishing messages'.

Fraudulent SMS messages that appear to be from us or other legitimate businesses may attempt to trick you into providing personal information such as your mobile phone number, NAB ID, Internet or Telephone Banking password, credit card details, etc. NAB will never send you an SMS asking for your password or send you a link to login to Internet Banking.

Don't respond to any SMS requests for this information and don’t click on any links within these emails, even if they appear to have come from us. We'll never ask you to disclose your details in this way.

For more information on SMS phishing, read 'Spam and Phishing messages'.

Online

• Use SMS security - Even if your ID and password fall into the wrong hands, funds can't be transferred without your approval. Register via NAB Internet Banking or contact us on 1300 651 656 for further information.
• When using SMS Security, always confirm the details within the SMS are correct before proceeding with the transaction. If anything looks suspicious or if you're concerned, don't proceed. Call 1300 651 656 for assistance.
• When transferring funds or paying a bill, always confirm the details you've entered are correct before completing the transaction.
• Keep your computer's operating system up to date by ensuring that automatic updates are switched on. Install any updates when they become available.
• We strongly recommend that all computers and devices have up-to-date anti-virus software. Visit nab.com.au/software to take advantage of NAB's anti-virus offers for customers.
• Always type www.nab.com.au into your browser's address bar when accessing the NAB website.
• Pause and think when receiving an message or viewing a website that looks suspicious. If you are concerned, don't provide any personal or banking information.

Over the phone

• If you're unsure whether a telephone call has come from us, ask the operator if you can call them back and request their name / team extension number. Then call back on 13 22 65 and ask to be put through to them.

For more security advice visit nab.com.au/security.