Telstra scam emails: how to spot, check and report them

Is there a Telstra scam going around?

Almost always, yes. Telstra is one of the most impersonated brands in Australia because nearly every household has an account with them, so a fake Telstra email has a good chance of landing with a real customer. The scammers rotate the story every few weeks but the goal is the same: get you to click a link and type something valuable into a page they control.

The lures we see most, in rough order of how often they turn up:

• The fake bill. A copy of a real Telstra bill email with a "View bill" button. The amount is often slightly wrong or suspiciously large so you click in a hurry.
• The failed payment. "Your AutoPay payment was unsuccessful" or "Your service will be suspended". Urgency is the hook.
• The refund. "You have been overcharged, claim your refund". Nobody gets refunds by surprise.
• The full mailbox. For Bigpond and Telstra Mail users: "Your mailbox is almost full, messages will be deleted today unless you verify". The link goes to a fake webmail sign-in page.
• The sign-in alert. "Your Telstra ID was used to sign in from an unfamiliar location. Keep the same password?" Both buttons go to the same credential-harvesting page.
• The terms-of-service update. "Our terms have changed, review and accept to keep your service." The accept button is the trap.
• The text message. Same stories, shorter, with a shortened link. Also fake missed-delivery and "points expiring" texts that borrow the Telstra name.

Many of these are sent to people who are not even Telstra customers. If you have never had a Telstra service and get a Telstra bill, that alone answers the question.

Five checks that catch nearly every fake

1. Look at the actual sender address, not the display name. The name might say "Telstra", "Telstra Communications", "Telstra Media" or "Telstra Billing". Tap or hover on it. Real Telstra mail comes from an address ending in @telstra.com or @online.telstra.com.au. Scam senders look like telstra.com.au@ovh.us, billing-telstra@gmail.com or a random business whose mailbox was hijacked. On a phone you may need to tap the name to see the address.
2. Hover over the link before you click. On a computer, rest the mouse on the button and read the address in the bottom corner of the window. On a phone, press and hold the link to preview it. A real Telstra link goes to telstra.com.au. The fakes go to free website builders and link shorteners: addresses ending in weebly.com, typedream.app, loopple.com, campaign-archive.com, bit.ly, or a domain you have never heard of with "telstra" somewhere in the middle.
3. Check how it addresses you. Telstra knows your name and your account number. "Dear Customer", "Dear User" or nothing at all is a strong sign the sender is working from a list of addresses.
4. Notice the deadline. "Today", "within 24 hours", "immediately". Real companies give you weeks. Pressure is the scammer's main tool because it stops you doing checks one and two.
5. Ask whether you were expecting it. Bill not due? No Telstra service at this address? Never had Bigpond mail? Then it is not for you, no matter how good it looks.

None of these checks need any technical knowledge. If an email fails even one of them, do not click. Delete it, or report it first (see below) and then delete it.

What a real Telstra bill email looks like

If you chose email billing, Telstra does send bills by email, which is exactly why the fake ones work. The safe habit is simple and costs you ten seconds: never open a bill from the email link. Open the My Telstra app, or type telstra.com.au into your browser yourself, sign in, and look at the bill there. If the email was real, the bill is waiting for you in the app with the same amount. If it is not there, the email was fake.

The same rule covers every other story in the list above. Payment failed? Check in the app. Mailbox full? Sign in to webmail by typing the address. Sign-in alert? Change the password from inside the app, not from the email. Going in the front door instead of through the link makes the scam harmless.

What happens if you do click

Clicking the link on its own rarely does damage on a modern phone or computer. The harm comes on the next page, which is built to look like a Telstra or Bigpond sign-in screen. Whatever you type into it goes straight to the scammer. From there, two things usually follow:

• Mailbox takeover. With your email password, they sign in to your real mailbox and quietly add a forwarding rule so they get a copy of everything. They then watch for invoices, quotes and payment requests, and send altered versions with their bank details. This is how businesses lose five-figure sums, and it often goes on for weeks before anyone notices.
• Password reuse. If the password you typed is the same one you use for your bank, myGov, Facebook or anything else, they will try it there within minutes.

If you typed a password

1. From a different device if you can, sign in to the real service and change the password. Make it one you have not used anywhere else.
2. Turn on multi-factor authentication (MFA, sometimes called two-step verification). With MFA on, a stolen password alone will not get them in, and most scammers move on to the next victim rather than fight it.
3. In your mailbox settings, look for forwarding rules or "filters" you did not create and delete them. Check "recent sign-ins" or "devices" and sign out everything you do not recognise.
4. Change the same password anywhere else you used it.
5. Warn anyone who might get a fake invoice "from you": customers, suppliers, your accountant.

If you typed card or bank details

Call your bank first, before anything else. Use the number on the back of your card, not one from the email. They can block the card and watch the account. Then do the password steps above if you entered any.

If you only clicked and closed the page

You are almost certainly fine. Run a scan with the security software already on your computer, keep an eye on your inbox for unexpected sign-in or code messages over the next few days, and report the email.

Where to report a Telstra scam

Reporting takes a minute and it works. Telstra and the mail providers use the reports to block the sending addresses and take down the fake pages, which protects the next person on the list. Report to all that apply:

Telstra's own fraud team cannot be reached by a public phone number, and any email or text giving you a "Telstra fraud department" number to call is itself part of the scam. If you want to talk to Telstra, call the number printed on a real bill or use the My Telstra app.

Not a scam: looking for your Telstra email?

A lot of people searching "Telstra email" just want to sign in to their Telstra Mail or Bigpond mailbox. Type telstra.com.au into your browser and use the Telstra Mail link, or go through the My Telstra app. Bookmark it once you are there and use the bookmark from then on. That habit alone defeats every "verify your mailbox" scam, because you never arrive through a link in an email.

The same tricks with other names on them

Everything above applies when the name on the email is myGov, the ATO, Australia Post, Linkt, Netflix, your bank, or Microsoft. The myGov version is particularly common on the Eyre Peninsula around tax time: "You have a refund waiting, sign in to claim it." myGov never emails links to sign in, and never emails refunds. Open the app or type my.gov.au yourself.

Protect the whole household or business in an afternoon

• Multi-factor authentication on email first, then banking, then myGov. Email is the master key to everything else because password resets go there.
• Unique passwords, kept in a password manager so you do not have to remember them. The manager will also refuse to fill your password into a fake site, which is a quiet extra check.
• Keep devices updated. Phone, computer and browser updates close the holes a bad link could use.
• Talk about it. The scam only needs one person in the house or office to click. Show the five checks to the people who handle the bills.
• For businesses: have your mail provider turn on spam filtering with link checking, and agree a rule that any change to a supplier's bank details is confirmed by phone on a known number before you pay.

Sources: Telstra Exchange, Reporting SMS and MMS scams to Telstra (June 2023) for the 7226, scams@telstra.com and phishing@telstra.com channels; ACCC Scamwatch; Australian Cyber Security Centre ReportCyber; IDCARE. Examples of sender addresses and hosting domains are drawn from scam samples circulating in 2025 and 2026. Last reviewed 24 October 2026.