Staying safe online

Online banking, protecting your security

Stay alert to scams and fraud

Australians have seen an increase in fraud and scams recently, we encourage everyone to remain alert. If you receive a message or call that seems strange, then you’re probably right! Reminder, if you receive a weird call, hang up and call us on our official phone number. Don’t click on any strange links, forward any weird SMSes to +61 476 220 003 or emails to phish@NAB.com.au, then delete.

The ubank defence

We’re here to help and should the worst occur, you’re still protected

The ubank defence is our promise to you that we’ll reimburse 100% of your money should it be fraudulently taken from your account, provided:

It’s clear you didn’t contribute to the loss
You promptly let us know when you become aware of any unauthorised transactions

Contacting you about fraud

Our fraud team may send you an SMS from time to time to confirm any high-risk card transactions. This is to protect you and make sure the card transactions aren’t fraudulent.

For anything deemed high risk you’ll receive an SMS from the following numbers (this is our fraud team contacting you).

+61 489 988 024
+61 437 126 492
+61 489 954 380
+61 489 988 025

These SMSes will only ask for a Yes, No or Cancel response or instruct you to call our fraud team directly on 1300 705 750.

Contact us

You should contact us immediately on 13 30 80 when:

Your password/PIN has been shared or compromised.
Your card or mobile phone has been misused, lost or stolen.
The device you use for online banking has been lost, stolen or infected with malicious software.
There are unauthorised transactions on your account/s or you believe your ubank account has been accessed by an unauthorised person.

Fraud, phishing and scams

Types of fraud, phishing and scams to look out for

What is identity theft or takeover?

This is when a criminal has enough information about an individual to impersonate them for financial gain or other benefits. Criminals can gather your details by stealing from your letterbox or through phishing scams, data breaches, social engineering, malware or hacking systems.

How does it occur?

When these criminals have enough information, they can attempt to apply for finance, open bank accounts, phone accounts or set up other services in your name.

What to look for

Always look out for changes to your account that you didn’t request .

This might include:

Receiving an email or alert from a change you didn’t make

The inability to log in to your account

Getting an alert that your profile has been logged in to from an unusual location

Receiving bills, letters, invoices or receipts addressed to you that you do not recognise
What are scams and phishing?

Spam refers to unsolicited junk emails that are sent to large numbers of people at once. Spam emails are typically advertising fake products or get-rich-quick schemes.

Phishing emails are more sinister than spam. They’re designed to trick you into providing personal information like a mobile phone number, usernames and passwords, or credit card details or bank details.

How does it occur?

These fraudulent emails or text messages usually appear to be from ubank, NAB or other legitimate businesses. Ubank and NAB will never contact you asking for personal information such as account details and/or passwords; and we will never send you a link to online banking asking you to log in.

What to look for

There are a few signs the email you received may not be legitimate, including:

Sender address – This might be unusual, misspelled or slightly different from the correct address, for example uBank.com instead of ubank.com.au

Generic greetings and sign offs – Phishing emails are sent out to hundreds of people at once so use generic greetings and signoffs.

Poor grammar and spelling – This can be a tell-tale sign, but it isn’t always the case. Remember, criminals can use spell check too.

Creating a sense of urgency – Phishing emails will often encourage you to click a link or download an attachment to avoid a problem to create a sense of urgency. Always read an email carefully before taking any action.

Suspicious links and fake websites – If you receive an email with a suspicious link, hover over the link with your mouse to see the actual web address the link leads to – it could lead to a fake website.

Malicious attachment – Often an attachment will appear to be a PDF, image or Office file, but when you try to open the document, it tries to run a program or script intended to infect your computer with malicious software.

Urgency – Requests that are positioned as extremely urgent and need your immediate action outside what is expected.

Report suspicious messages to phish@ubank.com.au and then delete them, without clicking on the links or attachments.
What are scams?

There are many types of scams

1. Investment scams

Australians lose millions to investment scams every year.

How does it occur?

Individuals or businesses receive a cold call and are offered attractive investment returns or professional-sounding business opportunities. Once the investment is made, the victim usually receives no returns.

What to look for

These scammers are mainly based overseas and often tell victims they only need to invest $1,000 – $2,000 to start seeing returns. Often this escalates into requests for more money.

2. Romance and friendship scams

Today, it’s easier than ever to make friends and build relationships online. The downside is criminals have become clever at taking advantage of people looking for love. Scammers may be looking for financial gain, to gather information or to use their new ‘friends’ to help them launder money.

What to look for

A combination of these red flags could indicate a friend or relative is involved in a scam:

they have never met the person face to face

they have not seen the person via webcam, video chat or Skype

if they have spoken on the phone, it’s rare and the calls are brief

they fall in love within weeks, if not days, of talking

your friend is secretive of the relationship and doesn’t want to discuss it (they may have been groomed not to share too many details)

there has been a request for money

3. Remote access scams

Some phone scammers impersonate a bank, telco or computer company and tell you there’s an issue with your computer, banking or phone.

What to look for

They’ll ask you to download a program that gives them remote access to your computer, so they can ‘fix’ the issue. If you do this, they can access all the information on your computer. You should never give an unsolicited caller access to your computer.

4. Phishing scams

Impersonating ubank, NAB or another company to gain access to your accounts.

What to look for

Usually, in a phishing phone call:

The caller says they are from a bank, a large service provider like the NBN, ATO or a phone company

They may know some of your personal details like your employee number or work address and use it to gain your confidence or offer to let you speak with their ‘manager’

They may ask for SMS codes, or get you to process a transaction or download software so that they can remotely access your computer

Security alerts

Be on the look-out for suspicious messages

Ransomware is a type of malicious software (malware) that encrypts (or locks) the files on a computer, making them inaccessible. Once the malware has been downloaded onto the victim’s computer, the victim receives a message on their computer screen from the criminal (the ransom note), advising them that their files have been locked, and demanding money in return for unlocking the files.

Cybercriminals usually demand victims pay the ransom in virtual currencies, such as Bitcoin, which is difficult for law enforcement to trace. Ransomware attacks are just like any other extortion attempt and police advise that businesses should not comply with the criminals’ request for money.

Businesses are advised to ensure they have active and effective cyber security controls in place. Our recommended steps are:

Be wary of unexpected, threatening or poorly written emails

Make sure your operating system and anti-virus software are always up to date

Incident management plan

Back-up your data

The ACSC strongly recommends implementing the ‘Essential Eight’ strategies to mitigate cyber security incidents, which can help protect systems from compromise.

If you believe you may have fallen victim to ransomware, please call ubank on 13 30 80 immediately.
Ubank and NAB are aware of purchasing scams targeting Australian consumers, with scammers active on both the buying and selling sides of transactions. These scams take place on the common platforms used by people to buy and sell goods and services, such as eBay, Gumtree, Facebook Marketplace and Carsales.

If you’re selling an item, a scammer may send you a fake or altered receipt claiming they have transferred funds into your account. After you send or hand over the item, they will cease communication without having paid you.

If you’re purchasing an item, a scammer posing as a legitimate seller may post an item for sale which appears to be a good deal. They may put up an advertisement that is fake, or sell items that aren’t rightfully theirs. When you start communicating with them, they may send you pictures of the item which appear to be legitimate. However, these images are often stolen from the Internet or from other legitimate advertisements. Once you pay them, the seller will stop communicating and you won’t receive the item.

Tips to avoid a purchasing scam:

Be cautious of buyers and sellers asking for identification documents such as your driver’s license, passport and Medicare card number. Never provide these to someone you don’t know, as it may be used to commit identity fraud.

If you’re purchasing an item, try to meet the buyer in person where possible. If this is not possible, ask them to video call you so you can inspect the item more closely. Conduct a ‘reverse image search’ for the photos of the item you’re buying- you may find the picture of the item already exists on a legitimate ad, or other fake ones.

If you’re selling an item, wait for the funds to arrive in your bank account before you hand over the goods, or accept cash at handover. Don’t rely on receipts provided as they may have been altered.

If you believe you may have fallen victim to a scam, please contact ubank on 13 30 80 immediately. You can learn more about purchasing scams here.
Ubank and NAB are aware of invoice scam attempts targeting Australian businesses. An invoice scam is when a business receives an emailed invoice from a supplier whose email account has been compromised by a criminal. The criminal will alter the payment details on the invoice to a fraudulent or mule account. As the invoice looks legitimate, the business doesn’t question the payment details, and sends the payment to the fraudulent account.

Another variation of an invoice scam is when a business receives a request advising a supplier’s or employee’s payment details have changed, and to make payments to a new account.

Before processing invoices, check the payment details against the last invoice. If they have changed, or you receive a request to update payment details:

Do not proceed with the transaction(s), and

Call the supplier/sender to confirm the legitimacy of the request, using a known contact or publicly listed number. Do not call the number on the new invoice/email.

If you have received an email of this type and actioned the request, please contact ubank on 13 30 80. Watch this video to learn more about invoice scams.

Tips to stay protected online

Be on the lookout

Be on the lookout for suspicious emails, text messages and calls requesting personal and banking information.
Set up passkeys on your personal devices to log in to your ubank app.
Only enable passkeys from your personal device and only use your own biometric info (e.g., facial recognition or fingerprint).
Never share your passwords, PIN’s, passcodes or Pattern Lock codes with anyone including ubank staff, and don’t write them down.
We’ll SMS you one-time passcodes for online banking transactions and password resets, so it’s important to keep your phone secure.
If you call ubank, we may send you an identification verification SMS; the message will state that this is the only code we will ask you to provide to us.
Ensure to read the whole message to ensure the action being requested matches what you were trying to do.

Passkeys

Passkeys are a simple and secure way to log into the ubank app that provides an additional layer of protection against phishing and scams. With a passkey, you can log into the ubank app by the same way you log into your personal device.

To be able to set up a passkey you must:

Have a device that supports and is upgraded to iOS 16 or later / Android 9 or later
Update to the latest version of the ubank app
Make sure your device has a screen lock, either pin or FaceID
for iOS, turn on ‘AutoFill Passwords and Passkey’ in your device settings and make sure to have one AutoFill method turned on
for Android, have autofill service enabled in the passwords & accounts settings

How to set up passkeys FAQs

Passwords for Online Banking

Use a unique password for each of your online accounts and make your passwords hard to guess. Your password should:

be at least 8 characters long
Include at least 1 lower case letter
Include at least 1 upper case letter
Include at least 1 number
Include at least 1 special character
Not include your first name, last name, birth date or email address

Online browsing behaviour

Turn on automatic software updates to ensure your devices always have the latest operating system installed.
Switch on app auto updates on your device, so you’re always on the latest version of the ubank app.
Remember to log off when you’ve finished using Online banking.
Avoid using computers in public places such as internet cafes, hotels and airport lounges to conduct online banking.
Always access ubank’s website by typing ubank.com.au into your Internet Browser. Make sure the website address starts with “https” and a padlock is displayed.
When downloading Apps, ensure they are from official App stores (Apple App store or Google Play store).
Only perform banking on trusted devices and on trusted Wi-Fi/networks. Never accept a request to download a program or certificate to your device in order to use a public Wi-Fi network.
If you discover a transaction you don’t recognise, please contact us immediately on 13 30 80.

If you have a ubank debit card

Sign the back of a new card when you receive it.
Don’t let anyone else use your card – including family members or friends.
Regularly check that the card is still in your possession.
Destroy your card when it expires by cutting it diagonally in half (including any embedded microchip on the card; magnetic strip and security code).
Protect your PIN when entering it on ATMs and EFTPOS terminals.
Try to memorise your PIN so you don’t have to write it down.
Don’t choose a PIN that is easily identified with you for example your birth date, car registration, telephone number or your name in part or full. (If the guidelines for choosing a PIN are not followed, you may be liable for any unauthorised transactions.)
Ensure you have a locked padlock on your letterbox and shred any documents such as bank statements before disposing of them.

How we protect you

Security measures to keep your money safe

Security measures to keep your money secure
Security measure	What it means
SMS security	We’ll send you one-time passwords via SMS when you add a new payee via the app or Online banking, as an extra security measure
Transaction monitoring	Our team continuously monitor transactions for anything suspicious or unusual, 24/7
Transport Layer Security Encryption	Ubank’s website uses TLS (Transport Layer Security) encryption technology to protect your information. To ensure compatibility with our site, please keep your browser up to date
Banking sessions timeout	We’ll automatically log you out if you’ve been inactive for a while
Maximum transfer limits	We limit the maximum you can transfer via Online banking each business day. If you need to transfer more, call us on 13 30 80 for assistance
Lockout	After a number of failed logins, access to online banking is automatically blocked
Notifications	We'll send you a notification whenever a new device is added to your account
Crypto payments restrictions	Transactions to some crypto exchanges have been restricted to help protect you from fraud
Passkeys	A passkey lets you use the security features on your device to sign in to the ubank app. They provide an additional layer of protection against phishing and scams.

Useful links

Australian Securities and Investments Commission (ASIC) website where they publish companies identified as operating cold calling scams https://www.moneysmart.gov.au/scams/companies-you-should-not-deal-with
Australian Competition and Consumer Commission’s (ACCC) Scamwatch website to learn more about current types of scams
The Australian Cyber Security Centre (ACSC) is a federal government led initiative to securely report instances of cybercrime. You can submit a Report at www.cyber.gov.au
IDCare is a not-for-profit Australian and New Zealand national identity and cyber safety support service. They have a team of trained counsellors that can assist individuals facing identity and cyber security concerns. Visit: http://www.idcare.org/
NAB’s Responsible Disclosure Program – the responsible disclosure of vulnerabilities helps ensure the security and privacy of Ubank and our customers. If you believe you have found a security vulnerability, let us know via NAB’s Responsible Disclosure Program, managed by Bugcrowd.