Why unknown links are riskier than they first appear

Every day, Australians tap on links without thinking twice. A text about a missed parcel from Australia Post, an email claiming your myGov account needs attention, a sponsored post promising cheap flights from Sydney to Perth — the moments feel routine. Behind many of those moments, though, sits a quiet industry built around getting you to click first and think later.

This article looks at what actually happens when you follow a link you cannot verify, why placeholder sites with nothing but a generic "Click here to proceed" prompt are part of that pattern, and how small shifts in habit can cut your exposure sharply. None of it requires special software or technical knowledge. It mostly requires a second of pause.

Where suspicious links actually show up

Suspicious links rarely arrive through dramatic channels. They tend to blend into the everyday noise of an inbox, a chat window, or a social feed. A Brisbane small business owner might get an email that looks like a routine ATO notice, while a Melbourne university student could receive an SMS about a courier that never had a parcel in the first place. The message is designed to feel familiar enough that you keep reading, and short enough that you tap before the doubt kicks in.

Email remains the most common delivery method, but SMS-based scams have surged across Australia over the past few years. Messages pretending to come from toll-road providers, telcos like Optus or Telstra, or even local councils asking you to confirm a detail have all become routine. Social media ads and comment sections on platforms like Facebook, Instagram, and TikTok are also fertile ground. So are search engine results, where paid ads can sit above organic listings and mimic legitimate brands almost perfectly.

The unifying trick is timing. The message lands when you are busiest — commuting, picking up the kids, dealing with a flat tyre in Adelaide traffic — and asks for a single tap. The simpler the request, the harder it is to spot the problem underneath.

How generic redirect pages move you around

Some links do not take you where they say they will. They land on a thin page with no logo, no contact details, and nothing more than a generic "Click here to proceed" line. The lack of information is the giveaway. A site belonging to a real Australian business, council, or government service will almost always show its name, an ABN or copyright line, and a privacy or terms link in some form.

These placeholder pages exist for a reason. They buy the link's operator time, let them filter out bots and security scanners, and route genuine visitors toward wherever the real payload is — a phishing kit, a malware dropper, or a fake login form. A page such as this placeholder page illustrates how minimal the surface looks, and that minimalism is deliberate.

The broader trend is documented in pieces like this redirect overview, which explains how disposable intermediaries have become a standard layer in modern scam operations. If the page you land on tells you nothing about who runs it, treat that silence as a warning, not a missing detail.

Scams built around Australian brands and habits

Local scammers know what Australians trust, and they use it. Fake Australia Post tracking notices are so common that the organisation has published dedicated warnings. Imitations of ATO messages spike around tax time, and fake myGov alerts often arrive just as HECS balances are being processed. Even community groups — surf clubs, school P&Cs, footy clubs running the canteen — can find their logos lifted for a quick phishing run.

Several habits make these scams more effective here. Plenty of Australians still tap links straight from SMS out of muscle memory, especially older users who grew up treating text messages as inherently trustworthy. Sausage sizzle flyers shared in group chats, community Facebook pages, and school WhatsApp groups often contain shortened URLs that nobody bothers to expand. The magpie swooping season posts that go viral each spring sometimes carry links that look harmless because the post itself is light-hearted.

What ties these together is the way local familiarity is borrowed. The brand is real, the tone is local, the language matches what you would expect from a Perth-based tradie or a Hobart deli. That borrowing lowers your guard, which is exactly what the operator wants.

What happens after the click

Once you tap through a malicious link, several things can unfold. Some pages simply harvest credentials by showing a fake login screen that looks like your bank's, your email provider, or your superannuation fund. Others drop a payload in the background — a piece of malware that sits quietly, logging details or opening a backdoor for later access. A third category tries to install ransomware, locking files on your device until a payment is made.

The choice between these outcomes often depends on what device you are using and how it is configured. A phone running an outdated operating system is a much easier target than a patched laptop. Public Wi-Fi at a Sydney café or a Brisbane library adds another layer of risk, because the network itself can be probed. Some scams now use follow-up calls — a "representative" ringing hours after the click to walk you through "verifying" your account — which adds social pressure on top of the technical trick.

A handful of warning signs show up before you ever reach a malicious page. Hovering over a link on desktop often reveals a destination that has nothing to do with the sender. On mobile, long-pressing the link does the same. Domain age, spelling mistakes in the brand name, unusual top-level domains, and pressure language like "within 24 hours" all matter.

Warning signs in a suspicious link

• The sender's display name does not match the actual email address or phone number
• The destination domain looks plausible at a glance but differs by one character, a swapped letter, or a country-code ending
• The message creates urgency — a delivery deadline, an account lock, a tax owed — and asks you to act through the link rather than by logging in directly
• The page you land on offers almost no identifying information about who runs it

Building habits that lower the risk

Most people do not need a cybersecurity course to stay safer. A few reliable habits cover the majority of real-world exposure. The first is the simplest: if a message asks you to act through a link, log in to the relevant account or service directly through your browser instead. Going to myGov, your bank, or Australia Post by typing the address yourself takes a few extra seconds and removes most phishing attempts from the equation.

The second habit is treating shortened links with caution, especially in group chats. Most platforms now let you preview a link before opening it. If the preview reveals a domain you have never heard of, leave it alone. Aged domain names are sometimes valued precisely because their history lends them a thin layer of credibility, which is why school domain valuations are worth understanding — the trust an old name carries can be borrowed by anyone willing to register the next one.

The third habit is keeping your devices current. Software updates close the holes that malware relies on. The fourth is using a password manager, which fills in credentials only on the sites where they were originally saved, so a fake login page simply will not receive your real password.

Habits that make clicking safer

• Open banking, government, and courier sites by typing the address or using a saved bookmark rather than tapping links in messages
• Hover or long-press links to check the actual destination before tapping through, and avoid clicking links in messages from unknown senders altogether
• Keep your phone, tablet, and computer updated, and turn on automatic updates where you can
• Use a password manager and turn on multi-factor authentication so a single stolen password does not unlock everything

Understanding the mechanics behind simple links is half the work. The other half is letting that understanding turn into a brief pause before the tap — the kind of pause that turns a moment of risk into a moment of nothing at all.