Customer security: Scams, fraud and online safety

The person sending these may try to obtain your personal details or get you to click on an unsafe link, trick you into making an expensive call or send back a text message. Any of these could result in loss of personal information or funds.

If you get a text message that is unknown, unsolicited or you suspect to be fraudulent, we suggest that you:

• Don’t reply to the message, even to unsubscribe

• Don’t provide any personal details 

• Don’t click on any links 

• Don’t open any attachments 

• Don’t call any numbers associated with the message

• Don’t forward the message onto anyone

To report a suspicious text that appears to be from AGL:

1. Take a screenshot of the text

2. Send it to spam@agl.com.au noting the time, date and phone number.

There’s no single identifier but here are some hints that will help you establish if an email is suspicious.

1. The message asks for personal information.
   No matter how official an email might look, it's always a bad sign if the message asks for personal information. For example, your bank doesn't need you to send them your account number - they already know it. A company should never send an email asking for your password or credit card number.

2. The offer seems too good to be true.

3. You didn't initiate the action.
   For example, if you get an email saying you have won an AGL competition, but you never entered the competition.

4. The URL (e.g. link to website or email address) doesn't match the name displayed.
   If you hover your mouse over the link or email address and its different to the address that you can see, the message is probably fraudulent or malicious. For example, if you hover over a display sender name like “AGL Energy” it should appear as “agl@energy.agl.com.au”, not something like “agl@123.com”.

5. The domain name is slightly different to what it should be e.g. aglenery.com.
   Criminals who launch phishing campaigns often depend on people not checking a link before they click it, or not understanding how a domain name is structured.

6. You’re asked to make an unusual or unnecessary payment.
   A sign of a phishing email is if you’re asked for money outside of regular billing, or where you do not have an owing balance.

7. The message contains poor spelling and grammar.
   When a company sends out a message, it's usually reviewed for spelling, grammar and legality. If a message is filled with poor grammar or spelling mistakes, it probably did not come from them.

8. The message makes unrealistic threats.
   If a message makes unrealistic threats, it’s probably a scam. An example of a threat message is an email saying that your account will be cancelled within 24 hours if you don’t action something.

9. Something just doesn't look right.
   If it looks off, it probably is.

To report a suspicious email:

1. Open a new email in your email browser.

2. Drag the suspicious email out of your inbox and drop it into the new email (it will become an attachment).

3. Address the new email to spam@agl.com.au with the subject ‘Spam’.

4. Delete the suspicious email from your inbox.

Once we receive your email, we will review and confirm whether it is a scam email. We will be in touch if we need any more information.

Phone scams aim to deceive you. The person calling you may be trying to obtain your personal details or credit card details.

Things to look out for;

• Phone calls that are out of the blue claiming to be an AGL representative with unrealistic threats.

• Being asked to share personal information with unknown or unsolicited callers.

For more information, visit the Australian Communications and Media Authority's page on phone scams.

We are aware of scam SMS’s being sent to our customers, using AGL’s branding.

These SMS’s contain varying messages related to outstanding invoices and/or threat of disconnection, with an embedded link to follow.

Please DO NOT click the link in these SMS’s.

These SMS’s contain a fake AGL link, which if clicked can direct the customer to a website impersonating AGL.

Even if the SMS appears to be sent from AGL, these malicious actors can spoof the sender ID/Name of the text messages to make it appear legitimate. 

Our Cyber Security team continues to take steps to contain these scams as they are identified or reported, however we ask that customers remain vigilant and do not click on these links.

If you have provided any payment details via the link in a scam SMS, we advise that you contact your banking institution immediately.

If you wish to verify the legitimacy of any interaction related to AGL, please contact us directly on 131 245, for assistance.

Please see below for a list of scam SMS’s that have been identified to date:

We have recently received reports of scam callers pretending to be from AGL. The phone scam is related to the Energy Bill Relief Fund announced by the Australian Government in partnership with the state and territory governments.

The scammers are attempting to obtain customers’ bank details under the false premise of depositing energy bill relief credits. AGL will not contact customers for this purpose – eligible customers will have their energy bill relief credit applied directly to their AGL energy bill. For more information about the Energy Bill Relief Fund please visit the Federal Government Energy Bill Relief website.

If you receive any calls like this, please do not provide any personal information, and disconnect from the call. If you wish to verify the legitimacy of any interaction related to AGL, please contact us directly on 131 245.

If you’ve lost money or shared your personal information with scammers you should contact your bank. You can also report it to the Australian Cyber Security Centre via https://www.cyber.gov.au/acsc/report and your report will be referred to the appropriate police jurisdiction for assessment. If there’s been no loss of money or personal information you can report the scam to Scamwatch via Report a scam.

We’re aware of an AGL branded scam email that is currently circulating, with the subject line “Refund need to be Issued for Duplicate Payment.”

Please refer to an example of the scam email below, and the scam indicators that can be found.

1. Grammatical & capitalisation errors in the email title;

“Refund need to be Issued…”

1. The email address is originating from a non AGL domain name;

“@harborps.org”

1. The email title, and email heading are inconsistent

“Refund need to be Issued…” vs “Refund will be Issued…”

1. Inaccuracies and grammatical errors in the body of the email:

a) Here the email refers to filling out a form “above” however the link to the form is found below

b) The sentence “…so we can processed a refund” is grammatically incorrect

1. When hovering over

“Refund Me” the embedded link information is visible, it can be seen that the URL does not relate to AGL. We can confirm that this URL leads the recipient to a website impersonating AGL and requests for payment information.

1. There are slight variations to the formatting of the content in the email body. It is always beneficial to look for inconsistencies in font type and sizing, when reviewing a potentially scam email.

Our Cyber Security Team continues to take steps to contain these scams as they are identified or reported, however we ask that customers remain vigilant, looking out for similar fraud indicators and not clicking on any suspicious links. 

If you have provided any payment details via the link in a scam email, we advise that you contact your banking institution immediately.

If you wish to verify the legitimacy of any interaction related to AGL, please contact us directly on 131 245, for assistance.