Cybercrime on the rise: how to protect yourself online

Today’s digital world gives us more freedom and choice than ever before in how we access products and services, and how we interact with one another.

Having an online presence offers many benefits, but it also increases the risk of cybercrime, where unauthorised users access personal information to steal people's identities and money, including their super.

Below we outline some common ways cybercriminals target the super industry. Find out what we’re doing to protect your identity when transacting online, and learn simple tips for spotting a scam.

How criminals can use identity theft to target fund members

Cybercrime is a serious and growing problem in Australia. A report of cybercrime is made every 6 minutes, with individuals self-reporting an average loss of $33,000 per incident1.

One of the most reported types of cybercrime is identity fraud, when someone uses your personal information without your consent to steal money or gain other benefits1.

Cybercriminals often use scams to access your personal information. One common scam is phishing, where a cybercriminal poses as a person or organisation you trust and sends fake emails or text messages with links asking for your login details or identity documents to verify who you are2.

They can then use this information or sell it on dark web forums and marketplaces to3:

More examples of super scams can be found on the Moneysmart website.

Case study

A cybercriminal gained unauthorised access to Jane’s4 personal information and used it to change the contact details for their super account online. The cybercriminal then applied to withdraw the full balance of Jane’s super (more than $95,000) using counterfeit identity documents fraudulently certified by a Justice of the Peace.

Two days later, Jane’s retirement benefit was deposited into a fake bank account, and the money was quickly used to make purchases overseas.

What GESB does to help protect your identity

At GESB, we take cybersecurity seriously. We use robust security checks and verification steps to confirm your identity before allowing access or changes to your account.

In general, when you contact us remotely, we request:

  • Three pieces of personal information to confirm you’re the account holder, or you’re authorised to collect information on the account holder’s behalf
  • Valid identity (ID) documents, where appropriate

Before we process certain transactions and account changes, such as withdrawing your super or rolling it over to another fund, we’ll ask for ID documents to confirm you’re the one making the request. Learn more about how to provide proof of identity.

We have information security controls to monitor for external threats to our online systems. We investigate any suspicious activity that could indicate fraud or cybercrime and report it to the relevant authorities as needed.

Our security controls also include physical security on our premises to prevent unauthorised access, and staff training in identifying and preventing fraud.

We’re always working to improve our security.  For example, when accessing Member Online, you’re required to go through an extra security step called multi-factor authentication (MFA). MFA is an enhanced two-step identity check that helps confirm you are who you say you are.

What you can do to help protect your identity

There are several steps you can take in your daily life to help protect your personal information and login details from cybercriminals. These include:

  • Updating your devices – consider turning on automatic updates on all your devices, as these help fix weaknesses that could be targeted by cybercriminals
  • Turning on multi-factor authentication (MFA) – consider turning on MFA, starting with your most important accounts such as email and online banking, to make it more difficult for cybercriminals to break in
  • Using passphrases instead of passwords – passphrases are made up of 4 or more random words, making them harder for cybercriminals to guess
  • Being scam aware – if you receive a message that has the features of a scam, such as claiming to be from a person or business you know or trying to create a sense of urgency or panic, go back to the official source to check it’s from them

To explore more easy steps to secure your device and accounts, visit the Australian Cyber Security Centre website.

GESB also has resources to help you avoid email scams and use email safely.

How to report identity crime

If you believe you’ve been a victim of online identity fraud in relation to your super account, or if there’s been a change to your contact details that you didn’t request, please call your Member Services Centre on 13 43 72. We can flag your account and provide additional support and guidance.

If you have a Self-Managed Super Fund (SMSF) and suspect it’s been targeted by identity fraud, please contact the ATO.

You can also use ACSC’s ReportCyber tool to report cybercrime and cybersecurity incidents on behalf of yourself, someone else or a business.

More information

  • Find out more about identity fraud, including what to do if your identity’s been stolen, on the Australian Government’s Office of the Australian Information Commissioner (OAIC) website
  • Visit the ATO’s Scam alert page for information and examples of recent ATO impersonation scams

1 Australian Cyber Security Centre, Annual Cyber Threat Report 2024-2025, accessed June 2026
2 Australian Cyber Security Centre, Types of scams, accessed June 2026
3 Australian Federal Police, Cybercrime, accessed June 2026
4 This example is for illustrative purposes only.

Page last updated 14 July 2026

Thank you for printing this page. Remember to come back to gesb.wa.gov.au for the latest information as our content is updated regularly. This information is correct as at 22 July 2026.