The scam text, step by step

Mia is 17, in year 12, and works Saturdays at a bakery. She has $1,840.00 saved for a car, built up over 14 months of paying herself first. On a Tuesday night during exam week she gets a text: Your parcel is held pending a customs fee of $2.99. Pay within 24 hours to avoid return: followed by a link.

Mia is expecting a parcel, a birthday gift for her mum. The link opens a page that looks exactly like a courier company: logo, tracking number, a countdown timer. It asks for her card number, expiry and the three digit code to collect the $2.99 fee. She is tired, it is $2.99, and the timer is ticking.

She enters the card details. The page then shows a second screen: To verify your identity, enter the code we have just sent to your phone. A code from her bank does arrive, with a line she does not fully read, and she types it into the page. The page thanks her and says the parcel is on its way.

Two things have now happened. The scammers hold her full card details, and the code she typed was her bank's confirmation for adding her card to a new digital wallet on a phone she has never seen. Over the next hour, three tap payments go through at stores in another city: $89.00, $240.00, then $480.00.

Mia's phone buzzes with each one, but her notifications for the banking app are switched off, so nothing appears on her lock screen. She finds the damage at 11pm when she opens the app to check whether the $2.99 came out: $809.00 gone, and her card sitting inside someone else's wallet.

Her friend Zoe had received the same text that week. Zoe was also expecting a parcel. The difference: Zoe opened the courier's real app, saw her parcel listed as on schedule with no fee owing, and deleted the text. Thirty seconds of checking through a channel she controlled.

Mia calls her bank's 24 hour line that night. The card is frozen, the foreign wallet is removed, and because she reported within hours, the bank recovers two of the three payments and refunds the third under its fraud policy 9 days later. She reports the scam to Scamwatch the next morning. The $2.99 fee, of course, was never the point.

Look closely at why the recovery was only partial. The two payments the bank clawed back were the ones still settling, caught in the day or two before the money had fully left. The third had already completed, so it could not be simply reversed and had to be covered under the bank's fraud policy instead, which is why it took 9 days rather than being fixed on the same call. None of that was luck. It followed directly from how fast Mia rang, and from the fact that a card payment leaves a short window that an instant transfer would not have.

Afterwards, Mia changed three small things. She turned on transaction notifications, so the next unexpected payment would light up her lock screen instead of hiding in an app she only opens at night. She saved her bank's real number in her contacts, so she would never again be hunting for it in a panic. And she made herself a private rule that any message carrying a link and a deadline gets closed, and the company reached through its own app instead. None of it was technical. It was the same lesson Zoe already knew, learned the expensive way.