Know if it's a scam before you click.

Scams rely on urgency, impersonation, and exploiting trust. Watch for these red flags:

• Domains - look-alike domains (e.g. paypa1.com), newly registered sites (under 30 days), free hosting or unusual TLDs (.xyz, .top, .click)
• Emails - mismatched sender domains, urgent language ("act now"), requests for credentials or payment, generic greetings
• Social accounts - recently created profiles, few followers, copied bios, DMs with links or "investment opportunities"
• Crypto - guaranteed returns, pressure to send funds to a specific wallet, "recovery services" requesting upfront payment
• Phone - spoofed caller ID, government impersonation, requests for remote access or gift cards

Use AVA to screen any entity before engaging. A 30-second check can prevent significant financial loss.

Trust should be earned through verification, not assumed. Before transacting or sharing information:

• Screen the entity - paste the domain, URL, wallet address, or social handle into AVA for an instant risk assessment
• Check domain age - legitimate businesses have domains registered for years, not days
• Inspect SSL certificates - a padlock icon alone means nothing. Check who issued the certificate and whether it matches the organisation
• Cross-reference - search the entity name alongside words like "scam", "review", or "complaint" before engaging
• Verify independently - contact organisations through their official website (not links in messages) to confirm legitimacy

• Enable 2FA everywhere - use authenticator apps (not SMS) for critical accounts. Hardware keys for highest-value accounts
• Use a password manager - unique 16+ character passwords per site. Bitwarden (free) or 1Password are strong choices
• Separate email identities - use different email addresses for banking, social media, and subscriptions to limit blast radius
• Monitor for breaches - check Have I Been Pwned regularly. Change credentials immediately if exposed
• Limit public information - social media oversharing provides attackers with answers to security questions
• Keep software updated - enable automatic updates for OS, browsers, and applications

If you suspect you have been targeted or have fallen victim to a scam, act immediately:

• Contact your bank - request a transaction freeze or chargeback within 24 hours for the best chance of recovery
• Change compromised credentials - update passwords for any accounts that may have been exposed, starting with email and banking
• Report to authorities: Australia: ScamWatch, ReportCyber. US: IC3, FTC. UK: Action Fraud
• Preserve evidence - screenshot messages, emails, transaction records, and URLs before they disappear
• Warn others - report the scam entity on relevant platforms and share with your network

Organisations operating in Australia face increasing regulatory obligations under the Scams Prevention Framework Act 2025:

• Mandatory scam prevention - banks, telcos, and digital platforms must implement reasonable scam prevention measures (penalties up to AUD $50M)
• Real-time screening - integrate entity verification into payment flows, onboarding, and communication channels via the AVA API
• Audit trail - maintain records of screening decisions for compliance reporting. AVA provides exportable audit logs
• Incident response plan - document procedures for breach notification (72-hour NDB Act requirement), customer communication, and evidence preservation

For enterprise API integration and compliance consulting, contact enterprise@checkwithava.com.