· By Nicholas “Nick” O'Sullivan, Townsville
Who do you actually call? Cyber incident and scam reporting in Australia, decoded
One of the more disorienting parts of dealing with a cyber incident or a scam is realising there isn’t one single “cyber police” to call. Australia has several different agencies, each built for a different kind of harm — and picking the wrong one just wastes time you don’t have. Here’s a plain-English map of who handles what.
ReportCyber, via cyber.gov.au — run by the Australian Cyber Security Centre (see our explainer on ASD and ACSC), ReportCyber is the front door for reporting cybercrime: business email compromise, ransomware, hacking, and online fraud with a technical/cyber component. Reports here feed into national threat awareness, and for incidents affecting a business, this is usually the right first stop.
Scamwatch, run by the ACCC — Scamwatch is where you report a scam that’s more about deception than a technical compromise: fake invoices, romance scams, investment scams, phishing that led to a payment. There’s real overlap with ReportCyber (a phishing email that leads to a fraudulent payment touches both worlds), and in practice reporting to one is far better than reporting to neither.
IDCARE — Australia and New Zealand’s national identity and cyber support service. IDCARE is less about reporting to a database and more about direct, practical help: if someone’s identity has actually been compromised (documents stolen, accounts taken over, a data breach has exposed personal records), IDCARE case managers walk through what to actually do next — which accounts to freeze, what to reissue, and in what order.
The OAIC and the Notifiable Data Breaches scheme — the Office of the Australian Information Commissioner is the privacy regulator. If your organisation experiences a data breach involving personal information that’s likely to result in serious harm, the Notifiable Data Breaches scheme may require you to notify affected individuals and the OAIC. This is a compliance obligation, not just a reporting option, for organisations covered by the Privacy Act — worth understanding before an incident, not during one.
eSafety Commissioner — the right agency when the harm is more personal than corporate: image-based abuse, cyberbullying, cyberstalking, or a young person being targeted online. Less relevant to a business email compromise, very relevant if a staff member, volunteer or young person connected to your organisation is being targeted directly.
Most organisations will only ever need one or two of these in a lifetime, which is exactly why nobody remembers which is which when it actually happens. Note which one applies to your situation, in your incident response notes, before you need it — not while you’re trying to figure it out during the incident itself.
Reporting is the right thing to do and it genuinely helps build the national picture, but it doesn’t recover your account, restore your backup or fix your Microsoft 365 tenant. That practical recovery work is what a Leadership Technology Review or a focused Microsoft 365 tenant hygiene review is for — reporting tells the right people it happened; a review is what stops it happening again.
Next in this series: the Department of Home Affairs, the Cyber Security Act 2024, and what it actually means for a small organisation.
