Advice Column

Ask the Cyber Guardian

Real worries from real-sounding readers, answered without the lecture.

"Dear Cyber Guardian, someone logged into my Instagram and changed the email. My friends are getting weird money messages from 'me' and I feel sick about it. What do I do?"

— Locked Out in Year 9

First: this is not your fault, and it is fixable. Go straight to Instagram's 'Need more help?' / hacked account. Because the email was changed, they will send a recovery code to your original address or ask you to verify.

While you wait, post from another account or message a group chat telling friends the messages are a scam and not to click anything. That stops the damage spreading or other accounts getting hacked.

Once you are back in, change the password to a long and strong password you use nowhere else, turn on two-factor authentication, and check Settings → Security → Login activity to kick out unknown devices. Finally, change the password on any other account that used the same one.

"Dear Cyber Guardian, I got a text saying my parcel couldn't be delivered and I had to pay $2.50. It looked completely real and I almost typed my card in. How do I tell what's fake?"

— Nearly Got Me

Great instinct for stopping. Delivery scams are the single most common text scam right now, and they work because everyone is waiting on something.

Three quick checks: does it create urgency or a tiny fee? Does the link domain look slightly off, like 'auspost-delivery.co'? And were you actually expecting a parcel from that company?

The golden rule is never use the link in the message. Open the real app or type the company's website yourself. If you already entered card details, tell a parent straight away and call the bank to freeze the card, fast action usually means no money is lost.

"Dear Cyber Guardian, I post a lot, my school jumper, my suburb, my routine. My mum says it's dangerous but I think she's being dramatic. Is she right?"

— Oversharer

She has a point, but you do not have to stop posting. The risk is not any single post; it is the pattern you leave behind. Uniform plus suburb plus 'walking home from training' tells a stranger exactly where to find you on a Thursday.

Try this: keep your account private, review your follower list and remove anyone you have never met, turn off location tagging, and post activities after they happen rather than live.

A useful test before posting: would I be comfortable if this appeared on a screen in front of the whole school? If not, it probably does not need to go up.