{
  "slug": "telstra-bigpond-account-suspension",
  "canonical_name": "Telstra / BigPond bill, refund and suspension emails",
  "family": "account-suspension",
  "impersonates": {
    "brand": "Telstra (BigPond)",
    "disclaimer": "Telstra is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://www.telstra.com.au/cyber-security-and-safety/scams"
  },
  "goal": [
    "credentials",
    "payment",
    "personal-data"
  ],
  "channels": [
    "email"
  ],
  "summary": "Two waves aimed at Telstra customers in Australia: fake bills and a \"you paid twice, claim your refund of $202.42\" email (2016), then a BigPond \"your service could be suspended, update your billing information\" email (2017). Both lead to a copy of the My Account page that collects logins and card details.",
  "status": "archived",
  "first_seen": "2016-12",
  "last_seen": "2017-04",
  "recognise": [
    "A refund or a suspension out of the blue, with a link",
    "The linked \"My Account\" page is not on telstra.com",
    "Generic \"Dear BigPond Customer\" greeting"
  ],
  "variants": [],
  "specimen": {
    "date": "2017-04",
    "channel": "email",
    "from": "bigpondservice@bigpond.com (spoofed)",
    "reply_to": null,
    "subject": null,
    "attachment": null,
    "body_text": "Dear BigPond Customer,\n\nTelstra BigPond is sending this e-mail to inform you that our service to you could be suspended. This might be due to one of the following reasons:\n1. You have changed your billing address.\n2. You have submitted incorrect information during the payment process of your bill.\n3. Your credit/debit card has expired.\n4. You have not updated your BigPond profile.\n\nTo ensure that your service will not be interrupted, we request confirmation and update of your billing information now by clicking the following link: [rogue URL].",
    "redactions": [
      "rogue URL"
    ],
    "image": "/wp-content/uploads/bigpond-phishing-email.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/bigpond-email-scam"
    ]
  },
  "tells": [
    {
      "n": 1,
      "anchor": "from",
      "text": "The display address imitates bigpond.com; the real sender is elsewhere"
    },
    {
      "n": 2,
      "anchor": "body",
      "text": "Four generic \"reasons\" instead of one fact about your account"
    },
    {
      "n": 3,
      "anchor": "body",
      "text": "The only action is a link to \"update billing information\""
    }
  ],
  "indicators": {
    "sender_domains": [],
    "senders": [
      {
        "value": "bigpondservice@bigpond.com (spoofed)",
        "first_seen": "2017-04",
        "sources": [
          "https://soft2secure.com/knowledgebase/bigpond-email-scam"
        ]
      }
    ],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not use the link; open telstra.com yourself and check your bill there",
      "Report the email to Telstra through their scams page",
      "Delete it"
    ],
    "if_called_or_paid": [
      "Entered a password? Change it now, and everywhere else you used the same one",
      "Entered card details? Call your bank, ask them to block the card and reissue",
      "Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings"
    ],
    "report_links": [
      {
        "label": "Telstra: scams",
        "url": "https://www.telstra.com.au/cyber-security-and-safety/scams"
      },
      {
        "label": "Scamwatch (Australia)",
        "url": "https://www.scamwatch.gov.au/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2017-04-27",
      "type": "specimen",
      "title": "Specimen №2: BigPond \"service could be suspended\"",
      "text": "The suspension email quoted above, sent from a spoofed bigpondservice@bigpond.com.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/bigpond-email-scam"
      ]
    },
    {
      "date": "2016-12-31",
      "type": "specimen",
      "title": "Specimen №1: Telstra refund of $202.42",
      "text": "Fake bills and a double-payment refund of $202.42 leading to a copied My Account page.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/telstra-email-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of two guides (2016, 2017), both online unchanged. BigPond as a brand is gone; the Telstra skin recurs.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "afterpay-account-suspension",
    "cra-tax-refund"
  ],
  "sources": [
    "https://soft2secure.com/knowledgebase/bigpond-email-scam",
    "https://soft2secure.com/knowledgebase/telstra-email-scam",
    "https://www.telstra.com.au/cyber-security-and-safety/scams"
  ],
  "legacy_urls": [
    "/knowledgebase/bigpond-email-scam",
    "/knowledgebase/telstra-email-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/telstra-bigpond-account-suspension",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}