Incoming Australian social media ban leaves children vulnerable to phishing scams, experts say

The incoming ban on social media for all Australians under the age of 16 may unintentionally create new ways for scammers to target Australians and access their personal data, cyber safety experts warn.

The rules, which will come into effect on December 10, will require users to verify their age, potentially giving scammers the perfect cover story to access highly convincing "prove your age scams".

The goal of these particular scams is to trick people into clicking malicious links or handing over sensitive information, allowing scammers to commit identity theft.

"What's the number one thing scammers and predators want from us?" Cyber safety specialist Stacey Edmonds said.

"Our data and personal details … and we're giving them out."

Deciding how they will verify age is up to the platform to decide but one requirement is that requesting ID cannot be the only form of age checking.

Experts say it is important to remember no platform will ask you just for government identification to verify your age.

Meta says that if you are 16 or older and mistakenly lose access to your account, you can verify your age through a third-party partner called Yoti by providing a government-issued ID or a video selfie.

It says Yoti deletes the information once a person's age has been verified.

TikTok said it would have a multi-layered approach to confirm a child's age.

While Snapchat has said it will use Connect ID, connected to a user's banking account app to verify age.

Ms Edmonds, who created a game to teach children critical thinking skills about online scams said age scams are inevitable and will follow well-known scamming formulas.

She believes Australians may fall victim to phishing emails and texts asking for people to put in personal details or follow dodgy links to prove they can keep accessing their accounts.

"The fact is we need to do something about social media because big tech companies aren't regulating themselves," she said.

"But every change and regulation always has unintended consequences and I think it's really important that we understand the dangers."

Ms Edmonds points to well-known scams like ATO phishing messages during tax time.

The eSafety commissioner's website addresses the risk of scams in its FAQs section on the ban.

It says "to reduce the risk of scams, age-restricted platforms should clearly communicate the age-check steps account holders have to take, the information they have to give and whether the platform is using a third-party age assurance provider".

"Their 'Help' or 'Support' sections are a good place to look for latest details," the website read.

"If 'go and read the Help pages' is our main defence against fake age checks, we are leaving families exposed," Ms Edmonds said.

"Scammers and predators thrive in the gap between what is written in FAQs and what people do when they are emotional, rushed and staring at an official looking prompt," Ms Edmonds said.

People are more likely to fall victim to scams when their guard is down, Scamwatch says.

Lennon Chang, a professor in Cyber Risk and Policy at Deakin University says he can easily see how existing scam tactics could be adapted to capitalise on the social media ban.

"We'll probably see scam websites touting the under 16 social media ban and getting them [users] to provide their personal information via a link for verification and that link might lead to a scam website or downloading malicious software."

Risk of VPN scams

There are also concerns under 16s will fall for scams that promise to help them bypass the ban if they hand over details.

"We're just about to go into a long Christmas holiday and the kids facing the ban will be at an age where they could probably be left alone and their parents are working," Ms Edmonds said.

"We've got vulnerable people who are emotionally charged and pissed off they've been banned and now they've got an ad telling them they can sign up for a virtual private network that might get them around it and all they have to do is give their personal information."

Daswin De Silva, an AI expert from La Trobe University says in other countries like China, where certain platforms are banned, users have been able to get around it.

"A lot of people will search for a free VPN and that will download a host of other spam software onto your computer or your phone creating further risks for data breach," he said.

'Leaving families exposed'

The eSafety commissioner also concedes there are ways around the ban.

"We know that some under-16s may find their way around the age restrictions, like some get around restrictions on cigarettes and alcohol," the commissioner's website said.

"But age-restricted platforms will have to take steps to stop under-16s getting around the law.

"This includes having ways to prevent under-16s from faking their age by using false identity documents, AI tools or deepfakes. It also means trying to stop under-16s from using VPNs to pretend to be outside Australia."

Ms Edmonds said education should be rolled out in conjunction with the ban.

"Children are not just potential victims," Ms Edmonds said.

"They are our most powerful early warning system. If we give them a simple language for human hacking, those instincts ripple out to parents and grandparents as well.

"Teaching children to ask themselves questions like does this look dodgy or not rather than just being across what the big scams are."