Shout a Coffee

What actually happens when you hand a dodgy website your details

Published 10 September 2026 · 6 min read

A dodgy website isn't always the obvious kind. It might be a pixel-perfect copy of a parcel tracking page, a fake login for a service you actually use, a store with prices that are too good to be true, or a "free tool" that wants you to create an account before it will do a one-minute job. The moment you enter real details, a name, an email, a card number, a document, they're captured. Here's what those details get used for, according to the agencies that track it in Australia and New Zealand.

It usually starts with identity fraud

The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 found identity fraud was the single most reported type of cybercrime by individuals, out of more than 84,700 reports to ReportCyber that year, and that the average self-reported cost to an individual rose to about $33,000. Identity fraud, in the OAIC's definition, is someone using your personal information without consent to get a benefit: opening a bank account, taking out credit, or applying for documents like a passport in your name.

Your details get combined with other details

One dodgy form rarely acts alone. The OAIC's point that a thief only needs "a small amount of your personal information" if they can fill in the rest from public sources cuts both ways here. What you typed into the fake site gets matched against old data breaches and whatever is public on your social media, date of birth, family names, photos, until there's enough of a profile to pass as you on a phone call or a web form.

Account takeover and SIM-swapping

With enough of your details, criminals don't need your password. The Australian Cyber Security Centre describes how scammers use collected information to impersonate you to your mobile provider and get your number ported to a SIM they control. Once that happens, the calls and text messages meant for you, including the two-factor codes your bank sends, go to them instead, and they can walk into your banking, email and superannuation accounts.

You get sold on, and scammed again

Details entered on a scam site don't get used once and thrown away, they get reused and resold for more targeted scams. New Zealand's National Cyber Security Centre makes the point that "just because a scammer has personal details about you doesn't mean the rest of their claims are legitimate", the extortion email that quotes one of your real old passwords is running on exactly this fuel. The money involved is not small: Australia's National Anti-Scam Centre reported $2.03 billion in scam losses across 2024 even after a 26% fall, and the NZ NCSC logs millions of dollars in direct losses reported every quarter.

How to tell before you type

The old advice to "check for the padlock" is necessary but no longer enough, plenty of scam sites have a valid certificate now. Better checks:

  • Read the exact domain, character by character. Scam sites lean on near-misses, a hyphen added, .com swapped for something else, a real brand name buried in a longer address.
  • Don't arrive via a link in an unexpected message. If a text or email says there's a problem with a delivery, a fine, or an account, go to the organisation's site the way you normally would, not through the link.
  • Be suspicious of urgency. "Act now or lose access" is a pressure tactic, a genuine service can wait for you to check.
  • Ask why a one-off task needs an account. Converting a file or reading a QR code doesn't require you to register, if a "free tool" insists, that's the price, and it's your details.

If you've already entered your details

Act quickly, the damage is easier to limit early. Australian agencies recommend:

  1. Change the password on that site and on any other account where you used the same one, and turn on multi-factor authentication.
  2. Contact your bank straight away if card or account details were involved.
  3. Report it to the Australian Signals Directorate's ACSC at ReportCyber, and to the National Anti-Scam Centre at Scamwatch.
  4. Call IDCARE on 1800 595 160, the free identity and cyber support service for Australia and New Zealand, which will help you build a response plan.

In New Zealand, report to the National Cyber Security Centre or Netsafe, and to the Office of the Privacy Commissioner if your information was mishandled by a legitimate organisation. Watch for the warning signs the ACSC lists: unusual activity on your statements, ID documents going missing, mail that stops arriving, debt collectors chasing purchases you didn't make, or a government agency contacting you about a benefit you never applied for.

The simplest defence is having nothing to take

Every one of these outcomes starts with details being entered somewhere they shouldn't be. The details you never type can't be harvested, resold, or used to port your phone number. For one-off jobs, a converter, a QR code, editing a PDF, a tool that works without an account and without uploading anything gives a dodgy operator nothing to work with.

Where this site stands

There's no account to create here, no email field, and no upload. Files are processed by your own browser and never sent to a server, so there is nothing to phish and no stored copy to breach. If you want to check that claim rather than take it on faith, is it safe to use free online PDF tools? shows you how.

Use a tool that asks for nothing

Browse the tools

Frequently asked questions

The site had "https" and a padlock. Doesn't that mean it's safe?

No. HTTPS means the connection between your browser and that server is encrypted, so nobody in between can read it. It says nothing about who runs the server or what they do with what you send. Scam sites routinely have valid certificates. Treat the padlock as the bare minimum, not a seal of approval.

I only gave an email address. Is that a problem?

It's the smallest version of the problem. An email address on its own confirms you're a real, active target and gets added to lists for phishing and extortion attempts. Change the password on any account tied to that address, switch on multi-factor authentication, and be extra wary of messages that arrive claiming to be from services you use.

Should I report it even if I didn't lose any money?

Yes. Both ReportCyber in Australia and the NCSC in New Zealand use reports to spot patterns and warn others, and a report on the record helps if fraud shows up in your name later. Reporting is free and doesn't require you to have lost anything.

Related guides

Sources