The world moved. We didn't.
Australia's score on the Global Cybersecurity Index (GCI), which the International Telecommunication Union (ITU) publishes, barely changed between 2020 and 2024. It slipped from 97.47 to 96.24. The rest of the world did not stand still. In 2020 only 16 countries scored higher than Australia. By 2024, 44 did, and 12 of them scored a perfect 100.
So did Australia slip, or did everyone else catch up?
From Africa to the Pacific, most countries climbed. Australia barely moved.
Thirty-two countries passed Australia. Four fell behind it.
Most of that climbing happened below Australia, but 32 countries did pass it. They got there through effort, building, often from scratch, what Australia already had.
Pakistan adopted its first national cyber security policy in 2021. Jordan opened a national cyber security centre, and Slovenia set up an independent information security office. Worldwide, countries with a national strategy rose from 107 to 132.
Some even organised around the index itself. Jordan formed a national team to raise its score, and Pakistan's policy set a goal of climbing international technology rankings.
Australia, already near the top, mostly rested on what it had. It topped up three measures but let four others slip.
While others built, Australia stood still.
Some of that building was paid for by Australia. Between July 2022 and June 2024, Australia's aid program paid out $26.7 million for cyber and critical technology work in Southeast Asia and the Pacific, $23.6 million of it to 21 named partners.
Fifteen of the 17 partners with a score rose 2 points or more, and Vanuatu, which received the most, rose 56. But almost every country that started low climbed, with or without Australian money. Of the 88 that scored under 40 in 2020, 83 rose 2 points or more. So the map shows where the money went, not what it did.
Abroad, Australia helped others build. At home, its own score slipped.
Australia's cyber aid went to its neighbours
Australia got better at organisation and worse at technology
So why did Australia slip? Its technical score fell 1.13 points and its organisational score rose 1.02, a net fall of just 1.22 out of 100.
The only technical measure that fell was teams that respond to attacks in a single sector, such as health or energy. Australia dropped from full marks to just over half. Partly the test got harder. In 2024 the ITU asked whether these teams were fully working, not just whether they existed.
Partly the gap was real. The government's own 2023 strategy admitted that sectors such as health had less capability to share and act on threat information.
Each of the other three losses lines up with something that happened in 2022. Industry partnerships fell as the government disbanded its industry advisory committee and stopped funding AustCyber, the body set up to grow the cyber industry. Professional training fell as a fund for training cyber workers was paused and then awarded less than half of the $60 million on offer in its second round. Awareness campaigns fell as the government's own industry advisers warned that awareness funding was far too low.
Overall spending did not fall. The agency that runs the Australian Cyber Security Centre more than doubled its budget, boosted by a ten-year, $9.9 billion defence package for cyber and intelligence. The money went into that agency, while smaller programs for industry and training were cut back.
Spending more than doubled. Four of Australia's scores still fell.
Two 2023 events line up with the gains, a new national strategy and a National Cyber Security Coordinator, a role created after the Optus hack showed the government had no cyber emergency response function. These are matches in timing, not proven causes. The index records whether a measure exists, not how well it works, and the ITU warns that scores are hard to compare across editions. Australia did not fall apart. It stood still on paper while the world filled in its own forms.
Being world class on paper is one thing. What happened to Australians is another.
We moved online. So did fraud.
A national score measures laws, agencies and plans. It does not measure what happens to people. For that we turn to the Australian Bureau of Statistics Personal Fraud survey. In 2024-2025, 2.9 million Australians aged 15 and over experienced card fraud, a scam or identity theft, the three kinds of personal fraud it has measured since 2014-2015. That is 13.1 percent of people that age, up from 8.5 percent in 2014-2015. Counting online impersonation, which the ABS added in 2021-2022, the total was 3.2 million.
So why did fraud rise by half while our scores stood still?
Thirteen in every 100 Australians were defrauded in a year. Ten were card fraud victims.
Card fraud outweighs everything else. Ten of the 13 were card fraud victims, and the other three were hit only by scams or identity theft.
Most card fraud happens online. In 2024, nine in every ten dollars lost to card fraud came from payments made without the card present, the payments industry body AusPayNet reports.
Overseas sites are the weak spot. Only 3 percent of spending on Australian cards is overseas, yet overseas online fraud is half of all card fraud. Many of those sites skip extra security checks, and international criminal groups use card details stolen in cyber attacks.
Card fraud drives the growth. It climbed from 6.9 percent in 2020-2021 to 10.4 percent in 2024-2025.
Scams went up and down, from a peak of 3.6 percent in 2020-2021 to 2.7 percent in 2024-2025. Identity theft stayed near 1 percent.
Why online? COVID-19 lockdowns closed shops and pushed Australians online. Before the pandemic, online sales grew about 14 percent a year. From March to October 2020 they were up an average 67 percent on a year earlier, the ABS found, with a further jump when Victoria's lockdown closed Melbourne stores in August. Fraud grew as spending moved online.
Card fraud climbed. Scams went up and down.
Every state is worse than in 2015
No state or territory escaped. The Northern Territory, the ACT and Queensland rose most, each by more than 6 points, and the ACT had the highest rate in each of the last two surveys. There was no survey between 2014-2015 and 2020-2021, so the first two maps are six years apart.
The biggest one-year jump came from 2023 to 2024, when the national rate rose from 11.1 to 13.0 percent. That year the value of online card fraud rose 29 percent, AusPayNet reports, while scam compounds spread across Southeast Asia and fake toll, parcel and billing texts increased.
Then the rise stopped. The rate barely moved in 2024-2025, from 13.0 to 13.1 percent. The payments industry says its members' efforts stopped losses on overseas online card payments from growing after 2023-2024.
More people, more victims. The odds barely change by state.
So does where you live change your risk? If fraud moved online, it should matter less. The biggest circles are simply where most people live, in the most populous states.
The odds are what count, and they barely change. For card fraud, only Western Australia sits significantly above the national rate, meaning by more than the survey's margin of error, and only South Australia and Tasmania below it.
For scams, no state differs significantly from the national rate. That fits scams arriving by phone and online, reaching Hobart as easily as Perth.
What about hard times? The consumer watchdog, the ACCC, links cost-of-living pressure to fake job offers, and scammers offer fake financial help to people in hardship. So rising living costs are a plausible reason for some of these scams.
The share of Australians scammed ended the decade about where it started. Where the scams happen moved a lot.
Scams barely grew. They moved.
Scams work differently from card fraud. The ABS only counts someone as scammed if they responded, by asking for more information, handing over money or details, or clicking a link. About 597,000 Australians aged 15 and over were scammed in 2024-2025, much the same share as a decade earlier.
So which scams faded, and which took their place?
Buying or selling scams nearly doubled. Phishing nearly halved.
The most common online safety habit guards against suspicious messages
Scams did not disappear. They changed shape. Buying or selling scams, such as fake online shops and false bills, nearly doubled, while phishing, messages that try to trick you into handing over personal details, nearly halved.
Phishing is the scam people are best prepared for. Avoiding unknown links, in teal at the top of the circle, is the most common online safety habit, kept by 64.8 percent of adults, and 72.5 percent of businesses with 200 or more staff run cyber security awareness and training for their staff. Since July 2022 telcos have also had to block scam texts.
Shopping scams slip past both defences. The most common habit guards against suspicious messages, and none of the 20 the Australian Institute of Criminology (AIC) tracks is about checking a seller before you pay. That gap may be why shoppers are now easier to scam.
Scams are also the fraud least often reported. Card fraud was reported for 97.6 percent of victims, counting cases where an organisation told the victim. For scams it was 71.1 percent.
The ACT does best at 89.2 percent, the only state or territory significantly above the national rate. Even that is below the card fraud reporting rate of every state and territory.
AI may make this worse. The Australian Signals Directorate says criminals use it to make fake voices, videos and websites more convincing, and the National Anti-Scam Centre warns it makes scams harder to recognise and report. It has not yet shown up as more victims in the ABS count.
Seven in ten scam victims had their worst scam reported. The ACT stands out.
The scams did not go away. A text that never arrives cannot trick anyone, but a shopper who does not know to check a seller still can be, and by 2025 the National Anti-Scam Centre found scammers “more successful using websites, digital and social media platforms”.
A blocked text protects everyone, careful or not. So how much does being careful help?
The careful still get hit
Two surveys let us test whether cyber security awareness protects people. The ABS counts who was defrauded at each age. The AIC asks adults how they rate their own technology knowledge, and which of 20 online safety habits they use, from avoiding unknown links to using a password manager.
If caution protected people, the most careful age group would be the least scammed. Is it?
Card fraud peaks in midlife. Scams stay high after 65.
The young are defrauded least, but not because they are careful. People aged 15 to 24 had the lowest rates of card fraud and scams, yet 18 to 34 year olds come last on 14 of the 20 online safety habits in the next chart.
A plausible reason is that the young have less to steal. Only 18 percent of under-30s held a credit card in 2022, against 61 percent of over-30s. Card fraud seems to follow the money. It peaks in midlife and eases after 65, when fewer people shop online.
Scams are the fairer test of caution, because a scam only counts if the person responded. From age 35 the rate stays close to 3 percent, so the over-65s are scammed about as often as the middle-aged.
Among Australians aged 65 and over, 84.6 percent avoid links in texts and emails when they are unsure who sent them, against 47.8 percent of 18 to 34 year olds. They lead clearly on 7 of the 20 habits, by 5 points or more. Yet in the ABS count they are scammed more often than 15 to 24 year olds. The AIC's own survey, which covers only internet users and measures fraud differently, finds the reverse.
They are also the least confident online. Only 16.0 percent of over-65s rate their technology knowledge as high or very high, against 49.8 percent of 18 to 34 year olds. Awareness, not know-how, sets them apart.
They also have more to lose. In 2025 the over-65s were 17.2 percent of the population but carried 26.5 percent of all losses reported to Scamwatch, the government's scam reporting service. The National Anti-Scam Centre says retirement savings may explain their large losses to investment scams.
Australians aged 65 and over are the most likely to avoid unknown links
Hover an age group to light up the matching age groups in the fraud chart above.
Card fraud climbed for almost every age. The over-65s nearly doubled.
Card fraud was higher in 2024-2025 than in 2020-2021 for every age group, and clearly so for everyone aged 25 and over. Among Australians aged 65 and over it nearly doubled, from 5.3 to 10.0 percent.
Australians as a whole used fewer online safety habits for the second year running, the AIC says. Among the over-65s, none of the habits fell by more than the survey's margin of error, and three rose.
Card fraud often needs no mistake by the cardholder. Card details can be stolen from a hacked shop website, so being careful cannot always stop it.
So no. The most careful age group is scammed about as often as the middle-aged, and its card fraud nearly doubled in four years.
Being careful cannot stop your details being stolen from someone else's systems. So how well do businesses and agencies defend theirs?
It is not just households
Households are not the only targets. The ABS also asks businesses which cyber security measures they have in place, and the privacy regulator records how quickly organisations find and report data breaches.
So do the smallest businesses defend themselves as well as the largest?
The smallest businesses trail on every measure
The widest gap is a written security policy. In 2024-2025 only about 6 percent of businesses with 0 to 4 staff had one, against 71 percent of those with 200 or more. About a third of the smallest had no cyber security measure at all.
Small businesses consistently report a lack of time, resources and expertise, the national cyber security strategy notes, and a 2019 survey by the Australian Cyber Security Centre listed the lack of dedicated IT security staff among the barriers.
Smaller firms are targets too. One in four small and medium business owners and managers told the AIC that cybercrime had affected their business in the past year.
And when organisations are breached, how quickly do they notice and report it?
Federal agencies were the slowest to find breaches and to report them, every half-year
Drag the slider to step through each half-year since July 2023.
These are the five sectors with the most data breaches in each half-year, so the list changes as the slider moves. The law gives an organisation up to 30 days to assess a breach it suspects, but nothing sets a deadline for noticing one.
In late 2025, agencies fell furthest behind other sectors at that first step. The privacy regulator has found some delays happened because the part of an agency that spotted an incident did not escalate it quickly.
Slow detection is not new. Between 53 and 87 percent of agency breaches were found more than 30 days after they happened. Only July to December 2025 is published as a data file, so the earlier half-years show shares without counts.
Standing still is not the same as standing firm.
Australia's defences look strong on paper, yet more Australians are defrauded each year than a decade ago. The clearest improvement in this data, the near halving of phishing victims, came alongside efforts to block scam texts before they arrive, not from points on a global index. The growth came where those protections are thin, on overseas shopping sites and social media. Awareness helps people spot a suspicious message, but it cannot stop card details being stolen from a hacked shop. And the defences are thinnest inside small businesses, while agencies are still slow to notice a breach. Being careful still matters. But the evidence here suggests that systems, not individual caution, decide who gets hit.