An email arrives with the Bunnings logo and a subject line about a $500 gift card. All you need to do is click a link and confirm a few details to claim it. It feels like the kind of thing that occasionally happens to someone, so why not you.
Click through, and the "confirmation" form wants your name, address, phone number, and card details to cover a small delivery fee.
Is This Bunnings Email Real?
No. Bunnings does not send emails offering free gift cards, prizes, or vouchers, and it never asks for banking details in an unsolicited message. If an email claims you've won something from Bunnings and asks you to click through to claim it, delete it. That single rule catches every version of this scam circulating right now.
Everything below covers what these emails look like, why the Bunnings name works so well for scammers, and what to do whether you've spotted it in time or already handed over details.
Why Bunnings Is a Target
Bunnings is one of the most visited and most trusted retail brands in Australia, which is exactly why scammers keep borrowing its name. A logo people recognise instantly lowers their guard faster than an unfamiliar sender ever could.
The National Anti-Scam Centre has publicly warned about phishing emails claiming to be from Bunnings and offering a $500 gift card tied to a confirmation link. Bunnings has also had to run its own dedicated scam warning page in response, spelling out that it never uses email to hand out free gift cards, and directing anyone unsure about a message to forward it in for a check.
The Variants Circulating Right Now
The $500 gift card offer. An email claims you've been selected to receive a $500 Bunnings gift card and asks you to confirm your details through a link. There is no selection process. Nobody is handing out $500 vouchers to random inboxes.
The prize or tool bundle win. A message claims you've won a tool bundle, often a well-known power tool brand, in a competition you don't remember entering. Real examples show jumbled sender addresses, reply-to details pointing somewhere unrelated entirely, and generic greetings like "Dear Customer."
The fake customer satisfaction survey. An email invites you to complete a short survey in exchange for a reward, then asks for enough personal information to be useful to identity thieves rather than useful for market research.
The fake job offer. A message claims to offer employment with Bunnings, sometimes remote or flexible work, and asks for personal details or an upfront payment for training materials or equipment as part of the "hiring process."
A Different Bunnings Scam: Fake Investment Bonds
A separate scam worth knowing about impersonates Bunnings in a completely different way. ASIC has issued a formal warning about scammers running fake websites and spam emails posing as brokers offering "sustainability investment bonds," with Bunnings branding and hyperlinks used to make the pitch look credible. Bunnings does not offer bonds or any other investment product. Legitimate bonds trade through licensed financial institutions, not hardware retailers. If an investment opportunity references Bunnings in any way, treat it as fake and stop before sending money anywhere.
How the Scam Works
Step 1: The email lands in a bulk send. Sender lists come from data breaches and broker databases, not from any relationship with Bunnings. You don't need to have shopped there recently, or at all, to receive one.
Step 2: Brand recognition does the persuading. A familiar logo and store colours make the email feel plausible before you've read a single word of the actual offer.
Step 3: A link leads to a form, not a store. The "claim your prize" or "confirm your details" page collects personal information, and often payment details for a supposed delivery or processing fee.
Step 4: The details get used or sold on. Whatever you enter feeds identity fraud, card fraud, or gets passed along to other scam operations targeting the same list.
Red Flags That Expose Every Fake
The sender address isn't @emails.bunnings.com.au. Click the display name to see the full address. Anything else, no matter how official the display name looks, is not from Bunnings.
You didn't enter anything. A prize, gift card, or bond opportunity you never signed up for isn't waiting for you. Legitimate competitions require entry.
It asks for payment to release a "free" prize. A genuine gift card doesn't need a delivery fee, processing charge, or card number to be handed over.
The greeting is generic. "Dear Customer" or your email address used as a name signals a bulk send, not a personal notification.
Reply-to or links point somewhere unrelated. A reply address tied to an unconnected domain, or a link that doesn't lead to bunnings.com.au, is one of the clearest tells available.
It creates urgency to claim within a short window. Countdown language exists to get you clicking before you stop to check.
What to Do If You Receive One
- Don't click anything, including a "confirm" button, attachment, or survey link.
- Forward it to [email protected] so Bunnings can act on it and warn others.
- Report it to the ACCC through Scamwatch at scamwatch.gov.au.
- Delete the email.
- Warn anyone nearby who shops at Bunnings regularly, since these campaigns often hit several addresses in the same area or household.
What to Do If You Already Entered Your Details
If you entered payment card details, call your bank immediately and ask them to flag the card for fraud. Watch your statement closely over the following weeks.
If you provided personal information like your address, date of birth, or phone number, treat it as exposed. Watch for follow-up scam attempts using those details to seem more credible, and consider a fraud alert with a credit reference agency if you gave enough to be useful for identity theft.
If you reused a password on the fake form that you use elsewhere, change it on every account where it appears and turn on two-factor authentication where you can.
How Your Email Ended Up on This List
Nobody needs a relationship with Bunnings to receive one of these emails. Scammers work from lists compiled from data breaches and broker databases, then send the same template to everyone on it regardless of whether they've ever set foot in a Bunnings store.
Every account created with a real email address is one more place that address can leak from eventually. Using a disposable address for sign-ups, competitions, and one-off registrations keeps your primary inbox off those lists in the first place. VanishInbox generates a working inbox instantly, with no account required, so you can receive whatever confirmation you need and let the address disappear afterward. Your real address never enters that company's database, so it's never part of the breach when that database eventually surfaces somewhere it shouldn't. For the full mechanics of that pipeline, see what actually happens when a website sells your email address.
Frequently Asked Questions
Does Bunnings really send gift card emails?
No. Bunnings does not offer free gift cards, prizes, or vouchers by email. Any message claiming otherwise is a scam impersonating the brand.
How do I know if a Bunnings email is genuine?
Check the full sender address. Genuine Bunnings emails come from @emails.bunnings.com.au. Anything else, regardless of the display name or logo shown, is not from Bunnings.
What's the Bunnings investment bond scam?
A separate scam where fake websites and spam emails impersonate a broker or responsible entity, using Bunnings branding and hyperlinks to promote fake "sustainability investment bonds." Bunnings does not offer bonds or any investment products, and ASIC has issued a public warning about it.
I clicked the link but didn't enter anything. Am I safe?
Likely, but run a security scan on your device as a precaution and keep an eye on your accounts over the following weeks.
How do I report a fake Bunnings email?
Forward it to [email protected], then report it to the ACCC through Scamwatch at scamwatch.gov.au.
Can I get my money back if I already paid a fee?
Contact your bank immediately and explain what happened. Report the scam to Scamwatch as well. Acting quickly gives you the best chance of stopping further charges or recovering funds.
The same brand-impersonation playbook shows up constantly with other well-known names. See our Geek Squad scam email guide for the identical panic-and-urgency mechanics applied to a tech support brand, or the ATO scam email circulating in Australia for a government-impersonation version of the same trick. For the broader mechanics of phishing across brands, see how to spot a phishing email. And if you want to verify a sender's address technically, our guide to checking whether an email is legitimate walks through reading the real domain and authentication results in Gmail.
