Criminals are impersonating the ATO to steal identities, access bank accounts, and defraud Australians, often using highly convincing emails, SMS messages, and phone calls.

There has been a dramatic increase in phishing scams that pretend to be from the ATO. These scams take advantage of the busy tax season to catch people off guard. Whether you’re expecting a refund or preparing to lodge your return, staying alert could save you serious stress and money.

Plus with the ATO changing from myGovID to myID, it’s a perfect time for a scam.

When logging in to an online service with myID, ensure that the URL displayed in your browser includes ‘https://www.myID.gov.au’ or ‘https://myID.gov.au’.

What do ATO scams look like?

Scammers use various methods to impersonate the ATO, including:

• Emails claiming you’re owed a tax refund, prompting you to click a link or enter your myGov login.
• Text messages with QR codes, supposedly linking to secure portals.
• Voicemails claiming overdue debts, threatening legal action if not paid immediately.
• Social media DMs, pretending to be official ATO support accounts.

They often include official-looking branding and links that mimic government websites to trick you into sharing your Tax File Number (TFN), bank account, or login credentials.

A 3-step plan to protect yourself

1. Pause and think

Scammers rely on panic and urgency. If you receive a message demanding immediate action or threatening fines, stop and ask: ‘Does this feel right?’ The ATO will never send threatening messages demanding immediate payment.

2. Check for signs of fraud

ATO communications may direct you to log into your myID account, but they will never:

• Include links asking you to enter login details.
• Demand payment via gift cards or cryptocurrency.
• Contact you via Facebook, Instagram, or other social media.
• Ask for personal information over email or SMS.

It is important to be aware of fraudulent websites, apps and phishing scams.

3. Report and act quickly

If you think you’ve received a scam:

• Forward the email or screenshot the message and send it to: reportscams@ato.gov.au
• Contact the ATO on 1800 008 540 to verify communications.
• Notify us

By reporting scams, you help others avoid becoming victims too.

How the ATO really contacts you

The ATO does contact taxpayers via SMS and email, but these messages are always general in nature. They will ask you to log in to myGov to view secure communications. You will never be asked to click a link to access a refund, enter credit card details, or verify your identity directly through a message.

ATO messages typically contain:

• Your name (not “Dear Customer”)
• Clear, professional language
• No threats of legal action
• No spelling or formatting errors

If you’re unsure about a message, contact the ATO directly or check the official ATO scam alerts page.

What to do if you’ve clicked a scam link or shared info

If you believe you’ve fallen for a scam:

1. Change your myID and online banking passwords immediately.
2. Call your bank and ask them to monitor or freeze your account.
3. Contact the ATO or your tax agent to flag your profile.
4. Report the scam to www.scamwatch.gov.au.

Early reporting can reduce the risk of long-term identity theft.

Tips for businesses

If you’re running a business:

• Inform your finance team or bookkeeper of these scams.
• Only use official ATO payment portals or registered tax agents.
• Train staff not to respond to suspicious emails or texts.

Some scams specifically target business owners, especially those who manage their own payroll or GST. Make sure only authorised users can access your business’s myID or BAS lodgement portal.

Final thoughts

Scams are becoming more sophisticated, but so are the tools and knowledge you can use to defend yourself. The best approach is cautious optimism and verify everything.

And remember, no legitimate ATO message will ever require urgent payment by Bitcoin.