Tax scams are fake messages, calls, or emails that impersonate the ATO, myGov, or myID to pressure you into paying money or handing over personal information. They surge around tax time, EOFY, and quarterly BAS deadlines, exactly when business owners are stretched thin and less likely to stop and check.
In March 2026 alone, the ATO received 1,461 reports of impersonation scams, a 2% jump from February. The volume isn’t slowing down. What’s changed is the quality. AI has made these scams smoother, more personalised, and harder to spot at a glance.
This is what we’re seeing land in Melbourne client inboxes right now: how to tell a real ATO message from a fake one, and what to do if you’ve already clicked.
How tax scams work
Every working tax scam needs two things at once: an impersonation that holds up for about ten seconds, and a reason you don’t have ten seconds to check.
That’s the whole game. The impersonation gives them legitimacy. An ATO logo, a myGov sign-in page, and a phone number that looks official. The pressure gives them speed. Most clients who’ve been caught will tell you afterwards that something felt off, but they were on a deadline, or mid-school-pickup, or already three jobs behind for the day. The scam isn’t designed to fool you in calm conditions. It’s designed to catch you in the gap.
What the bait usually looks like:
A refund is waiting for you to “verify your details.” A tax debt that needs paying today or “legal action” follows. An ATO notice that arrives the same week your BAS is due, asking you to confirm your TFN by replying to the email. A QR code in an SMS that takes you somewhere that isn’t ato.gov.au.
The detail people miss is that scammers aren’t guessing about timing. EOFY, quarterly BAS, refund season. The campaigns ramp up in those windows because that’s when the inbox is loud, and attention is thin. SMS scams impersonating the ATO grew over 400% in a single financial year, and the volume hasn’t levelled off.
If a message asks for your MyGov sign-in, a payment in gift cards, or your TFN sent back over email, it’s not the ATO. None of those things happens in real ATO communication, and the rule doesn’t have exceptions.
The tax scams targeting Australians in 2026
These are the live ones. If you haven’t seen one of these yet this year, you probably will.
MyGov refund email scam
A myGov refund email scam is a phishing email that looks like it’s from myGov or the ATO, telling you a refund is waiting and asking you to log in through a link to claim it. The link doesn’t go to myGov. It goes to a copy.
Here’s what happens when you click it. The fake sign-in page is sometimes near-identical to the real one. Same fonts, same layout, same colours. You enter your username and password. The page then prompts you for your two-factor code, the one you’ve just received by SMS. You enter that too. Now the scammer has a full live session.
From there, it’s quick. They log into the real myGov, often within minutes. The first thing they change is the bank account linked to your tax refund. Sometimes they’ll also update the linked phone number so future security codes get sent to a device they control. By the time your real refund lodges, it’s heading to an account that isn’t yours, and recovering it depends on how fast your bank can move.
The reason this scam works isn’t that the email is technically sophisticated. It’s that the timing fits. People are expecting a refund email between July and October. The scammers know that, and they post into the gap.
This is still the most common scam by volume. Around 75% of all email scams reported to the ATO over a recent six-month period linked to a fake myGov sign-in page.
ATO text message with a link
Real ATO SMS messages no longer contain hyperlinks. The ATO removed hyperlinks from all outbound unsolicited SMS in 2024, specifically to make scams easier to spot. So if you get a text claiming to be from the ATO and there’s a link in it, it’s a scam. Full stop.
DocuSign email scam (October 2025)
A newer one worth flagging. Scammers send what looks like a real DocuSign email titled something like “Declaration and Final Release” or “Notice of Assessment,” implying the ATO is holding your refund until you sign. Click the Review Document button, and you land on a fake MyGov sign-in page.
The ATO doesn’t use DocuSign to finalise refunds. Ever.
Cryptocurrency email scam (February 2026)
The latest variation. Scammers’ email claiming you’re holding cryptocurrency in a “non-KYC decentralised wallet” and need to make an immediate declaration by phone. The ATO doesn’t email you demanding immediate disclosure of crypto holdings. If you get one of these, don’t call the number, don’t open the attachments, forward it to [email protected] and delete it.
Fake myID registration email
MyGovID was renamed MyID in November 2024. Scammers used the rebrand as a hook, sending emails claiming you need to “reconfirm your details” or “reactivate” your account. You don’t. If you already had myGovID, the change happened automatically. Any email asking you to set up a new myID is a scam.
ATO phone call threatening arrest
The ATO will never threaten you with arrest, demand you stay on the line, or ask you to pay a debt with gift cards or crypto. None of those things. If a caller does any of them, it’s not the ATO, regardless of what the caller ID says. Scammers can spoof real ATO and Australian numbers, so caller ID isn’t a verification tool.
A real ATO call shows as No Caller ID. That’s it.
WhatsApp ATO passport request scam
Reported across last year and still active. Scammers contact people via WhatsApp claiming to be from the ATO and ask for a copy of their passport, driver’s licence, or other ID. The ATO does not contact taxpayers via WhatsApp. Ever. They also don’t conduct any business with you through Facebook, Instagram, or X DMs. Only through ATO online services or your registered tax or BAS agent.
AI voice cloning scams
This is the one most businesses still aren’t ready for. Australians lost $25.8 million to AI voice cloning scams in just the first half of 2025, and the technology has only gotten cheaper and faster since. Security Brief
Here’s how it works. A scammer needs as little as three seconds of audio, pulled from a podcast, a video on your company website, or a voicemail greeting, to clone someone’s voice. Then they call your bookkeeper, your CFO, or whoever handles payments, using your cloned voice to authorise a wire transfer or request a “quick favour” with sensitive financial information. SQ Magazine
For small businesses, the most realistic version of this scam isn’t the ATO impersonation. It’s an “urgent” call from a director, owner, or supplier asking for a payment that bypasses your normal process. The voice sounds right. The timing always feels plausible. That’s the trap.
Small businesses are now the soft target
Most generic tax scam advice is written for individual taxpayers. The reality is that small businesses are increasingly the better target. Bigger transaction volumes, more people with payment authority, and BAS cycles that create predictable moments of distraction.
What we typically see in client inboxes:
- Fake BAS-related notices timed to land a few days before a quarterly deadline, when business owners are already chasing reconciliations
- TFN and ABN harvesting scams: fake services offering to “register your ABN fast” or “fix” a TFN issue, charging a fee and stealing the data
- Payroll-targeted phishing: emails impersonating the ATO about STP, PAYG, or super guarantee obligations, designed to get an admin or office manager to click without checking
- Supplier impersonation: not strictly a tax scam, but it rides the same anxiety. A fake invoice “from the ATO” or a fake email from a real supplier with new bank details, slipped into a busy AP inbox
The pattern is the same every time. Pressure plus impersonation, dropped into a moment when someone’s too busy to slow down.
How to verify an ATO phone call or message
The only reliable way to verify an ATO contact is to ignore the message and call the ATO directly on 1800 008 540. Don’t use the number in the email, don’t click the link, don’t reply.
Three quick checks before you act on anything:
- Real ATO emails come from addresses ending in ato.gov.au. Hover over the sender. Anything else is a scam.
- Real ATO SMS messages have no hyperlinks. Any link in an unsolicited ATO text is a scam.
- Real ATO calls show as No Caller ID. A visible Australian-looking number is a red flag, not a green one.
If something feels off and you’re a client, send it to us before doing anything. Half a minute of someone checking is cheaper than compromising myGov account.
What to do if you’ve already clicked
Phone the ATO immediately on 1800 008 540 if you’ve shared any sensitive information or made a payment. This is the priority. Everything else comes after.
Then, working through the list:
- Change your myGov password and enable MFA if it isn’t already on. If the scammer’s already logged in, this kicks them out.
- Contact your bank. If you’ve shared bank details or made a payment, your bank can sometimes stop or reverse the transaction, but only if you move quickly.
- Report the scam. Forward email scams to [email protected]. Take a screenshot of SMS or social media scams and email those in too. Report financial scams to Scamwatch via the ACCC.
- Watch for follow-up scams. This is the part most people ignore. Once your details are out, you become a target for “recovery” scams: fake services claiming they can get your money back for an upfront fee.
- If your TFN has been compromised, phone the ATO’s Client Identity Support Centre on 1800 467 033. They’ll add extra protection to your account and flag it for monitoring.
For small businesses, also rotate the credentials of anyone with access to your accounting software (Xero, MYOB, QuickBooks), update bank verification protocols, and tell your team. The same scam tends to make a second attempt within a few weeks.
If you’re a Melbourne small business and something’s landed in your inbox that doesn’t feel right, whether it’s a BAS notice, a refund email, or a request to “verify” your details, send it to us before you click anything. We see these constantly, and a quick check from someone who knows what real ATO communication looks like is the cheapest fraud protection you’ll ever get.
Contact us about your setup, or forward us anything suspicious.
Frequently asked questions
Does the ATO accept gift cards as payment?
No. The ATO doesn’t accept gift cards, iTunes vouchers, cryptocurrency, prepaid debit cards, or cash deposits to personal accounts. Anyone asking you to pay tax this way is a scammer. There are no exceptions to this.
What should I do if I gave my TFN to a scammer?
If you’ve shared your TFN with a scammer, phone the ATO’s Client Identity Support Centre on 1800 467 033 and tell them what happened. Do this first, before reporting anywhere else.
What they do once you’ve called: they put a security indicator on your tax record. In practice, this means anything sensitive that comes through your account, like a lodgement, a refund redirect, a change of address, or a new bank account, gets pulled out of the automated stream and reviewed by a person before it processes. It’s the closest thing the ATO has to a freeze.
A few things worth knowing about that call. You’ll need to confirm your identity, so have your TFN, date of birth, and a recent ATO document (notice of assessment, BAS, anything with a reference number) within reach. The line is for individuals and small businesses both, and the staff handle these calls all day. You’re not the first person to ring up panicked, and you won’t sound silly explaining what happened.
The flag isn’t permanent, but it stays on long enough to cover the period when scammers typically try to act on stolen details, which is the next few weeks. You can also report the broader incident to IDCARE on 1800 595 160. They’re the national identity and cyber support service, and they’ll help you work through which other accounts (bank, super, myGov, driver’s licence) need attention.
How do I recover my myGov account after a scam?
If you’ve lost access to your myGov account, go to my.gov.au/recover to start the account recovery process. If that doesn’t get you back in, call myGov support on 132 307. Recovery usually takes a single phone call once you can prove who you are.
Once you’re logged back in, the order matters. Change the password before you do anything else. That locks the scammer out of the live session if they’re still in there. Then check the bank account on file under your linked ATO services, because that’s the field they target first. If it’s been changed, change it back and tell the ATO directly on 1800 008 540 so any pending refund doesn’t go out to the wrong account.
After that, look at your linked services list. We’ve seen scammers add Centrelink, Medicare, or My Health Record links so they can siphon information from other government accounts, not just tax. Anything you don’t recognise, unlink it.
Turn on multi-factor authentication if you didn’t already have it on. This is the single biggest thing that stops it from happening a second time, and it takes about ninety seconds to set up. The myGov code generator app is the most reliable option. SMS codes can be intercepted in some scenarios, and the scammer who just got into your account already knows your phone number.
One last thing most people skip: tell whoever does your books or your tax. If a lodgement gets flagged or a refund is delayed in the next few weeks, they’ll know why and can chase it down faster than you can.
Can I trust an ATO phone call if the caller ID looks Australian?
No. Caller IDs can be spoofed easily. Real ATO calls display as No Caller ID, not as a visible number. If a caller claims to be from the ATO, hang up and call 1800 008 540 to verify. A real ATO officer will never object to you calling back.
What’s the ATO scam reporting phone number?
1800 008 540 for general scam reporting and verification. 1800 467 033 if your TFN has been compromised. Email scams go to [email protected].
Are tax scams more common at EOFY?
Yes, significantly. Scammers time their campaigns to coincide with EOFY (May–June), tax return season (July–October), and quarterly BAS deadlines. The pattern is so predictable that we plan client communications around it. Expect the volume to lift sharply from late May.
