Imagine accessing your myGov account to discover that your activity statements from the previous year have been altered, resulting in the issuance of $100,000 in GST credits. You did not request or receive this refund. So what’s happening?

This scenario is part of a growing trend in tax fraud where myGov accounts are exploited for personal information. Scammers are changing bank account details and using the available data to claim substantial fraudulent refunds. In many cases, it seems like it’s you who’s behind these actions—or at least, that’s how it appears. The worst part? You may have unintentionally granted the scammers access to your account.

It’s not just activity statements that are targeted. Any myGov-linked service capable of issuing refunds or payments is at risk. Fraudsters are taking advantage of amendment periods in tax laws to manipulate data, securing illegitimate refunds on personal income tax, goods, and services tax (GST), and variations to pay as you go (PAYG) installments. In some instances, these schemes reflect an advanced understanding of the Australian tax and social security systems.

Once scammers gain access to your myGov account, they can cause considerable harm potentially.

How does this happen, and why is it so widespread?

Unfortunately, the weakest link is often human behaviour. Most scams begin with emails or SMS messages, which mimic the appearance of legitimate communications. Among the most common tactics are:

1. 1. Fake warnings about attempted breaches of your account, prompt you to click a link and verify your details.
   2. Baiting users with a false tax refund, requiring them to click a link to confirm and claim it.
   3. Impersonating the Australian Taxation Office (ATO) or other agencies, sending messages that include a link to a “new message.”

In fact, nearly 75% of all email scams reported to the ATO as of March 2024 were linked to a fake myGov sign-in page.

How to Spot a Fake

The first red flag often appears as an alert about activity on your myGov account. However, ironically, these messages may come from the very scammers who initially accessed your account. Nonetheless, there are several ways to detect a scam:

• The ATO, Centrelink, and myGov will never include hyperlinks in their messages. If you receive a message with a link, it’s fraudulent.
• The ATO does not use QR codes for account access.
• The ATO will never ask for your tax file number, bank account details, or myGov login information via social media. Some scammers create fake social media profiles impersonating the ATO, responding to user queries by asking for sensitive details.
• You will never receive pre-recorded messages about outstanding tax debt from the ATO.
• The ATO will not cancel your tax file number (TFN) or demand money transfers to a “safe” account due to alleged criminal activity involving your TFN.
• The ATO will not initiate a conference call with you, your tax agent, and a law enforcement officer. Scammers may try to arrange such calls to manipulate you, but it’s important to hang up and verify the situation directly with your tax agent.
• Lastly, the ATO will never ask you to reconfirm your details due to security updates on myGov. Always access your myGov account directly by logging in, rather than clicking on links from suspicious messages.

As a rule of thumb, never log into your myGov account on public Wi-Fi networks.

What to Do if You’ve Been Scammed

If you unintentionally downloaded the fake myGov app, gave your information to a scammer, or clicked on a dubious link, get in touch with the Services Australia Scams and Identity Theft Helpdesk at 1800 941 126. You may also get help with fraud from this place. When it comes to tax schemes, it is essential to confirm any correspondence before acting upon it. If you have already replied, call the ATO at 1800 008 540 to confirm or report the scam.

If you suspect that you have been targeted by a tax fraud scam, contact our consultants at Bates Cosgrave immediately.