If you’ve been following our emails and newsletters, you’ll know we regularly remind clients to stay alert to scams and fraud — especially around tax time. This season, we’re seeing a spike in scams impersonating the Australian Taxation Office (ATO), particularly fake refund emails, and it’s getting plenty of media attention.
We wanted to take a moment to share some of the scams we’ve encountered recently, along with the increasing sophistication we’re seeing. No doubt many of you have your own stories — and we’d love to hear them.
What we’re seeing
1. ATO communication scams
The ATO never sends links or attachments in individual communications. If it’s about your personal tax or refund, you’ll receive a message prompting you to log in to your myGov account — and that’s it.
For businesses, ATO emails may contain more detail, but still no attachments or clickable links.
Your best defence is to always access your myGov account directly via your browser — never through a link in an email or text. Or just give us a call — we’re happy to check for you. We get one or two emails a month from clients asking us to verify ATO messages. Some are legitimate, some aren’t.
2. Payment redirection scams
These are becoming more sophisticated and harder to detect. In the past year, we’ve seen two credible cases where scammers intercepted business emails and changed bank details, redirecting payments to fraudulent accounts.
- In one case, scammers sent updated bank details to all customers and set up email redirects so replies went to them. Two payments were made before a third customer called to confirm the changes — and uncovered the scam.
- In another, scammers intercepted supplier invoices, altered the bank details, and resent them from a fake email address. The email looked identical to the original, except the payment links were removed to force a manual transfer.
3. Spoofed calls and voice cloning
Five years ago, a client received a call from what appeared to be our office number. The caller claimed that our director was on leave and that an urgent tax debt needed to be paid. The number was spoofed, and the scammer even made follow-up calls pretending to be the ATO. The client, unfortunately, paid using gift cards before realising something was wrong and called us directly on our business number — where the director answered, as he was in the office all day.
That was five years ago. Today, scammers are using AI tools to clone voices. With just a few seconds of audio — from a voicemail, social media video, or webinar — they can generate convincing phone calls that sound like your accountant, business partner, or even your spouse.
We’re also seeing more complex phishing emails. Scammers create fake email threads with company directors (whose names are public) and forward to you requesting payment. As more personal data is leaked and AI tools scrape the web, these scams will only become more convincing.
Our top 5 defences against tax-time scams
1. Know your team
Having a trusted accountant means you’ve got a second set of eyes on any ATO or tax-related communication. We often spot red flags instantly because we know the process, the timelines, and the language the ATO uses. If it’s genuine, we’ll handle it. If it’s a scam, we’ll help you report it.
We often tell clients: if the ATO calls, just say, “Please speak to my accountant.” The ATO has our contact details on file and should be contacting us first — leaving you to focus on your business.
2. Verify through independent channels
Never trust the contact details in a suspicious message. If you get a call, hang up and call back using a number you already know or the ATO’s official number. If you get an email, log in to myGov or your accounting software directly — don’t click links.
And always verify any changes to bank details using a second method before making a payment.
3. Don’t act on urgency without proof
The ATO doesn’t issue surprise deadlines. If you’re unsure, reach out to us. We’ll confirm what’s due and when — and help you avoid unnecessary stress.
4. Enable strong security
Use multi-factor authentication (MFA) wherever possible — especially for email, myGov, and banking logins. MFA can prevent many email takeover attempts. If you’re still using SMS codes, consider switching to an authenticator app for stronger protection.
5. Don’t share personal info over email
Be cautious about who you share your Tax File Number (TFN) or ID documents with. Always use secure, password-protected channels when sending sensitive information.
So during this tax time, keep an eye out for opportunistic emails — and if something doesn’t feel right, don’t hesitate to reach out to us.