Open season for ATO and myGov impersonation scammers
Tax time can turn an out-of-the-blue message into a believable one.
Around the country, people and businesses are logging into their ATO and myGov accounts to lodge their returns, so a text or email that looks like it’s from the ATO or myGov often feels legitimate. That’s the opening scammers wait for.
CommBank research, conducted in June 2026, has found almost two thirds of research participants (62%) are exposed to a scam at least once a week*.
It’s playing out right now, said Shannon Brown, CommBank’s Fraud and Scams Industry, Intelligence and Disruption Senior Manager. “We’re seeing Australians being targeted by SMSs, phone calls, and emails where scammers are impersonating the ATO or myGov,” she said.
The messages usually claim you have a refund waiting, owe money, or need to update your details, with a link to click.
“Once someone clicks on a link, they are taken to a website that looks a lot like the legitimate ATO website, but it is a fake website that’s impersonating it,” Brown explained. The copycat sites copy the ATO’s branding and layout, and capture any information you type in.
It isn't only individuals being impacted. Many small businesses are hands-on with their tax admin too, and scammers hit them with similar messages, but the potential damage can also be substantial.
“You've got people who are responsible for the ownership of the business, people who are responsible for the finance, people who are responsible for the administrative tasks," Brown said. The more people who deal with money and do the admin for a business, the more chances there are for someone to click a dangerous link and be tricked into handing over information to a scammer or making a scam payment.
While scams impersonating the ATO or myGov can be received at any time of year, they may ramp up as the 31 October lodgment deadline that applies to most Australians draws closer, according to Brown.
Being smart isn’t a shield
The comforting belief that scams only catch out other people is exactly what helps make them work. Most scams succeed because they appear legitimate, the research found, rather than because someone missed an obvious warning sign.
Caitlin Court, CommBank’s Senior Manager, Behavioural Science, points to a mental shortcut called authority bias.
“Our brains are wired to trust and to follow something that we perceive to be an authority figure,” she said. A message that looks official, arriving at the exact time of year you would expect to hear from the ATO, doesn’t appear to be wrong.
That is why intelligence offers less protection than people assume. In Court’s view, your situation matters more than your savviness. “Your current life circumstances are actually more relevant than your intelligence,” she said, with stress levels and distraction often playing a part.
“About a third of research participants who were scammed were actually suspicious that it was a scam, but they went ahead anyway,” Court said. They were more likely to say they felt rushed at the time*.
A new safeguard
There is a fresh line of defence in place for this tax season. On 1 July 2026, the Sender ID Register was introduced, which requires businesses to register their name (or names) with the Australian Communications and Media Authority. A registered name of the business will appear at the top of the text messages they send.
Previously, scammers could drop a fake message into a genuine message thread by faking the sender’s name. Now a text from a sender that has not been registered should be flagged as “Unverified.”
Stop. Check. Reject.
For anyone asked for any personal information or payment, our advice is to always stop, check and reject – even if it looks or sounds legitimate.
Stop interacting, don’t click on a link, don’t hand over information and don’t make a payment.
Check by going to the official source yourself.
Reject by deleting it.
The golden rule is to never use the link or the phone number in the message itself. If something looks like it’s from the ATO or myGov, go to the ATO or myGov official website or app. If you want to call to confirm, use an official number for the ATO that you have sourced independently (such as from the ATO’s official website or app), not one supplied in a message or phone call.
One of the best defences is talking about it
One of the most effective defences has nothing to do with technology. Being scammed still carries a stigma, which keeps people quiet and keeps everyone around them in the dark.
“Scams can happen to anyone and we need to keep having conversations about them,” Brown said. “Go home and talk to your family, your friends, your housemates, your partner, whoever you’re with tonight, and tell them about what you’ve learned today.”
Find out more about the latest scams.
*About the research
Research was conducted by CommBank's Behavioural Science Centre of Excellence across two studies in January and June 2026 involving 5,557 participants in total.
The research combined nationally representative surveys with behavioural experiments to examine how Australians identify and respond to scams, including the factors that influence decision-making in the moment and the level of exposure to scams.
