5 tax-time scams to avoid

There are common scams to watch out for at tax time, from messages purporting to be from the ATO to tax refund scams and fraudulent online stores.
Typing card details into unfamiliar websites can increase the risk of your information being captured by scammers.
To better protect your money during EOFY, slow down when responding to emails and texts, and confirm their legitimacy via official channels.

1. Fake messages from the ATO

You may already be familiar with those all-too-common texts from someone purporting to be the ATO, urging you to click a link to access your myGov inbox. These scams run year-round but tax time can see our vigilance slip since we might be expecting contact from the actual ATO.

The best way to avoid this scam is to only check your myGov account by directly logging in through the official ATO website or app. “Never give identity documents or personal details – like your bank details or tax file number – over email or text,” says Kenny Phua, senior lecturer of finance at the UTS Business School. “myGov will never make such requests.”

2. Fake refunds

Everyone wants money back at tax time, which is why scammers have perfected the art of the enticing refund email. These messages often promise a surprise tax refund or bonus once you confirm your details by clicking a link. Spoiler: the link will usually lead to a fake site designed to capture your personal or banking information.

In some cases, scammers may even try to redirect your real tax refund by changing the bank account details linked to your tax return so the money ends up in their account.

Even if an email has correct details, remember that scams are increasingly personalised. “The ATO does not send emails or texts asking you to claim tax refunds or provide personal information,” says Phua. When in doubt, always directly check the official ATO website or app.

A safer online checkout

Typing card details into unfamiliar websites can increase the risk of your information being captured by scammers. With Click to Pay, CommBank customers with an eligible Mastercard can complete purchases without sharing their card details at checkout, adding an extra layer of protection at participating online stores.

3. Fake alerts

If you use accounting software to manage your business or finances, EOFY is when you’re expecting reminders and updates from those platforms. The problem? Not all alerts are legit. Watch out for messages claiming your account has been suspended, requires verification or that your payment details need updating.

The initial panic these messages create – and the rush to fix the problem – is exactly how scammers take advantage. By convincing people to click false links and log in, they can gain access to the account and change key details, such as the bank account linked to your tax return. In some cases, this means your refund could be redirected to the scammer without you realising.

If you receive an unexpected alert, don’t click the link. Instead, log in through the official website or app to check the notification is genuine.

4. Fake sales

Everyone loves a good EOFY sale. However, be wary of who you shop with. There’s been a spike in fake online stores in Australia over the past year, where scammers design convincing fashion, beauty and electronics websites, using ads on social media to promote sales. Shoppers then hand over their card details... but the items never arrive.

One red flag to watch out for is when prices seem too good to be true. When in doubt, gather information on the shop to make sure it’s real. “Look up their Australian Business Number [ABN] if they claim to be a local business,” says Phua. “Do they have a physical address, email address and/or phone number?” It’s also worth googling the brand history and checking to see if it’s been associated with any scams.

Real-life lessons

When Helen was scanning her social media feed one evening, she came across a sale she couldn’t ignore. The ad was from a fashion brand she’d never heard of and featured a woman wearing a beautiful dress. “The brand looked really legitimate,” she says. “The style of the ad wasn’t unusual – it looked like any other fashion brand I’d seen online. I assumed I’d just never heard of this one.”

The best part? The dress was 50 per cent off – part of a site-wide sale for EOFY. “It was a big discount but lots of brands were doing big sales at the time,” she explains. Unfortunately, the dress never arrived. After two weeks, Helen emailed the brand and heard nothing. “I contacted my bank and, in this case, they were able to reverse the charge. I also reported the website to Scamwatch.”

5. Fake invoices

If you run a business, are a sole trader or pay the accounts, be on the lookout for fake invoices or requests from clients for updated payment details. These scams can be so convincing, the email will look like it’s coming from someone you regularly work with. If you’re finalising your books in a hurry, it can be easy to click a fraudulent link or attachment.

If you weren’t expecting an invoice or a supplier is asking you to update their bank details, give them a call on a verified number (not what’s written on the invoice) to confirm.

Stop. Check. Reject.

To better protect your money during EOFY, slow down when responding to emails and texts, confirm their legitimacy via official channels before deleting and blocking any that seem suspicious.

Scam help

If you think you’ve been scammed, CommBank’s virtual assistant, Ceba, can help you quickly lock your card in the CommBank app or NetBank. Ceba can also connect you with a specialist in the app.

Visit CommBank Safe for more information on how to help protect yourself from scams.

Published: 18 May 2026