ATO and tax-time scams to watch out for in 2026

As the end of financial year (EOFY) approaches, Australians are once again being urged to stay alert to a sharp rise in tax-related scams. Fraudsters often ramp up their activity during tax time, using the Australian Taxation Office (ATO), myGov and other government agencies as trusted fronts to trick people into handing over money or sensitive personal information.

ATO scam reporting figures highlight how persistent the threat is. In April 2026, there were 1,246 reports of ATO impersonation scams¹, while in July 2025 – peak tax time – reports surged to around 7,500². 

Most of these scams (98.5%) arrive via email, but they also come through SMS, phone calls, social media and even fake websites.

Scammers impersonate the ATO, myGov and other government departments because people are already expecting to hear from them. Generally, their goal is to pressure you into:

• making a payment to a scammer.
• sharing personal details (like your TFN, bank details or myGov login).
• clicking malicious links or downloading attachments.
• installing malware that can be used to steal information later.

Once they have your details, criminals can commit refund fraud, access your myGov account, or even try to steal your super.

While scams evolve each year, recent scam types include:

• Fake payment demands
  Scammers impersonate the ATO and claim you owe an urgent tax debt. You may receive a call or message threatening penalties or legal action unless you pay immediately.
  
  A recent example involves scammers claiming the recipient holds crypto in a “non-KYC decentralised wallet” and must urgently declare it to avoid prosecution – prompting them to call a fake number.
  
  
• Rebate scams
  You’re told you’re entitled to a tax rebate or compensation. To ‘process’ it, you’re asked to provide personal details so the money can be rebated to your account.
  
  Instead, your personal details will be used to try to steal money from your account.
  
  
• Tax refund phishing scams
  These typically involve emails or SMS messages prompting you to click a link and complete a form. The form is designed to capture sensitive information such as your TFN, bank details or passwords.
  
  A recent example includes an email inviting you to review a form using DocuSign – but when you click on the link, you’re taken to a fake version of the myGov website designed to capture your personal details. 
  
  
• Tax hacks’ that are actually money-making schemes
  Around EOFY, scammers promote ‘tax hacks’ or guaranteed refund strategies that sound too good to be true and are designed to part you from your money.
  
  Previous versions have included illegal tax avoidance operations, or high-risk investments marketed through social media, sometimes by ‘fin-fluencers’.
  
  
• Fake service provision
  Simple services, such as applying for a tax file number (TFN), are free through official channels. 
  Scammers may pose as service providers but in reality, they are redirecting you to fake websites designed to steal your money or personal information.

Scammers may pose as service providers but in reality, they are redirecting you to fake websites designed to steal your money or personal information.

Report it: If you think you may be being scammed, report it by calling the ATO directly on 1800 008 540 or emailing screenshots to reportscams@ato.gov.au.

Visit our Staying safe online hub for more information. 

While the ATO is a commonly impersonated government department, it’s far from the only one. Other subjects of impersonation scams include myGov, Services Australia, Centrelink or Medicare – as well as financial services institutions and other brands you may know or have a relationship with.

For example, scammers commonly send messages saying things like:

“You have a new message in your myGov inbox — click here to view.”

These links typically lead to a fake login page designed to capture your credentials, giving scammers access to your account and financial information.

They may also create fake social media accounts with messages containing links that go to fake websites designed to steal your information.

Scammers are increasingly using generative AI to create convincing emails, SMS messages and websites. These messages often include:

• official logos and branding.
• realistic-sounding language and fewer spelling errors.
• references to current events or tax changes.

This makes scams much harder to spot than in the past.

When it comes to tax and financial information, just like any other type of information, AI can make mistakes.

But now, there is a growing risk of AI ‘recommendation poisoning’ and online search manipulation. 

This may involve fraudsters:

• embedding hidden instructions in AI tools.
• seeding AI chat tools with biased or malicious responses.
• manipulating search results so that harmful content ranks highly.

In some cases, users are tricked into following step-by-step instructions that install malware – without any obvious warning signs.

Despite their sophistication, most scams share common warning signs, including:

• urgent or threatening language – such as ‘act now’ or ‘avoid penalties’.
• requests for personal or financial information.
• requests to click on links, use QR codes or open attachments.
• instructions to pay money quickly, sometimes via unusual methods.
• contact details that don’t match official sources.

Generally, if something feels off, it probably is.

A few simple habits can go a long way to protecting yourself online:

The ATO and myGov will never:

• ask for personal details via unsolicited email, SMS or social media.
• send links to log in to their online services.
• use DocuSign for tax refunds.
• demand immediate payment or threaten arrest via email or SMS.
• ask you to disclose cryptocurrency holdings via email.
• send QR codes for login.

If you receive a message claiming to be from the ATO, myGov or other government agencies that does any of the above, treat it as a scam: report it, don’t engage with it, and delete it.

Even if an email or a call seems real, verify it using official channels – not contact details that were provided to you – before you act.

Always access services by typing official URLs into your browser and never use contact details sent to you.

• ato.gov.au
• my.gov.au

The ATO now offers an app that provides a secure way to manage your tax affairs, with real-time alerts if there is activity on your account, and the ability to lock it if needed.

The app also includes a ‘verify call’ feature that allows you to confirm in real time whether a call is genuine.

When it comes to tax information and financial advice, only rely on trusted sources, avoid sharing personal data with AI tools, and question any “too good to be true” tax strategies.

And always verify information with the ATO or a tax or super professional before acting on it.

Remember: Stop. Check. Protect

Always pause and check first when it comes to your super and investments.

Scammers sometimes pose as trusted organisations and may contact customers unexpectedly, asking them to act quickly or share personal details.

A simple way to protect yourself is to use official online services only.

Always check your account directly with us If you receive an unexpected call, email or message about your account. Don’t use the contact details provided. Instead, pause and log in directly.

If you haven’t logged in for a while – or ever – it takes about a minute to get going. You don’t need anything.

Simply go to FirstNet online or the CFS app where you can retrieve your details, be verified, and log in. Go to cfs.com.au/online-access for more.