In one line: tax time 2026 has brought a fresh wave of fake ATO and myGov messages, and the safest move is to never click a link in one — go straight to the ATO app or website instead.
What’s Actually Happening
On 26 June 2026, Scamwatch and the Australian Taxation Office issued a fresh warning about a wave of scam emails, texts and phone calls impersonating the ATO and myGov. It’s timed to land right as tax time ramps up, when people genuinely are expecting contact from the tax office — which is exactly what makes it work.
The messages use official-looking logos and formal ATO-style language, and they lean hard on urgency: a refund supposedly waiting, a debt that needs “urgent” action, or a request to “verify” your myGov login before access is cut off. Click through, and you land on a fake site built to harvest your myGov sign-in details or banking information. Scamwatch notes this one targets everyone — even people who aren’t required to lodge a tax return at all.
Warning Signs to Look For
- An unexpected message with a link claiming to be from the ATO — the real ATO will never text or email you a link to sign into myGov.
- A strong sense of urgency or pressure to act immediately.
- Sender details that don’t end in .gov.au.
- Any request for your personal, banking, or myGov login details by text, email or phone.
- Mention of DocuSign to “finalise” a refund — the ATO doesn’t use it for this.
If This Is Your Own Tax Return
If you get a text or email about a refund or an outstanding debt, don’t click anything in it. Instead:
- Open the ATO app or type ato.gov.au directly into your browser — never follow a link from the message itself.
- Log into myGov separately to check for any genuine correspondence.
- If you’re still not sure, call the ATO directly on 1800 008 540 and ask them to confirm whether the contact was real.
If You Run a Small Business
Business owners have extra exposure at tax time — BAS statements, GST, PAYG and single touch payroll all mean more legitimate ATO contact than most individuals get, which scammers rely on to blend in. A few extra precautions worth taking:
- Brief anyone who handles invoices or accounts on what real ATO contact looks like, and what it never looks like.
- Never action an “urgent” payment request from a text or email alone — verify by phone, using a number you already have on file, not one supplied in the message.
- Turn on multi-factor authentication on your business portal and myGovID login wherever it’s offered, and avoid leaving these logged in on shared computers.
Why These Scams Keep Getting Better
Modern scam messages don’t look like the clumsy, typo-riddled emails of a few years ago. Scammers increasingly use AI tools to write convincing, error-free copy and to clone official branding almost exactly, which is part of why Scamwatch keeps pushing the same core advice rather than “look for spelling mistakes”: don’t judge a message by how polished it looks, judge it by what it’s asking you to do.
If You’ve Already Clicked
Act quickly rather than sitting on it. Call the ATO on 1800 008 540 to help lock down your account, change any passwords you may have shared, and work through Scamwatch’s guide on what to do if you’ve been scammed. If your identity details were exposed, IDCARE (1800 595 160) offers free, confidential support for Australians affected by identity theft.
Multi-factor authentication is one of the simplest things you can turn on today to make an account far harder to break into even if your password does leak — we cover the basics in our earlier piece on why Australians should use multifactor authentication.
Get in Touch
If a message you’ve received doesn’t sit right, or you’d like a hand tightening up your account security before tax time gets busy, get in touch with WizzIT — we’re happy to take a look.