The October 31st tax deadline is an important date for taxpayers, but it also marks the beginning of a high-risk period for scams. Cybercriminals are fully aware of this deadline and strategically target taxpayers in the weeks and months immediately following it.
“Scammers rely on the anxiety of individuals who may have genuinely missed the submission date, or who are unsure of their lodgement status, using the fear of penalties to pressure them into taking compromised action. During this busy tax period, scammers may use fake emails, calls, or text messages purporting to be from the Australian Tax Office (ATO), usually promising an unexpected refund, or even a threat to pay for those who may have missed the deadline,” COBA’s Head of Financial Crimes and Cyber Resilience Martin Latimer explained.
With millions looking to file their taxes before the fast-approaching 31 October deadline, Australians are reminded to remain alert to fake communications about their tax return.
So, before you click that unknown link or unknowingly share any personal details with a scammer, COBA’s Financial Crimes and Cyber Resilience team have put together some easy tips to protect yourself this tax season.
What do ATO impersonation scams look like?
The ATO itself has warned consumers to be wary of scammers pretending be from the ‘ATO’, ‘myGov’, or other government agencies on occasion, falsely telling people their taxable income has been recalculated, and that they are due to receive compensation. To claim the payment, recipients are asked to share personal details such as their tax file number, driver’s licence, Medicare information or payslips.
“These fake emails may seem incredibly authentic, perhaps coming through around the time you lodged your return. They often link to websites where you can ‘verify details’ and ‘claim payments’. In some cases, they may even include warnings that the refund will be ‘cancelled’ if your details aren’t verified within 24 hours,” Latimer explained.
For those who may have missed the tax deadline, emails or texts may include QR codes or hyperlinks and threats to make a payment as soon as possible.
Example of a recent scam message, impersonating ‘Services Australia’.
Red flags of an impersonation scam
An email, text, or call purporting to be from the ATO is likely a scam if you notice any of these indicators:
- The communications from the ‘ATO’ contain a link for you to click on or a QR code to scan: Scammers use these tactics, like creating fake sign-in pages that look legitimate, in order to steal credentials including usernames and passwords. The ATO will never send you unsolicited emails or SMS with a link or a QR code to log in to online services, including to access any refund.
- The texts or emails contain a link to download files or attachments: This is used by scammers to install malicious software on your devices, including access to any personal identifying or financial information.
- The phone calls pretending to be from the ATO shows phone numbers in the caller ID or call log: Calls from the ATO do not show a number. Instead, they will show up as No Caller ID.
- You’re asked to pay a fee to receive a tax refund: Scammers may ask you to pay a fee using your credit card to then steal your card details. The ATO never asks for a fee in order to receive your refund.
How to Stop, Check and Protect yourself
Scammers prey on weak security and count on you being distracted, especially when many Australians will no doubt be looking forward to potential refunds or are uncertain if they made the tax deadline.
STOP
Don’t share any personal information like your bank account details, Tax File Number (TFN) or myGov sign-in details with anyone you don’t trust. Only give it to organisations or people who have a legitimate need for it, like your bank, tax agent, or current employer.
Scammers also tend to create a sense of urgency to pressure you. Take your time and don’t rush to act to ‘access your refund’ or ‘pay your tax’ through suspicious links. Always access online services like the ATO by directly typing the URL into a browser.
CHECK
Look at the phone number or the email address that’s pretending to be from the ATO. Does it seem legitimate? If you have linked your ATO to your myGov account, you will get notifications from myGov about any new messages, and they will not include links.
Sometimes, the ATO may SMS or email to ask you to contact them, but they will never ask you for personal identifying information through these channels.
PROTECT
If you’re ever unsure whether an SMS or email is really from the ATO, don’t reply or click on any links or attachments. Instead, contact the ATO on 1800 008 540 to check.
If you suspect an impersonation scam, terminate contact with the suspected scammer immediately. Avoid sending any money or providing any personal information, and report it to Scamwatch and ReportCyber.
In the event you have been scammed, report the scam via the above channels, and contact your bank or card provider immediately to stop further transactions and explore recovery options.
Customer-owned banks: Here to protect you
Customer-owned banks are dedicated to safeguarding their customers from scams and frauds and have joined forces with the wider industry to establish the Scam-Safe Accord. This initiative represents a united front against scammers and reinforces the banking sector’s determination to strengthen consumer protection. Find out more about the Scam-Safe Accord here.