Client data security and AI scams for tax and BAS practices.
Fourteen lessons on client data security and AI-assisted scams for registered tax and BAS agents and their practice staff, and a free 25-question practice test. About 2 hours of course time, on your phone or computer, with no account. Pass the test and download a certificate of completion with a QR check and a ready entry for your CPE log for A$59. You pay only after you pass.
- Pay only if you pass
- Retake the test as often as you like
- 2027 edition · no account, no subscription
Try a question from the test
Lesson 4 · Fake ATO and myGov contact: what the ATO will and will not do
A caller shows an ATO number and threatens arrest unless you pay by gift cards. What do you do?
Show the answer
Right answer: C, Hang up, then check using the ATO app's Verify call feature or a number you found yourself. Scam calls can use real ATO caller IDs. If you cannot verify the call, hang up. [S15] Read that lesson
Fourteen lessons, about 2 hours.
Each part answers a question from the working day and ends with a summary. Then the test: 25 questions at random, and 20 right (80%) is a pass.
- What the TPB asks of your CPE, and where this course fitsThe hours, what counts, what the TPB does not do, and what to write in your CPE log for a self-paced course.
- Client information: your confidentiality and record dutiesCode item 6, who counts as a third party, accidental disclosure, the 2024 quality and record rules, and tax file numbers.
- Who is really your client? Identity checks and fraudulent lodgmentsHow criminals use agents, the TPB's identity checks, why client-to-agent linking is not enough, and what to do when a refund has gone.
- Fake ATO and myGov contact: what the ATO will and will not doThe rules the ATO sets for itself, how fake calls and emails try to get round them, and the checks that always work.
- Payment and refund redirectionHow a bank-detail change becomes a loss, the call-back rule, and a payment process that two people must complete.
- Payment redirection and business email compromisePayment redirection is when a criminal gets a business to pay money into the wrong bank account.
- Fake invoices and supplier impersonationScamwatch says fake supplier emails often copy the real supplier's logo and message format, and may link to convincing copies of the real homepage.
- AI-written phishing and impersonation by email, SMS and chatPhishing is when a scammer pretends to be someone you trust to get your money, passwords or details.
- Verification habits that stop most of these scamsThis is the habit that appears most often in the sources behind this course, in one form or another.
- Account takeover, passwords and MFA fatigueAccount compromise means someone gets into your email, bank or other online account without your permission.
- Voice clones and deepfake video calls: an emerging riskVoice cloning and deepfake video are real, and the official bodies warn about them, but they are still a small part of the picture.
- When it happens: the first hourIf you think you have sent money or bank details to a scammer, contact your bank or financial institution immediately.
- A data-security plan for a small practiceAccounts, access, devices, backups, suppliers and staff: the practical controls the ATO and ACSC name, in the order to do them.
- Data breach: what to do and when you must tell peopleContaining a breach, the Notifiable Data Breaches test, the timing, and your other duties to the ATO, the TPB and clients.
Inside: 14 lessons, 117 parts, 126 practice questions, each explained, and 221 facts, each linked to its source.
How the 2 hours are counted: reading time at 200 words a minute (67 minutes, measured from the lesson text), 1 minute for each of the 42 review questions and for each of the 25 test questions, rounded down to the half hour.
How it fits TPB CPE rules.
The TPB sets the rules, not us. This is what it says, and what we do about it.
| Question | What the TPB says | What this course does |
|---|---|---|
| Does the TPB approve CPE providers? [S3] [S2] | No. It does not prescribe topics or approve providers. | We do not claim approval. You judge relevance. |
| Can cyber security training count? [S2] | Yes, the TPB says it will allow it. | This course is cyber security awareness for tax and BAS practices. |
| What about a self-paced course? [S2] | The TPB lists computer or internet-assisted courses. For self-paced activity your record should show relevance. | Page 3 of the certificate gives a relevance line to edit. |
| Is there a cap on reading? [S2] | No more than 25% of CPE over the period should be reading. | The certificate shows how many minutes are reading, so you can classify it yourself. |
| Is a certificate evidence? [S4] | Evidence may include a certificate of completion. | You get one, with a QR check. |
Your certificate, as soon as you pass.
Type your name, pay and download it straight away as a PDF: the certificate, a training record and a ready entry for your CPE log.
Certificate of completion
Client data security and AI scams for tax and BAS practices (2027 edition)
This is to certify that
Sample Name
has completed the self-paced online course from Aptia Skills and passed its final test with 23 out of 25 right (pass mark 20).
- Registered as
- Registered tax agent
- TPB registration number (partly hidden)
- *****678
- Course hours (rounded down)
- 2 hours
- Study time
- 134 min
- What the TPB asks of your CPE, and where this course fits
- Client information: your confidentiality and record duties
- Who is really your client? Identity checks and fraudulent lodgments
- Fake ATO and myGov contact: what the ATO will and will not do
- Payment and refund redirection
- Payment redirection and business email compromise
- Fake invoices and supplier impersonation
- AI-written phishing and impersonation by email, SMS and chat
- Verification habits that stop most of these scams
- Account takeover, passwords and MFA fatigue
- Voice clones and deepfake video calls: an emerging risk
- When it happens: the first hour
- A data-security plan for a small practice
- Data breach: what to do and when you must tell people
The TPB does not approve CPE providers. You decide whether this course is relevant to the services you provide, and you keep your own CPE records.
- Date issued
- 2 November 2026
- Issued and signed by
- Aptia Skills · Opus Vault
What your certificate includes
- A PDF certificate of completion (A4) with a unique number. Download it straight away. Your name, how you are registered, and your TPB registration number if you choose to give it (partly hidden).
- A training record. The fourteen lessons with the reading time of each and the kinds of source they draw on.
- A ready entry for your CPE log. The activity, provider, date, 2 hours counted and how, and a line on why it is relevant. You edit it.
- A QR check code. Anyone can check in seconds that it is genuine and still valid.
- A purchase receipt. With the price and what you agreed to before paying.
A$59Australian dollars · one payment
You pay only after you pass. By card, Apple Pay or Google Pay. No account, no subscription. If we get something wrong, we fix it or refund you.
Take the test and get itTraining a team? Coming soon: one link per person and one invoice. Email hello@aptiaskills.com.
Quick answers for tax and BAS practices.
Short pages, answer first, each with its sources.
The rules, plainly.
We are a private training provider, not a public body. Tap each answer to see its source.
How many CPE hours do tax and BAS agents need?Tax agents need 20 hours a year and 120 over 3 years. BAS agents need 20 hours a year and 90 over 3 years.
- Registered tax agents must complete at least 20 hours of CPE each year and 120 hours over a 3-year CPE period. Registered BAS agents must complete 20 hours a year and 90 hours over 3 years. [S3]
Does the TPB approve CPE providers or courses?No. It does not prescribe topics or approve providers. You judge relevance to the services you provide.
Does cyber security training count as CPE?Yes. The TPB says it will allow cyber security awareness training to count.
- The TPB lets you count cyber security awareness training towards your CPE, because it helps protect your practice from a cyber-attack. [S2]
Does a self-paced online course count?The TPB lists computer or internet-assisted courses. For self-paced activity your record should show its relevance, and reading is capped.
- The TPB lists computer or internet-assisted courses among the CPE activities it considers appropriate. [S2]
- For unstructured activity, such as reading or self-paced computer aided instruction, the TPB says the record should show how the activity is relevant to the services you provide. [S4]
- No more than 25% of CPE over the CPE period should come from technical or professional reading. You must also keep a log of the activities. [S2]
Can a certificate of completion be my evidence?The TPB says evidence of CPE may include a certificate of completion. Keep your records for 5 years from the end of the CPE period.
When can I share client information with a third party?Only with the client's permission or when you have a legal duty to. Cloud storage and outsourcing providers are third parties.
- You must not disclose information about a client's (or a former client's) affairs to a third party unless the client gave permission or you have a legal duty to disclose it. This is Code item 6. [S6] [S10]
- A third party includes entities you outsource work to and cloud storage providers. Outsourcing and cloud storage do not change your duty under Code item 6 to keep client information confidential. [S6]
Do I have to report a data breach?If it is an eligible data breach under the Notifiable Data Breaches scheme, yes. TFN recipients are covered for TFN information.
- A breach is an eligible data breach when there is unauthorised access or disclosure (or loss), it is likely to cause serious harm to someone the information is about, and remedial action has not prevented that likely harm. [S20]
- Tax practitioners who hold tax file number information are covered by the Notifiable Data Breaches scheme for breaches that involve TFN information. [S23] [S35]