What does the ATO say it will never do?
It will never send unsolicited messages containing hyperlinks or QR codes, and never ask for personal identifying information by email or SMS. It may use SMS or email to ask you to contact it, but never an unsolicited message with a link asking you to return information or log in.
It also never uses social media to ask for personal information, documents or payments.
Remember
- No unsolicited links or QR codes.
- No personal details by email or SMS.
- Nothing on social media either.
Facts and sources for this part
- The ATO will never send unsolicited messages containing hyperlinks or QR codes, and will never ask for personal identifying information by email or SMS. [S16] [S18]
- The ATO may use SMS or email to ask you to contact it, but never sends an unsolicited message with a link asking you to return personal information or log in. It never asks for personal details, documents or payments through social media. [S15]
Which sender details can you rely on?
Real ATO emails always come from addresses ending in ato.gov.au. Phone calls from the ATO show as No Caller ID.
So a call that shows an ATO number is not proof, and a message from ato-clients.example is not from the ATO. Scammers can copy caller IDs and build addresses that look right at a glance.
Remember
- Sender domain must end in ato.gov.au.
- A displayed ATO number does not prove anything.
Facts and sources for this part
- Real ATO emails always come from addresses ending in ato.gov.au. Phone calls from the ATO show as No Caller ID. [S16]
- Scam calls can use real ATO or Australian caller IDs, threaten arrest, demand payment by gift cards, crypto or offshore accounts, or involve fake conference calls with impersonated tax professionals or law enforcement. [S16]
Fake calls
Scam calls can use real ATO or Australian caller IDs, threaten arrest, and demand payment by gift cards, crypto or offshore accounts. Some involve fake conference calls with impersonated tax professionals or law enforcement.
You can use the Verify call feature in the ATO app on your registered device. If you cannot verify the call, hang up.
Remember
- Pressure plus unusual payment method is the pattern.
- Verify in the ATO app, or hang up and call 1800 008 540.
Facts and sources for this part
- Scam calls can use real ATO or Australian caller IDs, threaten arrest, demand payment by gift cards, crypto or offshore accounts, or involve fake conference calls with impersonated tax professionals or law enforcement. [S16]
- You can use the Verify call feature in the ATO app on your registered device to check that a call is really from the ATO. If you cannot verify the call, hang up. [S15]
- Scammers impersonate the ATO by email, SMS, phone calls, social media and fake websites. If you are not sure it is the ATO, do not respond; call 1800 008 540 to check. [S17] [S16]
Fake emails and appointment notices
In one reported scam email, the message said a phone appointment had been booked and asked the reader to open an attachment. The attachment led to a copy of the myGov sign-in page built to steal usernames, passwords and personal information.
In another, a link led to a page that downloaded remote desktop software, which can give the scammer access to your device. The ATO will never send an unsolicited message that directs you to a log in page.
Remember
- An unexpected appointment notice is a prompt to check, not click.
- Remote desktop software on a practice computer exposes every client.
Facts and sources for this part
- In one reported ATO scam email, the message said a phone appointment had been booked and asked the reader to open an attachment. The attachment led to a copy of the myGov sign-in page built to steal usernames, passwords and personal information. [S17]
- In another reported ATO scam email, a link led to a page that downloaded remote desktop software, which can give the scammer access to your device. The ATO will never send an unsolicited message that directs you to a log in page. [S17]
The check that always works
Do not use anything in the message. Look up the organisation's contact details yourself, and type the web address in yourself or use the ATO app.
Never share your myGov sign-in details with anyone, including your registered tax agent. That rule applies to you as much as to your clients: nobody legitimate needs it.
Remember
- Contact details you found yourself, never the message's.
- Type ato.gov.au or my.gov.au into the browser.
Facts and sources for this part
- If you are unsure, look up the organisation's contact details yourself and reach out using details you have sourced yourself. Check any tax debt or refund claim through the ATO's own pages, and type the web address in yourself. [S18] [S12]
- Never share your myGov sign-in details with anyone, including your registered tax agent. [S16]
If someone in your practice already clicked
Act at once. If someone has engaged with a scammer, provided information or paid, phone the ATO on 1800 008 540.
Then treat it as a possible breach: change the passwords involved, check for lodgments you did not make, and follow the breach steps later in this course.
Remember
- Phone the ATO straight away on 1800 008 540.
- Assume a breach until you have checked.
Facts and sources for this part
- If you have engaged with a scammer, provided information or paid, phone the ATO straight away on 1800 008 540. [S18]
- Signs of a breach include lodgments on client accounts you did not make, changes to client files you did not make, being unable to log in or finding account verification emails deleted, and devices running abnormally. [S11]
Scenario: the caller who wants payment today
A caller says a client has an unpaid debt and the matter goes to court today unless you pay now with prepaid vouchers. The number on your screen looks like an ATO number.
Do not pay. Hang up, then verify through the ATO app or phone the ATO on a number you looked up yourself. Note the time and what was said, and tell the principal.
Remember
- Urgency plus unusual payment is the pattern.
- Verify by your own route, then record it.
Facts and sources for this part
- Scam calls can use real ATO or Australian caller IDs, threaten arrest, demand payment by gift cards, crypto or offshore accounts, or involve fake conference calls with impersonated tax professionals or law enforcement. [S16]
- You can use the Verify call feature in the ATO app on your registered device to check that a call is really from the ATO. If you cannot verify the call, hang up. [S15]
- Scammers impersonate the ATO by email, SMS, phone calls, social media and fake websites. If you are not sure it is the ATO, do not respond; call 1800 008 540 to check. [S17] [S16]
Scenario: the unexpected appointment email
The practice inbox gets an email about a booked phone appointment with an attachment to confirm it. Nobody remembers booking one.
Nobody opens the attachment. A staff member signs in to the ATO's service by typing the address into the browser and checks for any real appointment. There is none, so the email is reported and deleted.
Remember
- Never use the message's own link or attachment.
- Check by typing the address yourself.
Facts and sources for this part
- In one reported ATO scam email, the message said a phone appointment had been booked and asked the reader to open an attachment. The attachment led to a copy of the myGov sign-in page built to steal usernames, passwords and personal information. [S17]
- If you are unsure, look up the organisation's contact details yourself and reach out using details you have sourced yourself. Check any tax debt or refund claim through the ATO's own pages, and type the web address in yourself. [S18] [S12]
Checklist: five rules to teach every person in the practice
Never click a link in a message that claims to be from the ATO. Check that the sender address ends in ato.gov.au. Never pay by voucher, crypto or an offshore account. Verify calls in the ATO app or by a number you looked up. Tell the principal at once if you have engaged.
Print it and put it where the phone is.
Remember
- Five rules, one page.
- Tell the principal at once.
Facts and sources for this part
- The ATO will never send unsolicited messages containing hyperlinks or QR codes, and will never ask for personal identifying information by email or SMS. [S16] [S18]
- Real ATO emails always come from addresses ending in ato.gov.au. Phone calls from the ATO show as No Caller ID. [S16]
- Scam calls can use real ATO or Australian caller IDs, threaten arrest, demand payment by gift cards, crypto or offshore accounts, or involve fake conference calls with impersonated tax professionals or law enforcement. [S16]
- You can use the Verify call feature in the ATO app on your registered device to check that a call is really from the ATO. If you cannot verify the call, hang up. [S15]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
An email comes from refunds@ato.gov.au.claims-desk.example. What does that tell you?
Show the answer
Right answer: B, It is not from the ATO, because real ATO addresses end in ato.gov.au. Real ATO emails always come from addresses ending in ato.gov.au. This address ends in .example. [S16]
Question 2 of 3
An email says a phone appointment with the ATO is booked and asks you to open an attachment to confirm. What is the safest step?
Show the answer
Right answer: A, Do not open it; contact the ATO using details you found yourself. One reported scam used exactly this to lead to a fake myGov sign-in page. Do not open attachments in unexpected messages. [S17]
Question 3 of 3
A staff member typed details into a fake ATO page. Who do you phone straight away?
Show the answer
Right answer: D, The ATO on 1800 008 540. If someone has provided information or paid a scammer, phone the ATO immediately on 1800 008 540. [S18]