Is that ATO message real? How to check and report scams

Why ATO scams work

Scammers pretend to be the ATO because people take tax messages seriously. A text about a refund, an email about a debt, or a call about "legal action" can push people to act before they think. The ATO publishes regular scam alerts, which shows how often these messages appear.

The good news: the ATO has published clear rules about what it does and doesn't do. If a message breaks one, you can stop there.

What the ATO says it won't do

From the ATO's scam guidance:

• No links by SMS. The ATO says it will never send an unsolicited SMS that contains a hyperlink. It also says the ATO and myGov will never send an SMS or email with a link to access online services.

• No sensitive details by email. The ATO says it will never ask for your tax file number (TFN), bank details or myGov sign-in details by email.

• No personal ID by SMS. It won't ask for personal identifying information by text.

• No vouchers or crypto. The ATO says it will never ask you to pay a debt with iTunes or Google Play cards, or other vouchers. It also won't take cryptocurrency or cardless cash ATM withdrawals as payment.

How to check a message

1. Don't reply, click or call back using the details in the message.

2. Sign in directly. Type my.gov.au or ato.gov.au into your browser and sign in. Genuine ATO letters, including your notice of assessment, appear in your myGov Inbox if your account is linked.

3. Check the sender. The ATO says its genuine emails come from addresses ending in ato.gov.au. A display name that says "ATO" proves nothing on its own.

4. Call the ATO. If you're not sure, the ATO says to phone 1800 008 540 to check, using that number rather than one in the message.

5. Use the ATO app. The ATO says its app has a feature that lets you verify, in real time, that you're speaking with the real ATO.

Red flags to look for

• A link in a text message claiming to be from the ATO or myGov

• Threats of arrest, police or "legal action" today

• A refund you weren't expecting, with a link to "claim" it

• Payment by gift card, voucher, crypto or a cash withdrawal

• A request for your TFN, bank details or myGov password

• A sender address that doesn't end in ato.gov.au

Sample (synthetic, fake): ATO: You have an outstanding tax debt of $1,936. Pay within 2 hours to avoid court action. Pay now: [link]

Real ATO contact reads differently. It refers to a specific income year or account, gives you time to respond, and points you to official ways to pay or contact the ATO.

How to report a scam

If you didn't pay or share details

The ATO still wants to know:

• Emails: forward the whole email to ReportScams@ato.gov.au, then delete it from your inbox, sent and deleted items.

• Texts: take a screenshot and email it to ReportScams@ato.gov.au, or use the ATO's online report a scam form.

Scams that pretend to be other organizations can be reported to Scamwatch.

If you paid money or shared personal details

Act quickly. The ATO says to:

• Call the ATO immediately on 1800 008 540

• Make an official report to your local police

• Contact your bank or financial institution if you gave card or bank details

• Contact the bank you sent the payment to and lodge a fraud report

If you shared your TFN or myGov details, say so when you call.

Protect your myGov and ATO details

A few habits make most of these scams harmless:

• Always sign in by typing my.gov.au or ato.gov.au yourself, never from a link in a message

• Never share a sign-in code sent to your phone with anyone who calls or messages you

• Keep your TFN off social media, email and forms you didn't request

• Use a unique password for myGov that you don't use anywhere else

• Check your myGov Inbox regularly, so a genuine letter doesn't sit unread

If something in your ATO account looks wrong, such as bank details or an address you didn't change, call the ATO on 1800 008 540.

Genuine ATO letters still need attention

Not every unexpected message is a scam. The ATO really does send notices of assessment and data-matching letters, for example. The aim is to check, not to ignore. Once you've confirmed a letter in your myGov Inbox or by phone, read it for what it asks and the date it gives.

A 60-second checklist

• Did the message include a link? If it came by SMS, treat it as a scam.

• Did it ask for a TFN, bank details or a myGov password?

• Does it demand vouchers, crypto or a cash withdrawal?

• Is the same letter in my myGov Inbox?

• Have I called 1800 008 540 myself if I'm still unsure?

Have a genuine letter read with you

When a letter checks out but the wording is hard to follow, EasyToDecode, launching soon, will read your own ATO letter, quote the amount, the request and the due date, and list the questions to ask. See how it works or join the waitlist to hear when it opens.