myGov and ATO Tax Scams Are Peaking Right Now — Here’s How to Stay Safe (2026)

Every year between April and June, Australians receive a flood of fake messages claiming to be from myGov or the Australian Taxation Office. In 2026, these scams have become harder to detect and the timing is not accidental.

Tax time creates the perfect psychological conditions for scammers. You are expecting communication from the ATO. You may be waiting for a refund. And you are likely distracted by the process of gathering documents and lodging returns. Scammers exploit every one of these conditions.

This guide breaks down exactly how these scams work, what the red flags look like, and how to verify any message before you act on it.

Why Tax Season Is Prime Time for Scammers

The ATO processed over 14 million tax returns in the 2024–25 financial year. Scammers do not need to target all of them they just need a small percentage to click a link or call a number. With millions of Australians expecting ATO contact between April and October, the scam message does not feel out of place. That is the core of the attack.

ScamWatch reported that government impersonation scams including ATO and myGov fakes  accounted for tens of millions in losses in 2024–25. The real number is significantly higher because most victims do not report.

The Three Most Common ATO and myGov Scams in 2026

Scam 1 — The Fake Tax Refund SMS

You receive a text message that reads something like:

“myGov: You have a pending tax refund of $348.50. Verify your details to receive payment: [link]”

Red flags to look for:

• myGov and the ATO never send refund notifications via SMS with a link
• The URL will not be my.gov.au — it will be something like mygov-refund.com or ato-verify.net
• Urgency language — “expires in 24 hours”, “immediate action required”

Scam 2 — The ATO Debt Threat Call

A robocall or live caller claims you owe a tax debt and will face arrest or legal action unless you pay immediately via gift cards, cryptocurrency, or wire transfer.

Red flags:

• The ATO never demands immediate payment via gift cards or crypto
• The ATO never threatens arrest in a phone call
• Real ATO debt notices come by post first, with a reference number you can verify at ato.gov.au

Scam 3 — The Fake myGov Login Page

An email tells you your myGov account has been locked or that unusual activity was detected. The link leads to a near-perfect replica of the myGov login page — designed to steal your username and password.

Red flags:

• The real myGov URL is always my.gov.au — nothing else
• Hover over any link before clicking — the actual destination will show at the bottom of your browser
• myGov never emails you asking you to verify your login credentials

How to Verify Any ATO or myGov Message in 3 Steps

Step 1 — Do not use the link or number provided

If you receive a message claiming to be from the ATO or myGov, go directly to the official site by typing my.gov.au or ato.gov.au into your browser. Log in there and check if the notification actually exists in your account.

Step 2 — Check what the ATO will and will not do

The ATO will never:

• Ask for payment via gift cards, iTunes cards, cryptocurrency, or wire transfer
• Threaten immediate arrest over the phone
• Send a refund via a link in an SMS
• Ask for your myGov password

The ATO will legitimately:

• Send letters by post with a reference number
• Contact you via your myGov inbox
• Call you — but will never demand immediate payment on that call

Step 3 — Scan the link before you click

If you have received a suspicious link claiming to be from myGov or the ATO, do not click it to test where it goes. Copy the URL and paste it into the OziShield Link Scanner. OziShield performs structural domain analysis — checking whether the domain is impersonating a government site, when it was registered, and whether it appears in threat databases.

A real government site does not need a third-party domain. If it is not my.gov.au or ato.gov.au, it is not real.

What to Do If You Have Already Clicked

If you clicked a link and entered your details:

1. Change your myGov password immediately at my.gov.au
2. Enable two-factor authentication on your myGov account if not already active
3. Contact your bank if you entered any financial information
4. Report it to ScamWatch at scamwatch.gov.au/report-a-scam
5. Contact IDCARE at idcare.org — Australia’s national identity and cyber support service — if your personal information was compromised

Report It — Protect the Next Person

If you received a fake ATO or myGov message, report it even if you did not click anything. Your report helps ScamWatch and the ATO track active campaigns and warn other Australians faster.

Report to: scamwatch.gov.au/report-a-scam Forward suspicious SMS to: 0429 999 888 (ScamWatch SMS forwarding)