Australians are being warned to be on the lookout for scams. The ATO has become aware of a scam wherein ATO clients receive an email in their MyGov inbox. One such scam claims the recipient has an outstanding tax refund. The scam, impersonates myGov and seeks to steal accounts details and credit card credentials.
The sender name shows “myGov – Refund Service”; however, the display address has been edited, and the sending address is a jumble of letters and numbers with a domain that has been linked to other scams.
“The email itself has been cleverly designed to appear as one you could expect to receive from myGov…although there are a few minor grammatical errors, it’s convincing enough to potentially fool many individuals.” as per below (Eliza Bavin, Yahoo Finance, 2022):
The body of the email alerts the recipient that they have an outstanding refund and, in order to “accept fast payment online”, they’re instructed to click a link. After clicking the link, the user is taken to the first phishing site, which is almost an exact replica of the myGov login page, the only immediately obvious difference being the URL. The user is directed to enter the email and password they use for their myGov account to sign in, and these details will then be harvested by the attacker. Next, the user is taken directly to a page where they’re instructed to update their information in order to receive their refund.
Note: The authentic myGov login page uses multi-factor authentication (MFA) when you sign in, meaning, on top of your password, you’ll have to answer a secret question or enter a code that’s received on your mobile. This step is skipped by the scammers.
On this page, the victim is asked to enter their:
- Name on the card
- Card number
- Expiration date
- CVV
- Date of birth
- Phone number
“This scam preys on the heightened emotions that tax time brings and, given the attention to detail at every stage, it has potential to be very damaging.”
MailGuard said, while myGov’s MFA process should help to limit what access a criminal may get to their victims’ personal information, you can never be too certain what they’re capable of.
“It’s especially important to ensure all of your passwords are unique, so if one were to be compromised in a situation such as this, the attacker can’t use it to access any of your other accounts.”
The ATO is also warning young people to be wary of scammers.
The Australian Taxation Office (ATO) has taken action against 595 websites impersonating its online services.
ATO assistant commissioner Tim Loh said the fake sites are designed to steal passwords, personal information and identity documents, such as passports and driver’s licenses. Since April 2022 the ATO has had more than 360 scams reported.
It is a myth that only the elderly fall for scams. In the past three years, younger Australians have fallen victim to the most tax scams. In 2021, people aged 25 to 34 reported the most amount of money lost to tax scams, closely followed by those aged 18 to 24. In contrast, those aged 55 and above were among those who reported the least financial losses, the ATO said.
If you get a phone call saying it’s from the ATO and it doesn’t sound right, hang up. Check with someone you trust, like us, or go to the ATO’s website where they have a listing of all the current ATO scams. You can also call on a dedicated scam hotline, 1800 008 540.
Email and SMS scams are not always full of typos, bad grammar and promises of riches from foreign royalty, Loh said. “We are seeing many more sophisticated scam messages using official language and fraudulent websites that mimic online services.”
The ATO will contact people through emails and SMS but will not request personal information through those means.
The ATO will never:
- Send an unsolicited message requesting personal information via a return email or SMS
- Send an email or SMS with a link to log in to its online services
- Ask you to pay a fee in order to receive a refund
Some common scams involve:
- Phoning people about a fake tax debt, and threatening that they’ll be arrested if they don’t pay it straight away
- Sending texts to people saying that they’re suspected of being involved in cryptocurrency tax evasion. If you receive this text, don’t click on the link
- Sending emails impersonating the ATO and asking for people to update their financial information so their tax refund can be processed
How to protect yourself from scams
MyGov offers the following advice in order to protect your account:
- Don’t share your myGov sign in details with anybody else
- Use a strong password that is easy for you to remember but hard for others to guess
- Use a different password to your other online accounts
- Change your password and myGov PIN regularly
- Don’t let other people see your computer screen when you use the ‘show password’ option
- Don’t send your password and myGov PIN to anyone by email or text message
- Don’t tell anyone your email account password
- Always sign out of your myGov account when you have finished using it
Check for the Extended Validation Certificate indicator in your browser’s address bar when accessing myGov. Each browser shows the Extended Validation Certificate in a different way. Usually this is a green box or bar with a padlock icon.
