A new scam email is doing the rounds, and it is designed to look exactly like a genuine message from the ATO. Scams like this tend to spike around tax time, when people are already expecting to hear from the ATO and are less likely to question a message that looks official. Knowing the specific red flags can save you from handing over your myGov login to a criminal.
How the scam works
The email claims a phone appointment with the ATO has been scheduled, and includes convincing details like a date and time.
It tells you to open an attachment to “securely access relevant services” or to reschedule the appointment.
That attachment contains a link to a fake, but realistic looking, myGov sign in page, built purely to steal your username, password and other personal details.
What makes this version convincing is the specific, believable detail. Rather than a vague, generic message, it includes an appointment date, a time, and an appointment type, details that make it feel like a real administrative notice rather than an obvious phishing attempt.
This is not an isolated incident
This myGov appointment scam is only the latest in a string of impersonation attempts the ATO has publicly warned about. Recent alerts have also covered a fake DocuSign style email carrying a document called a ‘Declaration and Final Release’, and a cryptocurrency themed email demanding taxpayers ‘declare’ holdings in an undisclosed digital wallet by calling a phone number in the email.
The details change, but the underlying pattern does not: an unexpected message, a sense of urgency, and a link or attachment designed to steal your login details.
What the ATO will never do
The ATO has confirmed it will never:
- email you an attachment that contains a link to a myGov sign in page
- ask you to access ATO services through a link in an unsolicited email
- direct you to a login page that is not hosted on an official myGov or ATO website
- ask for your myGov username, password, or security code by email
What to do if you receive it
- Do not open the attachment, and do not click any link inside it.
- Do not reply to the email or call any number it provides.
- Check the sender’s actual email address, not just the display name. A scam email might display as “Australian Taxation Office” while the underlying address is completely unrelated to a genuine government domain.
- If in doubt, access ATO or myGov services by typing the address into your browser yourself, or through the official app, rather than through any link in the message.
- If you are ever unsure whether a message claiming to be from the ATO is genuine, contact JMB or the ATO directly through a channel you already know and trust, not through anything in the email itself.
A closer look at checking a link before you click
If you want to check a link without clicking it, hovering your mouse over it on a computer will usually show the actual destination address in a small preview, often at the bottom of the screen. On a phone, holding your finger on a link, without tapping it, will often show a preview of where it leads.
If that address does not clearly end in a recognised government domain, treat it as suspicious, even if the email itself looks convincing.
If you run a business, warn your team too
Scam emails like this are not only sent to individuals. If your business has staff who handle finance, payroll or administrative tasks, it is worth making sure they are aware of this specific scam and the ATO’s general rules about what it will never ask for by email.
A quick heads up to your team can prevent a single distracted click from turning into a much bigger problem.
Frequently asked questions
Q. What if I already opened the attachment?
Do not enter any login details if you have not already done so. If you have entered your myGov username or password, change your password immediately and contact Services Australia.
Q. How can I report a scam email like this?
You can report it to Scamwatch, and forward suspicious ATO related emails to the ATO’s own reporting address.
Q. Are phone scams different from this email scam?
Yes. This is a separate, email based scam. If you want to check whether a phone call claiming to be from the ATO is genuine, see our earlier article on verifying ATO calls.
Q. How does the ATO usually contact me if there is a genuine issue?
The ATO does use SMS and email for some legitimate purposes, but it will never ask you to log in to myGov through a link in that message, or to open an attachment containing a sign in page. If you are unsure, contact the ATO or JMB directly using details you already have, not anything provided in the message.
Q. Are older Australians more at risk from scams like this?
Anyone can be targeted, including people who are not required to lodge a tax return at all. It is worth sharing this kind of warning with family members, particularly if they are less familiar with checking sender details or hovering over links before clicking.
Sources
ATO, Scam alerts: https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/scam-alerts