It’s tax season in Australia and unfortunately, this comes with a number of tax scams.
The materials and processes required for filing taxes allow cyber criminals to execute tax-related scams due to the continuing chaos around the COVID-19 pandemic.
Tax scams to look out for, and methods to avoid them
Fake tax preparers
Fake tax preparers usually show up around tax time advertising online that they can do your tax return fast for a low price. Unfortunately sometimes these preparers are not registered as licensed agents under the Tax Practitioners Board (TPB), but pose as registered practitioners.
These often operate by accessing the myGov accounts of their clients and lodging their tax returns through myTax, or take your personal details and your payment, and then disappear.
How to avoid being scammed
It’s important to remember that ultimately you are responsible for all the information on your tax return, no matter who prepares it. So make sure you choose your preparer wisely.
Check that your tax preparer is registered
They may display the TPB logo on their website but you should still double check they are registered by searching the TPB Register.
Never share your myGov password with anyone
Sharing your information (such as your myGov password) with an unregistered practitioner puts your personal and financial affairs at risk.
Setup your myGov account to use 2 factor authentication
You can use either the myGov Code Generator app or receive a code by SMS when logging in. This will further protect you from unauthorised access to your myGov account.
Business email compromise scam
Attackers target those with financial roles and sometimes even employees, by posing as someone high up in the organisation, such as the CEO, director, or a payroll provider.
They then send emails asking for payroll details or PAYG payment summary forms, which include all the personal information a cyber criminal would need to steal someone’s identity.
Many of these emails start with a friendly greeting before getting to the request, putting those targeted at ease before asking for the forms or details.
How to avoid being scammed
If you work for a company, never send tax information electronically without first verifying with the sender in person or on the phone that they actually sent the request in the first place.
While it might seem like more of a hassle, it’s worth taking the extra precaution, as the likelihood of this type of attack increases during tax season.
ATO phishing scams
Phishing is a tactic used to trick you into giving sensitive information like usernames, passwords or credit card numbers by impersonating a reputable company or individual.
In an Australian Taxation Office (ATO) phishing attack, the recipient will typically receive an “urgent” email, SMS or automated phone call claiming to be from the ATO with instructions to follow a link to login or make a payment.
Over the past year, there have been various ATO scams, such as:
- SMS or email scams from the ATO requesting you to update or verify your myGov account.
- Automated phone scams telling you that your tax file number (TFN) has been suspended due to illegal activity or a scammer, and you have to pay a fine to release it.
- Phone and SMS scams claiming you have a tax debt and that you will be arrested if you don’t pay.
How to avoid being scammed
If you receive a phone call, SMS, or email from the ATO, don’t click on links to log in to your account, send payments or provide any personal information.
The ATO will never threaten you with immediate arrest, demand payment, or suspend your TFN. So if you’re not sure if it’s the ATO contacting you, phone them directly using the phone number on their website to check.
It’s also worth installing a digital security product, like Avast’s Free Antivirus, to protect you from any malicious software that you might download from a tax scam email, and using a secure browser with a VPN like, Avast Secure Browser, which has an Anti-Phishing solution in the desktop browser to defend against malicious threats when browsing the internet.
Stephen Kho is a cyber security expert at Avast. Stephen is a security professional with 14 years of industry security experience across multiple business sectors including the financial and telecommunications industries
