Fake ATO emails remain one of Australia's most damaging email scams: Scamwatch consistently ranks the ATO among the most impersonated organisations in the country, with tax-themed scams costing Australians millions of dollars every year (Scamwatch). The playbook is always the same — an email that looks like it came from the Australian Taxation Office claims you owe money, are owed a refund, or must verify your myGov identity, then pushes you to a fake login page or a malicious attachment. This guide shows exactly what a fake ATO email looks like, what to do if you clicked, and how to train staff so the next one dies in the reporting folder.
TL;DR
- The real ATO does not email links asking you to log in, does not email final notices demanding immediate payment, and never threatens arrest by email.
- The most common fake-ATO lures: tax refund notifications, overdue tax debt warnings, myGov verification, and payroll or superannuation corrections aimed at businesses.
- If you clicked: change your myGov and ATO machine credentials from a clean device, revoke sessions, enable MFA, and report it.
- Report the email; do not call any number inside it — the ATO's real number is on ato.gov.au.
- Monthly training plus simulated ATO-themed lures is the defence that holds up at 11:59pm on the BAS due date.
Why the ATO is the perfect disguise
The ATO has genuine power over Australians: it can hold refunds, charge penalties, and take legal action. Scammers borrow that authority — a real fear of the tax office does the persuasion for them. The timing does the rest: scam waves cluster around tax time (June to July) and BAS deadlines, when an email about a tax debt or refund feels plausible rather than strange.
Sender spoofing adds the finishing touch: near-perfect ATO branding, Australian English, and lookalike domains that survive a casual glance. Increasingly, the same lures arrive by SMS — see our guide to smishing for that variant.
The red flags
- A link asking you to log in. The ATO does not email links to login pages. Type ato.gov.au into your browser yourself.
- A refund you never applied for. You are eligible for a tax refund is bait; the refund exists only if you hand over your myGov credentials.
- Urgency plus threats. Final notice, legal action within 24 hours, arrest warnings, threats to cancel your ABN. Real ATO correspondence gives you time and arrives by post for serious matters.
- Unusual payment methods. Gift cards, cryptocurrency, transfers to a Tax Office suspense account — none of these are ATO payment channels.
- The sender address. Expand it: real ATO mail comes from ato.gov.au domains, not ato-refunds.com.au or similar spoofs.
For business-specific lures: fake payroll tax corrections, fake Single Touch Payroll issues and fake activity statement notifications target bookkeepers and finance staff. A phishing email that reaches finance with the right tone can cost a month's payroll — that is why phishing simulations treat the ATO as a top impersonation theme.
What to do if you clicked
- Change your myGov and ATO machine credentials immediately from a different, clean device — and any other account sharing that password.
- Revoke sessions on myGov and ATO online services, and enable multi-factor authentication if it is off.
- Check for damage: if a refund was redirected or a payment made, call your bank straight away — recall windows close in hours.
- Report it: to the ATO (ato.gov.au — report a scam) and to Scamwatch; delete the email after reporting.
- Tell your team. One shared warning kills the lure for everyone else — and normalises reporting, the habit that catches real attacks.
If staff credentials or client data were exposed, treat it as a data incident: assess eligibility for reporting under the Notifiable Data Breaches scheme (see the OAIC's guidance) — a security gap assessment shows whether your response plan covers this before you need it.
Training that works
A policy document does not protect the bookkeeper at 11:58pm on the BAS due date — training does:
- Simulated ATO-themed lures calibrated to real scam waves, so staff meet the pattern safely in an inbox rather than dangerously in a live one.
- Monthly short modules — one habit at a time: sender addresses, link hygiene, verification calls.
- Measured improvement: click rates falling and report rates rising per person, evidence you can show a board, an insurer or an auditor (human risk reporting).
- A no-blame reporting culture, so the first person to spot the scam reports it within minutes instead of hiding a click.
See our security awareness training for how monthly, measured programs are structured.
FAQ
Does the ATO ever email you with a link? No. The ATO does not send emails or SMS containing links to online services asking you to log in or confirm personal details. If you get one, do not click — go to ato.gov.au directly.
How do I check if a message is really from the ATO? Call the ATO on the number published at ato.gov.au (never a number in the message) or log into your myGov or ATO online services directly. If nothing is there, the message was fake.
I entered my details on a fake ATO page — what now? Change the myGov and ATO machine credentials immediately from a clean device, revoke sessions, turn on MFA, check for unauthorised activity, and report to the ATO and Scamwatch. If money moved, call your bank first.
Can a fake ATO email infect my computer? Yes — some carry malicious attachments (fake tax assessment PDFs or statement files) that install malware when opened. Never open attachments from unexpected tax emails.
Why do these emails peak at certain times of year? Tax time (June to July) and BAS quarters provide the cover: messages about refunds and debts feel plausible when they are expected. Simulations should follow the same calendar.
One last thing
The ATO will never mind you verifying. Every fake ATO email fails the same two-second test — do not click, go directly to ato.gov.au — and the businesses that drill that reflex monthly are the ones whose finance teams delete and report the next wave before it does damage.