Government Impersonation Scams: myGov, ATO & Services Australia
Over 10,000 government impersonation scams were reported last year, with 86% referencing myGov. Here's how to protect yourself.
Services Australia observed, analyzed, and responded to more than 10,000 unique agency impersonation scams in the last financial year. The staggering part: 86% of these scams referenced myGov in some way. Scammers have become increasingly sophisticated, creating fake websites and messages that closely mimic official government communications. The replicas are so convincing that even careful people fall victim.
Here's the single most important thing you need to know:
myGov will NEVER send you an email or SMS with a link. The ATO and myGov do send messages, but they will never include hyperlinks directing you to log in to their services. Any message claiming to be from myGov or the ATO that contains a clickable link is a scam, no exceptions. Understanding this one rule immediately protects you from the vast majority of government impersonation attempts.
Common Government Impersonation Scams
myGov Email and SMS Scams
New email scams ask people to update their myGov or myGovID details, with scammers pretending to be from the "myGov customer care team." These emails tell people they need to verify their identity by clicking on a link. The link leads to a fake myGov sign-in page designed to steal your personal information, including passport and driver's license details. Once scammers have this information, they can commit identity theft, open accounts in your name, or access your actual myGov account to steal tax information or divert refunds.
Recent variations: QR codes in emails direct to fake myGov login pages. SMS messages about account verification create artificial urgency, claiming your account will be suspended unless you act immediately. Emails claiming your myGovID needs urgent renewal exploit confusion about the difference between myGov and myGovID. Fake notifications about unclaimed benefits or refunds prey on people's hope of receiving money they didn't know they were owed. All of these variations share the same goal: trick you into providing login credentials or personal information.
ATO Tax Refund Scams
Scammers pretending to be from the "Australian Taxation Office" or "myGov" email and falsely tell people their taxable income has been recalculated and they are due to receive compensation. They ask recipients to reply with personal identifying information to process the "refund." The specific dollar amounts make these scams feel legitimate, like the ATO actually reviewed your file and found you were owed money. Some variations ask you to click a link to "claim your refund," leading to fake ATO websites that capture your credentials and banking details.
The ATO issued a reminder that it would never send an email with a QR code or a link to log in to online services. Real tax refunds appear in your myGov inbox when you log in directly through your browser. If you're owed a refund, you'll see it when you access your account through the official website, not through a surprise email with a link.
Services Australia and Centrelink Impersonation
Scammers impersonate Services Australia, Centrelink, and Medicare via phone, email, and SMS. They may claim there's an issue with your payment, request personal information to "verify your identity," or threaten to suspend benefits unless you take immediate action. The threats are designed to panic recipients who depend on government payments for essential living expenses. The fear of losing income creates pressure to comply without thinking critically.
Common tactics: Fake payment update notifications claiming your Centrelink payment has been suspended. Requests to confirm banking details supposedly to "ensure payments go to the right account" but actually designed to steal your banking information. Threats of legal action or benefit suspension unless you call a specific number or click a link immediately. Real Services Australia communications come through your myGov inbox or official letters in the mail. They never demand immediate action via email or SMS with links.
How to Spot Fake Government Messages
Links in messages
This represents the primary red flag for government impersonation scams. myGov, the ATO, and Services Australia will NEVER include clickable links in emails or SMS messages. This policy exists specifically to protect you from scams. Any message claiming to be from these agencies that contains a link is fraudulent. Period. No exceptions. Real government communications tell you to visit the official website by typing the URL yourself.
QR codes
Another absolute indicator of scams. Government agencies do not send QR codes in emails for login purposes. The ATO explicitly warned about this tactic. If you receive a QR code claiming to provide quick access to myGov, the ATO portal, or Services Australia, it's a scam. Legitimate government services require you to type the official URL into your browser for security.
Urgent threats and artificial deadlines
Claims of account suspension, legal action, or immediate payment required are classic scam tactics. Real government agencies give you reasonable time to respond to legitimate issues. They send official letters through postal mail for serious matters, not threatening text messages. The ATO doesn't threaten arrest via email. Centrelink doesn't suspend payments because you didn't respond to a text message within 24 hours. These manufactured crises are designed to bypass your critical thinking and force hasty decisions.
Requests for personal information
Requests for personal information via email or SMS indicate fraud. Government agencies already have your details. They don't need you to "verify" information they collected when you enrolled. If there's a genuine issue with your account details, you'll receive official correspondence through the mail or see secure messages in your myGov inbox when you log in directly. They won't ask you to reply to an email with your driver's license number, passport details, or banking information.
Unusual payment methods
Absolute scam indicators. Government agencies never ask for payment via gift cards, cryptocurrency, or wire transfer. They don't demand immediate payment of tax debts via phone. If someone claiming to be from the ATO says you owe taxes and must pay immediately with iTunes cards or Bitcoin, that's a scam. Real tax debts are communicated through official letters with payment options through the ATO website or phone system using normal banking methods.
Spelling and grammar errors
While some sophisticated operations have perfect English, many scams contain subtle mistakes that reveal their fraudulent nature. Professional government communications teams proofread carefully. An email from the ATO with spelling errors or awkward phrasing is probably fake.
Generic greetings
Messages like "Dear customer" instead of your actual name suggest the message wasn't sent by an organization that knows your identity. Real myGov and ATO communications use the name you registered with. Generic greetings indicate mass-distributed scam messages sent to thousands of recipients.
Suspicious sender email addresses
Check the actual email address, not just the display name. The display might say "myGov" but the actual address could be something like mygov.com.au instead of the correct my.gov.au, or mygovhelp@outlook.com, or secure-mygov-verification@gmail.com. Government agencies only send from their official domains. Hover over the sender name to see the real email address before trusting any message.
How to Protect Yourself
Check suspicious messages with SafeAus
Before clicking any link or responding to a government message, check it with SafeAus. Our smart detection identifies government impersonation scams in under 5ms. Simply paste the suspicious message or URL into SafeAus for instant verification. This takes seconds and could prevent identity theft that takes months to resolve.
Go direct to official websites
Rather than clicking links in messages, type my.gov.au or ato.gov.au directly into your browser. Never click links in emails or text messages claiming to be from government agencies. Bookmark these official sites so you always have the correct URL readily available. This habit eliminates the primary attack vector for government impersonation scams.
Enable multi-factor authentication
Enable MFA on your myGov account for extra security. Even if scammers steal your password through phishing, MFA prevents them from accessing your account. Use an authenticator app rather than SMS-based MFA when possible, as SMS can be intercepted through SIM swapping attacks. MFA is your last line of defence if you accidentally provide credentials to a fake website.
Check your myGov inbox directly
Log in directly to see legitimate messages from government agencies. All official communications from Services Australia, the ATO, and other linked agencies appear in your myGov inbox when you access the portal through your browser. If you receive an email or text claiming to be from a government agency, don't trust it until you've verified by logging into myGov yourself and checking for corresponding messages there.
Verify through official phone numbers
Verify unexpected messages by calling the agency using the number on their official website, not the number provided in the suspicious message. If you receive a message claiming to be from the ATO, look up the ATO's phone number on ato.gov.au and call them. Real customer service can confirm whether they attempted to contact you. This verification takes a few minutes but prevents potentially catastrophic identity theft.
Don't rush in response to urgent demands
Government agencies give you time to respond. They don't demand immediate action through email or SMS. Real issues are communicated through official channels with reasonable timeframes for response. If a message is pressuring you to act within hours, that urgency itself indicates a scam. Take a breath, slow down, and verify through official channels before taking any action.
Educate family members
Older Australians are particularly targeted because scammers assume they're less familiar with digital security practices. Share this information with elderly family members and set up Family Protection to monitor threats together. A quick conversation about how to identify fake government messages could save a family member from significant financial loss and the emotional trauma of identity theft.
What to Do If You've Been Scammed
If you've clicked a link, provided information, or sent money in response to a fake government message, immediate action can limit the damage. Don't panic, but do act quickly. Time is critical in preventing further identity theft or financial loss.
Change your passwords immediately
Change passwords for myGov, ATO online services, and any other affected accounts. Do this from a different device if possible, or after running antivirus software to ensure your computer isn't infected with keylogging malware. Use unique, strong passwords for each account. If you reused the compromised password elsewhere, change it on all those accounts too.
Contact Services Australia's Scams and Identity Theft Helpdesk
Call 1800 941 126 for advice and to connect with identity recovery services. They specialise in helping scam victims and can guide you through the recovery process. They'll help you understand what information was compromised and what steps you need to take to protect your identity.
Contact your bank
If you've provided financial information or made payments, call the number on the back of your card, not any number from the scam message. They can freeze accounts, reverse transactions if caught quickly enough, and monitor for fraudulent activity. Report the scam transaction details so they can track the money trail and potentially recover funds.
Report to authorities
Report to Scamwatch and ReportCyber so authorities can track patterns and potentially shut down the scam operation. Your report helps protect other Australians by adding to the database of known scam tactics and fake websites. Forward the scam message to Services Australia so they're aware of the specific impersonation attempt.
Contact IDCARE for identity theft support
Call 1800 595 160 for free assistance with identity crime. IDCARE creates personalised response plans based on what information was compromised, helps you understand the risks, and guides you through the recovery process. They can help you place alerts on your credit file, monitor for misuse of your identity, and take action if your identity is used fraudulently.
Monitor your accounts and credit file
Check your myGov inbox regularly for unexpected changes or communications. Review your bank statements daily for unauthorised transactions. Contact credit reporting agencies like Equifax or Experian to place a ban on your credit file, preventing anyone from opening new credit accounts in your name. The full impact of identity theft sometimes takes weeks or months to emerge as criminals sell information or use it gradually. Vigilant monitoring catches misuse early before it causes major damage.
Official Government Contact Information
Always contact government agencies through their official channels. When you need to verify a message or contact a government service, use these official numbers and websites that you find independently, not contact information provided in suspicious messages.
myGov
Website: my.gov.au
Phone: 132 307 (myGov Help Desk)
This is the only official website for myGov access. Any other domain claiming to be myGov is fraudulent.
Australian Taxation Office (ATO)
Website: ato.gov.au
Phone: 13 28 61
You can also access ATO services through myGov for secure communication.
Services Australia
Website: servicesaustralia.gov.au
Centrelink: 13 23 00
Medicare: 132 011
Different services have different contact numbers, but all are accessible through the main Services Australia website.
Scams and Identity Theft Helpdesk
Phone: 1800 941 126
Provides specialised support for anyone who has been scammed or suspects their identity has been compromised. This service connects you with identity recovery support and provides guidance specific to government impersonation scams.
With over 10,000 government impersonation scams reported annually and 86% referencing myGov, these scams are one of the most prevalent threats facing Australians. The sophistication of these scams is increasing, with criminals creating near-perfect replicas of government websites and communications. Your best protection is remembering that myGov will NEVER send you an email or SMS with a link. When in doubt, go directly to the official website, use SafeAus to verify the message, or call the official number listed on the government website. Those few extra minutes of verification could prevent months or years of recovering from identity theft.