Spot the scam: the tax refund text from the ‘ATO’ or ‘myGov’

A text lands saying your tax refund is ready. Maybe it failed because of a wrong BSB, or it needs one quick confirmation. There’s a link, and money at the end of it.

It’s a scam, and an old favourite. The ATO and Services Australia, which runs myGov, have both published what these messages look like and the one rule that gives them away.

Here’s how to take one apart, sign by sign.

Money waiting, one tap away

Services Australia lists the lines myGov text scams use. One says “a refund is waiting for your action and you need to click a link to get the payment”. Others say your details are wrong, a subsidy is on hold, or your account is about to be suspended or frozen.

The ATO has published the refund versions it has seen in fake emails:

• “You are due to receive an ATO Direct refund.”
• “ATO Refund failed due to incorrect BSB/Account number.”
• “We need to verify your incoming tax deposit.”

The link goes to a fake myGov sign-in page. In March 2024 the ATO said about 75% of the email scams reported to it over the previous six months linked to one.

Your password isn’t the real prize. With your myGov sign-in, the ATO says, scammers can lodge in your name and change your bank details so payments go to them.

Sign one: there’s a link

This is the giveaway. Services Australia is blunt: “If you get a text message from myGov with a link to click on, it’s a scam.”

myGov only texts to tell you there’s a new message in your myGov Inbox. It never asks you to tap through to anything.

The ATO is just as clear. It will never send an unsolicited SMS that contains a hyperlink, or ask for personal identifying information by SMS. Both say they won’t text or email you a link to sign in to online services.

The ATO does use text messages. It may text you to ask you to get in touch. It just won’t put a sign-in link in one.

Sign two: a refund you didn’t expect

The ATO lists “unexpected messages about refunds or debts you weren’t aware of” as a warning sign. Its scam alerts go further: if someone claiming to be the ATO tells you you’re owed a refund, it’s likely a scam.

And if anyone asks you to pay a fee to receive your tax refund, that’s a scam too. The ATO says it will never do that.

Sign three: the rush

Scammers want you moving before you think. The ATO flags threats and urgency, such as “your account will be locked”. myGov scam texts warn your account will be suspended or frozen unless you act.

Sign four: it can hide among real texts

The ATO warns that scam texts can turn up in the same message thread as genuine ATO messages. Sitting next to a real one proves nothing.

Since 1 July 2026, texts from organisations that register their sender name should show that name, and texts from unregistered names show “Unverified”. Scamwatch says to treat “Unverified” messages with caution. We explained how the label works in our story on the SMS Sender ID Register.

The name helps, but the link test still wins. A text that looks like it’s from myGov and asks you to tap a link fails sign one.

How to check in a minute

Don’t use anything in the message. myGov says to sign in only through the official myGov app or by typing my.gov.au into your browser. For the ATO, type ato.gov.au yourself.

If you’re still unsure, the ATO says to call it on 1800 008 540 rather than reply.

Where to report it

For an ATO text, the ATO asks you to screenshot it and email it to ReportScams@ato.gov.au, or use its online Report a scam form. For a myGov scam, email it to reportascam@servicesaustralia.gov.au.

If you tapped and typed

Move quickly. Paid money or gave sensitive personal details? The ATO says to call it straight away on 1800 008 540. If you shared bank or card details, tell your bank too.

If you entered your myGov sign-in, myGov’s own steps are:

• call the Services Australia Scams and Identity Theft helpdesk on 1800 941 126
• change your password and check your account history
• set up Digital ID or passkeys as your sign-in, then turn off your password
• complete the Security review in your myGov account and remove devices or passkeys you don’t recognise
• contact any linked service the scammer could have reached, such as the ATO, and your bank if you shared bank or card details.

Locked out? myGov says unusual sign-in activity may have locked your account. Look in your email for a myGov message about it and follow the prompts, or contact the myGov helpdesk.

If you have the ATO app, you can lock your ATO account there when something doesn’t feel right. For more on the sign-in method myGov recommends, see our passkeys explainer. For another ATO impersonation doing the rounds, read our warning about fake ATO emails that install remote-access software.

Checklist

• Never tap a link in a text from the “ATO” or “myGov”. Both say they won’t send you a link to sign in.
• Type the address yourself. Check refunds and messages at my.gov.au, ato.gov.au or in the official myGov app.
• Call the ATO if unsure. The number is 1800 008 540; don’t reply to the text.
• Report a fake ATO text. Screenshot it and email it to ReportScams@ato.gov.au.
• Report a fake myGov text. Email it to reportascam@servicesaustralia.gov.au.
• Call the ATO straight away if you gave details or paid. Ring 1800 008 540, and call your bank if you shared bank or card details.
• Secure myGov if you entered your sign-in. Call 1800 941 126, change your password and complete the Security review.
• Switch myGov to passkeys or Digital ID. Then turn off your password, as myGov recommends.