Is that ATO message real? The business version
That one rule catches the overwhelming majority of these. ATO Assistant Commissioner Ben Foster has said it plainly: the ATO and myGov do send emails and SMS, but will never send one containing a hyperlink directing you to a login page for their online services.
The reason it works is that it does not ask you to judge anything. You do not have to spot a misspelling, or notice a slightly wrong domain, or decide whether the tone sounds official. The presence of the link is the answer.
Why BAS week is different
Criminals read the calendar, and the last week of October, February, April and July is the best week of the quarter to send a fake tax demand.
An out-of-the-blue message about a tax debt is implausible in the middle of a quiet month. In BAS week it is exactly what you were expecting — you already have the tax office on your mind, money is already moving, and the person who opens the email is often the person least able to check it.
Nothing about that is hard to believe in the last week of the quarter. Which is the whole point.
The variant with no link at all
Everything above tells you to distrust the link. So the more careful version does not include one.
There is nothing to click, so every "don't click the link" instinct has nothing to grip — and so does every link-scanning email filter. Services Australia has warned people to be wary of emails asking for identity documents or personal identifying information, and this is why. The request itself is the tell. A government agency does not collect your identity documents by return email.
The Sender ID Register: useful, but not a verdict
Australia's SMS Sender ID Register commenced on 1 July 2026. Registered branded sender IDs — "ATO", "myGov", a bank name — keep displaying their name. Messages using an unregistered branded sender ID are now labelled "Unverified" by the carrier and grouped together in one thread with other unregistered senders, including scams.
That is a genuine improvement. It is not a verdict, and it is worth being precise about why:
- "Unverified" does not prove a message is a scam. A legitimate business that simply did not register in time gets the same label.
- A registered name does not prove the contents are true. The register verifies who sent it, not whether what they said is honest.
- Email is unaffected. Making SMS impersonation harder pushes pressure toward the channel where spoofing still pays — which for a business is email, and email is where the invoices are.
The part that applies to your own business
This is the half of the change most small businesses have missed, and it cuts the other way.
Two practical notes. Registration goes through your telco or messaging provider, not directly. And your details on the Australian Business Register must be current for it to work — ACMA checks the ABR's authorised contact or service-of-notice email, so an out-of-date ABR entry will stop the registration.
If your reminders have started landing in a strange grey thread and customers have stopped turning up, that is worth checking before you blame the message provider.
Being suspicious is not enough
The uncomfortable finding, and the reason a habit beats vigilance: CommBank research published in January 2026 found roughly a third of scam victims surveyed were suspicious but went ahead anyway. The most common reason scams succeeded was simply that they looked legitimate.
What to do with the next one
- Use nothing in the message. Not the link, not the number, not the attachment, not the reply button. All of it was supplied by whoever sent it.
- Open ATO online services yourself — ato.gov.au or the app, signed in the way you normally do. A real liability is visible there.
- If you want to ring, find the number on ato.gov.au, not in the message.
- Say it out loud to whoever pays the bills. In a four-person business the person who opens the email often is not the person who would know.
And if you have already clicked or replied: change that password immediately and anywhere it was reused, check your ATO and myGov details for changed contact or bank information, ring the ATO on a number from their site, and call IDCARE on 1800 595 160. If money has moved, ring your bank first and ask for a recall.
Common questions
Does the ATO ever send emails or texts with links?
The ATO does send emails and SMS, but ATO Assistant Commissioner Ben Foster has stated plainly that it will never send an email or SMS with a hyperlink directing you to a login page for its online services. That single rule catches most impersonation attempts. If a message asks you to click through and sign in, it is not the ATO - regardless of how it is worded or who it appears to come from.
What does the 'Unverified' label on a text mean?
Australia's SMS Sender ID Register commenced on 1 July 2026. Registered branded sender IDs such as 'ATO' or 'myGov' keep displaying their name; messages using an unregistered branded sender ID are labelled 'Unverified' by the carrier and grouped in a thread with other unregistered senders. It is a useful signal but not a verdict - the absence of a brand name does not by itself prove a message is illegitimate, and a registered name does not prove the contents are true.
Do we need to register our own business sender ID?
If your business sends branded text messages - appointment reminders, delivery notifications, anything showing your name instead of a number - then yes, you were required to register the sender ID with your telco or message provider before 1 July 2026. If you did not, your texts may now display as 'Unverified' and be grouped with scam messages. Your details on the Australian Business Register must be current for registration to work.
An ATO email asked us to reply with identity documents. Is that a scam?
Yes. Services Australia has warned people to be wary of emails asking for identity documents or personal identifying information, and the ATO does not collect them that way. This variant is worth knowing precisely because it contains no link at all - so every 'don't click the link' instinct and every link-scanning filter has nothing to work with. The request itself is the tell.
Why are BAS weeks worse?
Because an unexpected tax message is most believable when you are already expecting to deal with the tax office. The last week of October, February, April and July is when Australian small businesses have the most payments moving and the least attention to spare. An email that would get a second look in a quiet month gets actioned on the 27th.
The message came from a number we have received real ATO texts from before. Doesn't that prove it?
No. Scammers can spoof sender information so a message appears in an existing thread alongside genuine ones. A message landing in the right thread is not evidence of anything. Check by going to the ATO's online services yourself, or by ringing a number you found on ato.gov.au - never one supplied in the message.
What if we have already clicked or entered details?
Act now rather than waiting to be sure. If you entered credentials, change that password immediately and anywhere else it was reused, and check your myGov and ATO online services for changed contact or bank details. Ring the ATO on a number from ato.gov.au. Call IDCARE on 1800 595 160 - it is Australia's free national identity and cyber support service. If money moved, ring your bank first and ask for a recall.
We were suspicious but paid anyway. Is that unusual?
No, and it is worth saying out loud. CommBank research published in January 2026 found roughly a third of scam victims surveyed were suspicious but proceeded regardless, and that the most common reason scams succeeded was simply that they looked legitimate. Suspicion on its own is not a defence. A habit that does not depend on your judgement at the time is.
Forward it before BAS day
Send the email, text or a photo of the letter to Is it a scam? and get a plain-English verdict back in seconds. You and up to three others, unlimited by email and WhatsApp, with a tax invoice for a deductible expense.
See the Business plan