Is that ATO tax refund text real? The one-line test
Timing is why this one matters right now. July was the single worst month for scam losses in Australia in 2025, and the reason is straightforward: between July and October millions of Australians are genuinely expecting messages about their return. A fake "your refund is ready" in July doesn't raise the suspicion it would in March.
What the fake ones say
Two shapes, one mechanism. Either money you weren't expecting, or access you're about to lose. Both manufacture the same urgency, and both end at a copy of the myGov sign-in page that harvests your credentials in seconds.
The ATO has also flagged a February 2026 variant: an email demanding you "declare" cryptocurrency holdings in a so-called non-KYC wallet by ringing a number in the email. And worth knowing specifically — the ATO says it will never use DocuSign to finalise a tax refund.
Three tests, in order of certainty
- A link in an unsolicited SMS. Conclusive. The ATO's published statement is unambiguous, and myGov sends exactly one kind of text: "you have a new message in your inbox", never with a sign-in link.
- The payment destination. Every genuine ATO payment goes to the Reserve Bank of Australia. If you're given a BSB, check it belongs to the RBA. Gift cards, crypto, ATM cash, international wire, or a personal account are all impossible for a real tax debt.
- Where it asks you to go. The real myGov is only ever reached by typing my.gov.au yourself, or via the app. If the notice is genuine it will be sitting in your myGov Inbox. If your Inbox is empty, the message was fake.
Why this scam is worse than a parcel text
A fake AusPost fee costs you $2.99 and a card number. This one is aimed at your myGov credentials, and that unlocks considerably more.
- Refund redirection — changing the bank account on your ATO record so your genuine refund goes to them.
- Tax identity fraud — lodging a false return in your name using your TFN, and collecting the refund before you file.
- Superannuation — the ATO has seen scammers set up a self-managed super fund in someone's name, or alter an existing one, to reach the balance.
- Onward identity crime — the details get used, or sold, well beyond the single refund.
ATO phishing losses illustrate the trajectory: roughly $4.6 million in the first months of 2024, against $13.7 million for the same period in 2025.
What the ATO does actually do
Being fair to them, they do send messages — which is what makes the distinction worth learning rather than just distrusting everything.
They may send an SMS or email asking you to contact them, or to supply information about a return or application you've already lodged. What they will never do is send an unsolicited message containing a link asking you to log in or return personal identifying information. Their words: they may ask you to contact them, never to log in via a link.
So a text saying "please call us about your recent lodgement" can be genuine. Ring them on a number you found yourself — the ATO is 1800 008 540 — not one from the message.
If you've already clicked
- Don't use any number from the message. Some of these scams include a fake phone number precisely so that "ringing to check" reaches the scammer.
- Sign in to myGov properly — app or typed address — and change your password. Then check your linked services and your bank details on the ATO record for changes you didn't make.
- Ring the ATO on 1800 008 540 and tell them your credentials may be compromised. If you suspect a return has been lodged in your name, say so — that's a specific process.
- If you entered card or banking details, ring your bank's fraud line using the number on your card.
- Call IDCARE on 1800 595 160 (weekdays 8am–5pm), or the Australian Cyber Security Hotline on 1300 292 371 after hours. Ask about a temporary credit ban.
- Report it at the ATO's scam alerts page and Scamwatch.
The seasonal thing worth telling a parent
Between July and October the volume of genuine tax messages rises, and so does the plausibility of the fakes. That's the window to mention it — not as a warning about the ATO, but as one sentence they can actually keep:
"Anything about tax, you check it in the myGov app. Never from the message."
And for the ones that don't fit any rule — a brand nobody's written about, or a phone call that can't be forwarded — Is it a scam? takes a forwarded text, a screenshot, or a typed description and answers in seconds. It's the same check whether or not the scam has a published rule yet, which during tax time is most of them.
Common questions
Does the ATO send text messages with links?
No. The ATO's published position is that it will never send an unsolicited SMS containing a hyperlink, and it removed links from unsolicited texts in Tax Time 2024. Any ATO or myGov SMS with a tappable link is a scam. myGov sends only one kind of text — a notification that there is a message in your inbox — and it never contains a sign-in link.
How do I check whether an ATO message is genuine?
Ignore the message entirely and open the myGov app, or type my.gov.au yourself. If the notice is real it will be in your myGov Inbox. If the Inbox is empty, the message was fake. You can also ring the ATO on 1800 008 540 — a number you found yourself, never one from the message.
How can I tell a fake ATO payment demand?
Check where the money is going. Every legitimate ATO payment goes to the Reserve Bank of Australia, so verify the BSB belongs to the RBA. The ATO will never accept gift cards, cryptocurrency, ATM cash deposits, international wire transfers, or payments to a personal bank account.
Why are tax scams worse in July?
Because genuine tax messages are expected then. July was the highest month for scam losses in Australia in 2025, and ATO impersonation spikes from July through October. A fake "your refund is ready" in July arrives when millions of people are actually waiting for one, so it doesn't trigger the suspicion it would in March.
What is tax identity fraud and how do I prevent it?
A criminal lodges a false return using your TFN and personal details, then collects the refund before you file. The simplest defence is to lodge your own return early — if yours is already in, the fraudulent one fails. Protecting your TFN and using a registered tax agent also help.
Does the ATO use DocuSign?
Not to finalise a tax refund. The ATO has specifically flagged that it will never use DocuSign for that purpose, so an "outstanding DocuSign requiring urgent review" message claiming to be about your refund is a scam.
I clicked the link and entered my myGov details. What now?
Sign in to myGov the proper way — app or typed address — and change your password immediately. Check your linked services and the bank account details held on your ATO record for changes. Ring the ATO on 1800 008 540 to report the compromise, and call IDCARE on 1800 595 160 about a credit ban if identity documents were exposed.
Can the ATO ever legitimately text or email me?
Yes. The ATO may send an SMS or email asking you to contact them, or to provide additional information about a return or application you have already lodged. What it will never do is send an unsolicited message with a link asking you to log in or return personal identifying information.
For the messages no rule covers yet
Is it a scam? checks any text, email, screenshot or described phone call — including the brands nobody has published advice about. A plain answer in seconds, and the family told when it's real.
See how it works