Originally published for EOFY 2025. Reviewed as year-round guidance on 15 September 2026.
A refund, a debt or a reason to rush?
Tax-time messages arrive when finance teams already have plenty to do. A fake refund, overdue payment or document request can borrow that urgency to push someone into an unsafe action.
This guide began as an EOFY 2025 alert. The lesson applies year-round: verify the request through a channel you already trust, not the link, QR code or phone number supplied in the message.
Urgency is a reason to check, not skip the process.
Avoid acting inside the unexpected messageUse the official portal or established contact.
Do not trust caller ID aloneTell the right people promptly.
Preserve the message and approximate timePractical checkpoints, not a guarantee of security or compliance.
What to check
Do not follow the login link
The ATO says it does not send unsolicited messages linking you to supply personal information or log in.
What to check
Type the official address yourself or use a trusted bookmark. Check suspicious contact through the ATO’s published contact options.
Protect payment changes
A supplier or accountant can be impersonated too.
What to check
Verify changed bank details using a previously established number. Use your normal approval process even when the email appears to come from a familiar person.
Know the response route
A mistaken click or disclosure should be reported, not hidden.
What to check
Contact IT immediately. If money or banking details are involved, contact your bank through an established channel. Use the ATO’s official scam and identity support instructions where relevant.
Make verification a normal habit
Use short examples in team training. Focus on the requested action, not just poor spelling: modern scam messages can be well written.
Review email protection and stronger authentication with IT. Neither replaces a clear process for checking unexpected requests.
Sources & further reading
Make the next step practical
Talk to ITFR about your business, priorities and the controls that fit.
