How to Spot Fake Australia Tax Office (ATO) Phishing Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Australia Tax Office (ATO) Phishing Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Phishing emails impersonating the Australian Taxation Office (ATO) are a common threat to small businesses across Australia. These messages attempt to steal login credentials, financial details, or install malware by pretending to offer tax refunds, demand immediate payment, or request urgent verification of business information. Knowing how to identify a fake ATO email helps protect your organisation from fraud and data breaches.

Common Signs of an ATO Phishing Email

Suspicious Sender Address

Check the actual email address, not just the display name. Legitimate ATO emails come from domains ending in @ato.gov.au. Scammers often use addresses that look similar but include extra words, misspellings, or unrelated domains such as @ato-tax-refund.com or @australiantaxoffice.net.

Urgent or Threatening Language

Fake ATO messages often create a sense of panic. They may claim you owe immediate tax, face legal action, or must act within 24 hours to receive a refund. The ATO does not use threats or demand instant payment via email.

Unexpected Attachments or Links

Be cautious of attachments named Tax_Refund_Form.pdf.exe, ATO_Invoice.zip, or similar files. Hover over any links without clicking to see the real destination. If the URL does not match ato.gov.au, do not open it.

Requests for Personal or Financial Information

The ATO will never ask you to reply to an email with your tax file number, credit card details, or myGov login credentials. Any message requesting this information by return email is fraudulent.

Poor Spelling and Formatting

While some scams are well-crafted, many phishing emails contain spelling errors, inconsistent formatting, or generic greetings such as Dear Customer instead of your business name.

What to Do If You Receive a Suspicious Email

1. Do not click any links or download attachments in the message.
2. Do not reply to the sender or provide any personal or business details.
3. Mark the email as junk or phishing in your email application:
   • In Microsoft Outlook, select the message, then choose Report Message > Phishing from the ribbon.
   • In Gmail, open the message, select More (three vertical dots), then choose Report phishing.
   • In Apple Mail, select the message and choose Message > Move to Junk from the menu bar.
4. Delete the email from your inbox and empty the Deleted Items or Trash folder.
5. If you accidentally clicked a link or entered details, change your passwords immediately and contact your IT support provider for assistance.

How to Verify a Legitimate ATO Communication

1. Visit the official ATO website directly by typing ato.gov.au into your browser address bar.
2. Log in to your myGov account at my.gov.au to check for official messages in your inbox.
3. Call the ATO on their official published number if you are unsure about a communication.
4. Forward suspicious emails to the ATO at [email protected].

The ATO may send emails to notify you of new messages in your myGov inbox, but they will not include links asking you to log in or provide sensitive information directly in the email.

Never enable macros in an Office document received from an unexpected sender, even if it claims to be an ATO form or invoice. Macros are a common method for delivering malware.

Protecting Your Business from Future Attacks

• Ensure all business email accounts use multi-factor authentication (MFA).
• Keep operating systems, browsers, and email applications updated with the latest security patches.
• Train employees to recognise phishing attempts and report suspicious messages immediately.
• Use spam filtering and email security solutions provided by your IT support partner.

If you believe your business has been targeted by an ATO phishing scam or you need help securing your email environment, contact your IT support provider for assistance.

Still Having Issues?