It’s late October, the first quarter BAS is on your mind, and a text arrives saying there’s a problem with your tax account. There’s a link to sort it out. Or it’s your bank, saying a payment has been held and you need to confirm your details.
Don’t tap the link. There’s a better way to check, and it takes about the same amount of time.
When BAS is actually due
For quarterly lodgers, the ATO’s due dates put the July to September quarter at 28 October. If you use a registered tax or BAS agent, different dates may apply.
Knowing the real date helps. A message claiming something is overdue before it’s due is easy to spot.
What the ATO says it will never do
The ATO’s scam guidance is specific. The ATO may contact you by phone, email, SMS or post, but it says it will never:
- send an unsolicited SMS that contains a link
- ask for personal identifying information by SMS or email
- send unsolicited emails containing links or QR codes
It also warns about a nasty detail. Scam texts can appear in the same message thread as genuine ATO texts on your phone, so a familiar-looking thread proves nothing.
Other warning signs the ATO lists include unexpected messages about refunds or debts you didn’t know about, links asking you to log in, and threats or urgency like “your account will be locked”.
Banks work the same way
The Australian Signals Directorate says financial institutions and other large organisations would never send you a link and ask you to enter personal or financial details. Its advice for any message you’re unsure about is to go directly to a source you trust, through the official website or app, and not to use the links or contact details in the message.
How to check without the link
- Open the app or website yourself. Type ato.gov.au or my.gov.au into your browser, open your bank’s app, or open your accounting software, and look for any notice there.
- Still unsure it’s the ATO? Ring them. The ATO’s advice is not to respond to the message, and to call 1800 008 540 to check.
- Report it anyway. The ATO asks people to report impersonation scams even if they didn’t respond. For a scam text, take a screenshot and send it through the ATO’s online Report a scam form. Then delete the message.
The twist: real ATO emails go missing too
“Ignore everything that says ATO” isn’t a safe rule either. Earlier this year we had a ticket from a client business that was having trouble receiving genuine emails from the ATO.
If you’re expecting something from the ATO and it hasn’t turned up, don’t go looking for it through links in texts. Sign in to the ATO’s online services yourself or ask your tax agent, and let IT check whether ATO emails are being held or filtered before they reach you.
The ATO notes that its real emails come from addresses ending in ato.gov.au, and its phone calls show as No Caller ID.
If you already tapped and entered details
If you paid money or gave out sensitive personal information, the ATO’s advice is to call it immediately on 1800 008 540. It also says to:
- contact your bank if you gave card or bank details
- contact the bank you paid to and lodge a fraud report
- make a report to police
- report cybercrime to the Australian Cyber Security Centre through ReportCyber
If it was a work phone, or you typed a work password, tell IT as well. ASD’s advice is to let your IT department know about scam messages received on a work laptop or phone.
The one step: open myGov, your bank app or your accounting software yourself. Never sign in from a text.
If you’d like a hand checking that ATO emails are reaching the right inbox, get in touch.