BAS is due 28 October. So is the fake ATO email

Quarter 1 BAS, covering July to September, is due on Wednesday 28 October, according to the ATO’s due dates page. If you lodge online you may be eligible for an extra two weeks, and a registered tax or BAS agent may be able to get you more time.

Either way, the next week or so is busy for whoever does the books. Busy is when a convincing email gets acted on without a second look.

Two emails that look like normal work

The fake ATO message. It says there’s a problem with your account, a refund waiting or a debt to sort out, and gives you a link or QR code to log in. The ATO’s verify or report a scam page says the ATO will never send unsolicited messages containing hyperlinks or QR codes, and will never ask for your TFN, bank details or myGov login by email.

The changed bank details. An email from a supplier you really do deal with, saying they’ve changed banks and the next invoice should be paid to the new account. Sometimes it really does come from their email address, because their mailbox has been taken over. The Australian Cyber Security Centre’s page on business email compromise describes exactly this: emails that ask for payment of an invoice or a change to bank account details.

The second one is the more expensive of the two, and the harder to spot, because nothing about it looks wrong.

What we’ve seen

In July 2026 a client forwarded us an invoice email demanding payment, which they’d already picked as a fraud attempt. That’s the right outcome. Someone paused, it got flagged, and nobody paid it.

Over the 12 months to 18 August 2026, we logged 13 tickets from 11 clients about suspicious, spam, phishing or fraudulent emails. That figure only covers the emails someone raised with us. Messages caught by filtering, or quietly deleted by staff, don’t show up in it.

Three rules for the fortnight

1. Never change bank details because of an email. Call the supplier on a number you already have, from a past invoice or their website, not the number in the email. Speak to someone you’ve dealt with before, and confirm the change with them.
2. Go to the ATO directly. Type the address into your browser or use the official app. Don’t follow a link in a message to get there. If you’re not sure a call, text or email is really from the ATO, the ATO says to call 1800 008 540 and check.
3. Treat urgency as a warning sign. “Pay today”, “your account will be locked” and “legal action will be taken” are all phrases the ATO lists as signs of a scam text. A real supplier, or the ATO, can wait ten minutes for you to make a phone call.

If someone has already clicked or paid

• Call your bank straight away and ask them to try to stop or recall the payment.
• If it was an ATO scam and you paid money or gave out personal details, the ATO says to call them immediately on 1800 008 540.
• If you typed in a password, change it, and tell your IT provider. The ACSC lists unexpected password resets, unusual sign-in alerts and emails being moved or deleted as signs a mailbox may be compromised, so ask for those to be checked.
• Report it. The ATO’s page explains how to report an ATO scam, and cybercrime can be reported through cyber.gov.au.

Nobody in the office should feel silly for reporting a click. The sooner someone knows, the more there is that can be done.

Next step

Forward this to whoever pays the bills, today, before BAS week gets hectic.

If you’d like a second opinion on an email that doesn’t feel right, get in touch.