Placeholder Content Image

It’s tax time and scammers are targeting your myGov account. Here’s how to stay safe

<div class="theconversation-article-body"><em><a href="https://theconversation.com/profiles/cassandra-cross-122865">Cassandra Cross</a>, <a href="https://theconversation.com/institutions/queensland-university-of-technology-847">Queensland University of Technology</a></em></p> <p>For many, tax time is an exciting part of the year – there’s the potential for a refund. However, it’s also an attractive time for fraudsters looking for ways to get money and deceive unsuspecting victims.</p> <p>Each year Australians lose large amounts of money to scams. In 2023, Australians reported <a href="https://www.accc.gov.au/media-release/scam-losses-decline-but-more-work-to-do-as-australians-lose-27-billion">losses of more than A$2.7 billion</a>. While this is a slight reduction from the $3.1 billion in 2022, there are still millions of victims who’ve suffered at the hands of scammers.</p> <p>Impersonation scams are one common approach. Scamwatch reports that in 2023, <a href="https://www.scamwatch.gov.au/news-alerts/shopping-for-online-bargains-this-black-friday-weekend-make-sure-its-the-real-deal">70% of reports to them</a> involved impersonation.</p> <p>A large number of these were linked to the Australian Taxation Office (ATO) and myGov.</p> <h2>What is an impersonation scam?</h2> <p>Impersonation scams are what they sound like: when an offender pretends to be someone or something they are not. Offenders may pretend to be family members or friends in our contact lists.</p> <p>In many cases, they will say they’re from an organisation such as a bank or a well-known retailer, or a government department – like the ATO.</p> <p>Offenders take on the identity of a known and trusted organisation to increase the chances of success. While we may ignore communications from unknown entities and strangers, we’re more likely to engage with what’s familiar.</p> <p>Additionally, the ATO has a powerful status as a government agency, and we are unlikely to ignore its messages – especially at tax time.</p> <h2>What are they trying to get out of my myGov account?</h2> <p>myGov is the gateway to a range of government services, including Medicare, Centrelink, My Health Record, the National Disability Insurance Scheme, and of course, the ATO.</p> <p>Being able to log in to myGov gives offenders access to a wide range of your personal details. This can help them build a fuller profile of you to potentially commit identity theft (such as opening new accounts in your name).</p> <p>There’s also the potential for direct fraud. With access to myGov, offenders can change your bank account details and redirect any refunds into their accounts, whether from the ATO or other linked services.</p> <p>They can even submit false tax returns, medical claims or other forms to obtain fraudulent funds. As the legitimate owner of the account, you may not immediately notice this.</p> <h2>What does a myGov scam look like?</h2> <p>In most instances, a myGov scam will look like one of the many phishing attempts we all receive on a daily basis. While each approach can be worded differently, their desired outcome is the same: to acquire your personal information.</p> <p>Fraudsters are sending text messages and emails pretending to be from the ATO, advising you there’s a refund available if you click the provided link.</p> <p>Another approach is to flag a “problem” with your tax return or bank account, and direct you to take immediate action via a link. Creating a sense of urgency can trick users into acting in the moment, without thinking through the request.</p> <p>The text or email may also be very neutral, simply stating there’s a new message waiting – with a link to where you can read it.</p> <p>Regardless of what the message says, the goal is to direct you to a website that looks genuine, but is fake. If you enter your myGov details into such a fake site, the offender can capture your login details and use them to log into your actual myGov account.</p> <h2>What to do if you’ve been a victim?</h2> <p>If you have clicked on a scam link and provided your personal details, there are steps you can take.</p> <p><strong>Change your password</strong> and review your account settings if you still have access to your myGov account.</p> <p><strong>Check your bank accounts</strong>, to see what, if anything, has been lost. Contact your bank or financial institution immediately if you notice any withdrawals or suspicious transactions.</p> <p><strong>Contact any other organisation</strong> linked to your myGov account to see if any unauthorised actions have been taken.</p> <p>For anyone who has lost personal information and experienced identity crime, <a href="https://www.idcare.org/">IDCARE is the national support centre</a> for identity crime victims. They will be able to assist with a personalised response plan to your specific situation.</p> <h2>How do I keep my account safe?</h2> <p><strong>Never click on links</strong> in text messages or emails that direct you to log in to your accounts. Always access your accounts independently, through details you have found independently of any text or email.</p> <p><strong>Review your security settings.</strong> There have been recent reports of people’s myGov accounts being targeted <a href="https://www.theguardian.com/australia-news/article/2024/aug/01/ato-mygov-tax-return-refund-scam">with repeated login attempts</a>. Using your unique eight-digit myGov username for logging in can be safer than <a href="https://my.gov.au/en/about/help/mygov-website/help-using-your-account/manage-sign-in-details#updatingyourusername">using your email address</a>.</p> <p><strong>Enable <a href="https://theconversation.com/what-is-multi-factor-authentication-and-how-should-i-be-using-it-191591">multi-factor authentication</a></strong> where possible. myGov uses two-factor authentication in the form of a text message in addition to an online login. While this is not foolproof, it offers an additional layer of protection and can stop offenders accessing your account with only partial pieces of your information.</p> <p><strong>Be vigilant on all communications.</strong> Always keep in mind that all may not be what it seems and the person you are communicating with may not be who they say they are. It is okay to be sceptical and do your own checks to verify details of what is presented to you.</p> <p>Remember, fraudsters thrive on the silence and shame of those who respond or fall victim to their scams. We need to communicate openly about these schemes and talk to family and friends, to increase everyone’s knowledge and awareness.<!-- Below is The Conversation's page counter tag. Please DO NOT REMOVE. --><img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/235785/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /><!-- End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: https://theconversation.com/republishing-guidelines --></p> <p><a href="https://theconversation.com/profiles/cassandra-cross-122865"><em>Cassandra Cross</em></a><em>, Associate Dean (Learning &amp; Teaching) Faculty of Creative Industries, Education and Social Justice, <a href="https://theconversation.com/institutions/queensland-university-of-technology-847">Queensland University of Technology</a></em></p> <p><em>Image credits: Shutterstock </em></p> <p><em>This article is republished from <a href="https://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/its-tax-time-and-scammers-are-targeting-your-mygov-account-heres-how-to-stay-safe-235785">original article</a>.</em></p> </div>

Money & Banking

Placeholder Content Image

The $500 million ATO fraud highlights flaws in the myGov ID system. Here’s how to keep your data safe

<p><em><a href="https://theconversation.com/profiles/rob-nicholls-91073">Rob Nicholls</a>, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a></em></p> <p>The Australian Tax Office (ATO) paid out more than half a billion dollars to cyber criminals between July 2021 and February 2023, according to an <a href="https://www.abc.net.au/news/2023-07-26/ato-reveals-cost-of-mygov-tax-identity-crime-fraud/102632572">ABC report</a>.</p> <p>Most of the payments were for small amounts (less than A$5,000) and were not flagged by the ATO’s own monitoring systems.</p> <p>The fraudsters exploited a weakness in the identification system used by the myGov online portal to redirect other people’s tax refunds to their own bank accounts.</p> <p>The good news is there’s plenty the federal government can do to crack down on this kind of fraud – and that you can do to keep your own payments secure.</p> <h2>How these scams work</h2> <p>Setting up a myGov account or a myGov ID requires proof of identity in the form of “<a href="https://www.afp.gov.au/sites/default/files/PDF/NPC-100PointChecklist-18042019.pdf">100 points of ID</a>”. It usually means either a passport and a driver’s licence or a driver’s licence, a Medicare card, and a bank statement.</p> <p>Once a myGov account is created, linking it to your tax records requires two of the following: an ATO assessment, bank account details, a payslip, a Centrelink payment, or a super account.</p> <p>These documents were precisely the ones targeted in three large data breaches in the past year: at <a href="https://theconversation.com/what-does-the-optus-data-breach-mean-for-you-and-how-can-you-protect-yourself-a-step-by-step-guide-191332">Optus</a>, at <a href="https://theconversation.com/medibank-hackers-are-now-releasing-stolen-data-on-the-dark-web-if-youre-affected-heres-what-you-need-to-know-194340">Medibank</a>, and at <a href="https://asic.gov.au/about-asic/news-centre/news-items/guidance-for-consumers-impacted-by-the-latitude-financial-services-data-breach/">Latitude Financial</a>.</p> <p>In this scam, the cyber criminal creates a fake myGov account using the stolen documents. If they can also get enough information to link to the ATO or your Tax File Number, they can then change bank account details to have your tax rebate paid to their account.</p> <p>It is a sadly simple scam.</p> <h2>How government can improve</h2> <p>One of the issues here is quite astounding. The ATO knows where salaries are paid, via the “<a href="https://www.ato.gov.au/business/single-touch-payroll/what-is-stp-/">single touch</a>” payroll system. This ensures salaries, tax and superannuation contributions are all paid at once.</p> <p>Most people who have received a tax refund will have provided bank account details where that payment can be made. Indeed, many people use precisely those bank account details to identify themselves to myGov.</p> <p>At present, those bank details can be changed within myGov without any further ado. If the ATO simply checked with the individual via another channel when bank account details are changed, this fraud could be prevented. It might be sensible to check with the individual’s employer as well.</p> <p>Part of the problem is the ATO has not been very transparent about the risks. If these risks were clearly set out, then calls for changes to ATO procedures would have been loud and clear from the cyber security community.</p> <p>The ATO is usually good at identifying when a cyber security incident may lead to fraud. For example, when the recruitment software company <a href="https://www.abc.net.au/news/2018-06-06/australian-data-may-be-compromised-in-pageup-security-breach/9840048?itm_campaign=newsapp">PageUp was hacked in 2018</a>, the ATO required people who may have been affected to reconfirm their identities. This was done without public commentary and represents sound practice.</p> <p>Sadly, the millions of records stolen in the Optus, Medibank and Latitude Financial breaches have not led to a similar level of vigilance.</p> <p>Another action the ATO could take would be to check when a single set of bank account details is associated with more than one myGov account.</p> <p>A national digital identity would also help. However, this system has been in development for years, is not universally popular, and may well be <a href="https://www.themandarin.com.au/226280-gallagher-warns-community-support-for-digital-identity-not-ubiquitous/">delayed</a> until after the federal election due in 2024.</p> <h2>Protecting yourself</h2> <p>The most important thing to do is make sure the ATO does not use a bank account number other than yours. As long as the ATO only has your bank account number to transfer your tax rebate, this scam does not work.</p> <p>It also helps to protect your Tax File Number. There are only four groups that ever need this number.</p> <p>The first is the ATO itself. The second is your employer. However, remember you do not need to give your TFN to a prospective employer, and your employer only needs your TFN <em>after</em> you have started work.</p> <p>Your super fund and your bank may ask for your TFN. However, providing your TFN to your super fund or bank is optional – it just makes things easier, as otherwise they will withhold tax which you will need to claim back later.</p> <p>Of course, all the usual data safety issues still apply. Don’t share your driver’s licence details without good reason. Take similar care with your passport. Your Medicare card is for health services and does not need to be shared widely.</p> <p>Don’t open emails from people you do not know. Never click links in messages unless you are sure they are safe. Most importantly, know your bank will not send you emails containing links, nor will the ATO.<!-- Below is The Conversation's page counter tag. Please DO NOT REMOVE. --><img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/210459/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /><!-- End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: https://theconversation.com/republishing-guidelines --></p> <p><em><a href="https://theconversation.com/profiles/rob-nicholls-91073">Rob Nicholls</a>, Associate professor of regulation and governance, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a></em></p> <p><em>Image </em><em>credits: Shutterstock</em></p> <p><em>This article is republished from <a href="https://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/the-500-million-ato-fraud-highlights-flaws-in-the-mygov-id-system-heres-how-to-keep-your-data-safe-210459">original article</a>.</em></p>

Technology

Placeholder Content Image

Cruel myGov scam targeting unsuspecting Aussies

<p>A malicious scam is targeting unsuspecting Aussies struggling with the cost of living expenses promising them a one-off myGov payment to “help you cope” with the crisis.</p> <p>The scam text, shared to Reddit, claims to be from the government service, rather it works by tricking the recipient into sharing their personal details.</p> <p>The scam comes as calls continue to increase for the federal government to raise the rate of welfare payments, which currently see $49.50 per day for singles on JobSeeker and $40.20 per day for Youth Allowance.</p> <p>“myGov: We’re providing $800 in a single payment to help you cope with the cost of living crisis,” the scam text readers, with a link to a fault URL posing as the government service.</p> <p>The recipients of the message warned others to “be careful of this one”, expressing concerns over how easily the scam could deceive vulnerable Aussies struggling to stay afloat during the cost of living crisis.</p> <p>“I’m sure lots of people will fall for this,” one said.</p> <p>“Lucky their spoofed website doesn’t even work.”</p> <p>MyGov has issued several alerts warning people about various scams spoofing the service.</p> <p>Its advice for suspicious messages is to never reply, open any links or download any attachments.</p> <p>“myGov will never send you an email, SMS message, or direct message or private chat on social media, asking you to click on a link to sign in to myGov, enter your bank details, tell us your personal details, including your Customer Reference Number (CRN) or Tax File Number (TFN),” it said.</p> <p>Any customers who have shared their myGov details and other personal information to scammers should contact the Services Australia Scams and Identity Theft Helpdesk.</p> <p><em>Image credit: Reddit</em></p>

Money & Banking

Placeholder Content Image

“So many non-technical people will fall for this”: New myGov scam that looks real

<p>Australians are being urged to be especially cautious of a new online myGov scam that purports to offer hundreds of dollars in tax refunds – and once you click through, the interfaces are so expertly copied that even highly vigilant scam experts are worried people will be taken in, and could potentially lose all their savings. </p> <p>The email, once it drops in your inbox, will inform you of an outstanding myGov refund, and will appear to genuinely be from the government agency. </p> <p>Email security software company MailGuard raised the alarm this week when it intercepted one of the suspect messages.</p> <p>Once you click through, you’ll be asked to enter login details and billing info. “These details will again be stolen by the criminal and will likely be used for their personal financial gain or sold on the dark web,” MailGuard warns.</p> <p>Space, software and politics expert @oferzelig deliberately went through all the steps to find out what happens, and then published the very disturbing results on Twitter.</p> <p>“A new ‘You have a message from myGov’ scam. I entered the link using a safe sandbox as I was curious,” he wrote. </p> <p>“They mimicked all the major Aussie banks' login pages, the bastards. So many non-technical people will fall for this, unfortunately 😢”</p> <blockquote class="twitter-tweet"> <p dir="ltr" lang="en">A new "You have a message from myGov" scam. I entered the link using a safe sandbox as I was curious.</p> <p>They mimicked all the major Aussie banks' login pages, the bastards.</p> <p>So many non-technical people will fall for this, unfortunately 😢<a href="https://twitter.com/troyhunt?ref_src=twsrc%5Etfw">@troyhunt</a> <a href="https://t.co/ZJ25x9XuoZ">pic.twitter.com/ZJ25x9XuoZ</a></p> <p>— 𝓞𝓯𝓮𝓻 𝓩𝓮𝓵𝓲𝓰 🚀💻 🇦🇺 🇮🇱 (@oferzelig) <a href="https://twitter.com/oferzelig/status/1610200580076769281?ref_src=twsrc%5Etfw">January 3, 2023</a></p></blockquote> <p>Services Australia, which delivers myGov, is aware of the scam and urged Australians to be on the alert. “We will never send you an email or SMS with a hyperlink directing you to sign in to your myGov account,” it says.</p> <p>“If you get an email like this, don’t open any links, download attachments or respond.</p> <p>“We’ll never ask you to open a link or a file attached to an email.”</p> <p>“When you are signed in to myGov, the messages in your myGov Inbox are secure. It’s safe to open links included in myGov Inbox messages,” it says.</p> <p>Check out all of the images below to see just how convincing the fake pages are – and please be extra cautious!</p> <p><em>Images: Twitter</em></p> <p> </p> <p> </p>

Money & Banking

Placeholder Content Image

New scam impersonating government service

<p>A warning has been issued about a new scam that seeks to lure Aussies into handing over their bank details by cloning the myGov website.</p> <p>The warning was issued yesterday by authorities on the <a href="https://www.staysmartonline.gov.au/alert-service/beware-fake-medicare-email" target="_blank"><strong><span style="text-decoration: underline;">Stay Smart Online</span></strong></a> website.</p> <p>The scammers are issuing an email that is designed to look as if it’s been sent from Medicare, asking the recipient to “please kindly update your Electronic Funds Transfer (EFT) payments”.</p> <p>If the link on the email is clicked, it takes the user to the clone site: mygovau.net.</p> <p>The real site is mygov.au.</p> <p>The government website links several services such as Medicare, Centrelink and the Australian Taxation Office.</p> <p>"If you input your login details you are directed to also enter your secret security question and answer, before you're taken to the fake Medicare website to input your bank account details," the Stay Safe Online warning states.</p> <p style="text-align: center;"><img width="500" height="334" src="https://oversixtydev.blob.core.windows.net/media/7819614/1_500x334.jpg" alt="1 (166)"/></p> <p>Dr Cassandra Cross, criminologist from the Queensland University of Technology, told the <a href="http://www.abc.net.au/news/2018-07-05/mygov-scam-clones-government-website-medicare-phishing-email/9942908" target="_blank"><em><strong><span style="text-decoration: underline;">ABC</span></strong></em></a> that online safety is more crucial as scams become more sophisticated.</p> <p>"They [cloned websites] look authentic, they look genuine. In this case the only difference is the URL," Dr Cross said.</p> <p>Dr Cross said this scam was like phishing emails claiming to be from banks that ask recipients to login to their account from a fake URL.</p> <p>"But they're using something a bit more timely and just a little bit different to catch people off guard and increase their chance that people will respond to it," she said.</p> <p>"We've done a lot of awareness around not putting information into banking websites that you'd click on from a link, but people wouldn't necessarily associate that same message with myGov.</p> <p>"This time of year we also see a lot around the Australian Tax Office, clinking on links to gain tax refunds."</p> <p>Previous scam indicators such as spelling mistakes and poor grammar can no longer be relied upon.</p> <p>"I don't think we can rely on those indicators as successfully now, because offenders have realised that people are looking for that and they've upped the ante, so to speak, so they've increased the level of sophistication that they put on these attacks."</p> <p><strong>How to make sure you are not clicking on a scam email</strong></p> <p>* It is recommended that if you receive a message from an organisation, never click on the links in emails or text messages.</p> <p>* Login to your official myGov account by typing the correct URL into your browser, and then check your website inbox for any legitimate messages from Medicare.</p> <p>* Always be suspicious of messages that aren’t addressed to you directly and if you are still unsure, contact the organisation separately.</p> <p> Have you received this scam in your emails? Let us know in the comments below.</p>

Technology

Our Partners