How to check whether a message from the ATO, myGov or Centrelink is real

How to check whether a message from the ATO, myGov or Centrelink is real

"ATO: you are entitled to a tax refund of $342.18. Confirm your bank details here." Or the opposite: "Services Australia: you have an outstanding Centrelink debt. Avoid further action by paying here." Government agencies make an excellent disguise for scams: everyone knows them, nobody wants trouble with them, and their real processes are complicated enough that a fake message seems believable.

These campaigns come in waves and repeat the same skeleton as fake unpaid toll or fine texts and fake parcel texts: a known organisation + money pending (in your favour or against you) + urgency + a link. Learn to check one and you can check them all.

The key rule: government agencies don't do business through links in texts

Remember two things:

1. Treat any unexpected text or email that asks for your bank details, passwords or a payment through a link as fake until you've checked it yourself. Your online dealings with the Australian Taxation Office (ATO) and with Services Australia (Centrelink, Medicare, Child Support) happen inside myGov and the agencies' official online services, which YOU open yourself and sign in to with your own details or your myID.
2. A real refund doesn't need you to "confirm your details" through a link, and certainly not your card details. If anything about your refund needs your attention, you'll see it when you sign in to myGov yourself and open your ATO online services.

Any message pushing you to tap a link to claim, pay or "sort out" something with a government agency is suspicious by default. Not because agencies never send messages, but because a link in a message is not how you should deal with them.

What the fake message looks like

• The refund. The most effective hook during tax time (1 July to 31 October): "you're owed a refund", with a specific, believable amount. It takes you to a fake site imitating myGov or the ATO, where you enter your personal and bank details. The Do Not Call Register even publishes an alert about end of financial year tax scams.
• The debt or the threat. "Final notice before legal action", "you have an outstanding Centrelink debt", "a warrant will be issued for your arrest". It plays on fear instead of hope, but the destination is the same: your details and your card.
• The account or the update. Variants asking you to "verify your myGov account", "update your details", "confirm your Medicare information" or send your Tax File Number (TFN), all through a link. Less urgent on the surface, just as fake.
• Lookalike addresses. Links containing "mygov", "ato", "centrelink" or "medicare" plus hyphens and extra words, on domains that aren't official. Australian Government websites end in .gov.au: check where the address really ends, not just what it contains.
• A sender that proves nothing. As with any text: the sender can be faked, and it neither proves nor disproves anything.

How to check whether anything is real

The method is the usual one: close the message and go to the official channel yourself. With government agencies it's even clearer, because the official channels are unique and well known:

1. Don't tap the link. Close it.
2. Go to the official site yourself. Type my.gov.au into your browser, or open the official app you already use. Don't get there through the link in the message or a hurried search.
3. Sign in with your own details or myID and check. If there's a refund, a debt, a letter or something you need to do, it'll be in your myGov inbox or your linked ATO and Centrelink online services. If there's nothing there, the message was fake.
4. If you're not comfortable online, call the agency on its official phone number (looked up yourself on the official website, not taken from the message) or ask for help in person.

If something real exists, you deal with it inside myGov or the agency's official services. Never through a link in a message. It's exactly the same habit we recommend for checking a call or text from your bank, which you'll find in our guides.

What to do if you've already tapped or entered details

• You only tapped and closed it: almost certainly nothing happened. Block, delete and move on.
• You entered card details: call your bank now, block the card and ask for a new one. Watch your transactions over the following weeks.
• You entered your myGov sign-in details or a code: change your password as soon as possible, signing in yourself at my.gov.au, and check for changes you don't recognise, such as new bank details, a new email address or phone number, or newly linked services. Contact the ATO or Services Australia on their official numbers, and IDCARE (1800 595 160) for free support if you think your identity has been compromised.
• Report it to Scamwatch, the national scam-reporting service, and, if you lost money, to police through ReportCyber, which you'll find via the AFP's cybercrime page. Include screenshots of the message and the link.
• Report the sender's number in the spam numbers directory.

Quick questions

Does the ATO ever really send texts? Government agencies may send some informational messages, for example to let you know there's new mail in your myGov inbox. But a genuine notice points you to sign in to myGov YOURSELF; it doesn't ask for your details or a payment in the message itself. When in doubt, treat it as unverified and check in myGov.

And Centrelink or Medicare? The same: informational messages, yes; handling your payments or personal details through a link in an unexpected message, no. Services Australia letters can reach you through your myGov inbox, which you open yourself, not by tapping links you've been sent.

Are these scams more dangerous at tax time? Yes, because the context helps the scammer: everyone's thinking about their tax return and a "refund waiting" fits right in. From July to October, be doubly wary of any tax message with a link.

Is an email with the official logo more trustworthy than a text? No. A logo can be copied in a minute and email senders can be faked too. Apply the same rule: no links from messages; go to myGov yourself.

If you've received one of these messages, report it in the NoCall spam numbers directory: these campaigns change their disguise with the season, and your report helps the next person spot the pattern in time.