Key Highlights

  • The ATO is warning taxpayers about a fake email that claims they have "a new payment update in your ATO profile".
  • the email claims to come from the ATO.
  • The email includes a link.
  • The file is malicious remote desktop software.

The ATO is warning taxpayers about a fake email that claims they have "a new payment update in your ATO profile". The email is designed to get people to download software that gives scammers remote access to their computer. The alert was published in September 2026, during the busiest stretch of tax time. With the 31 October 2026 deadline for self-lodgers close, many people are expecting legitimate messages about refunds, income statements and notices of assessment.

How the 'new payment update' scam works

the email claims to come from the ATO. It tells recipients either that there is "a new payment update in your ATO profile" or that they need to review their income statement.

The email includes a link. The link leads to a web page that asks the visitor to view or download a file.

The file is malicious remote desktop software. The ATO warns that once it is installed, it can give scammers access to the victim's device.

Why remote access is so dangerous

Remote desktop tools have legitimate uses, such as IT support. In a scammer's hands, the same capability can let someone see the screen, move files and operate the computer as if they were sitting at it.

Hypothetical example: a taxpayer waiting on a refund receives an email headed "Payment update", clicks the link and downloads what looks like a statement. Nothing obvious happens. Behind the scenes, the scammer now has a way into the computer. Days later, the victim logs into online banking or myGov, and the session is open on a device the scammer can reach.

That is why the ATO's warnings focus on the first click. Once software is installed, the risk lasts beyond the moment the email is opened.

The ATO's rules for spotting a fake

The ATO says it "will never send an unsolicited message that directs you to a log in page". Any email or SMS from the "ATO" with a link to sign in or download a file should be treated with suspicion.

Earlier ATO alerts set out other rules worth remembering. In October 2025, the ATO warned about a DocuSign-themed scam and said: "The ATO will never use DocuSign to finalise a tax refund."

A February 2026 ATO alert, issued about a crypto-themed scam, said the ATO will never ask for payment or personal details through unsolicited contact, and will never threaten arrest by email or SMS.

What the latest ATO scam figures show

The most recent ATO scam data, updated on 25 September 2026, covers August 2026. The ATO recorded 3,265 scam reports that month, up 36%.

Email made up 98.6% of reports, according to the ATO. SMS accounted for 0.4%, phone calls for 0.8% and social media for 0.2%. in August.

Email has long been the main channel. In a March 2024 alert, the about 75% of the email scams reported to it over the previous six months linked to a fake myGov sign-in page.