If you lodged your tax return in the last few days, an email warning of a "discrepancy" in that return may look perfectly timely. That is exactly why scammers use it. Services Australia is warning about fake myGov emails addressed "Dear myGov Customer" that claim something is wrong with a tax return, threaten legal action and attach a file. With the deadline only just passed, recent lodgers are an obvious target.

The lures doing the rounds

Services Australia keeps a page listing myGov Phishing emails. Two of the examples on it are aimed squarely at people who have just dealt with their tax.

The first is an email about a tax return. It opens "Dear myGov Customer", says there is a discrepancy in the return, warns of legal action and includes an attachment.

The second is a "lodgement notification" email. It claims there have been changes to your account, encouraging you to open or click something to check them.

The same page lists other myGov scam types too. They include emails asking you to update your details or EFT information so a refund can be paid, emails about an "unclaimed subsidy", and messages saying your account has been locked or that suspicious activity has been detected.

The refund-themed version deserves particular attention right now. Anyone waiting on money from the ATO may be tempted by a message saying their refund can't be paid until bank details are confirmed. Entering those details on a fake page can hand scammers both your financial information and your myGov sign-in.

Attachments carry their own risk. Opening a file from an unknown sender can lead to a fake log-in page or install malicious software, which is why the "discrepancy" email's attached document is such a red flag.

Why fresh lodgers are a target

The timing helps the scam. Someone who lodged on deadline day is expecting to hear from the government, may be waiting for a refund, and may be anxious about having made a mistake.

A message that mentions a discrepancy and legal action plays on that anxiety. A message about an account change plays on the fact that many people did, in fact, log in to myGov recently.

Generic greetings are a clue. Genuine government correspondence about your tax affairs is generally addressed to you, while "Dear myGov Customer" is a hallmark of a bulk phishing campaign.

The threat of legal action is another. Pressure to act immediately, before you have time to think or check, is a common feature of scams of all kinds.

What the ATO and myGov say they will never do

A June 2026 alert on ATO and myGov impersonation scams said the ATO will never send unsolicited messages containing links.

The ATO has repeated the message more recently. On a page updated on 28 October about its online services refresh, it said it "will never send an unsolicited message that directs you to a log-in page".

That same page says the genuine ATO and myGov sites are reached by typing their addresses directly, rather than through a link.

Services Australia's guidance is similar. It says genuine messages do not ask people to click links, buttons, icons or QR codes in any email claiming to be from myGov, and warns against calling phone numbers listed in a suspicious email.

A simple check also helps: messages that don't come from an address ending in ".gov.au" are a warning sign. A convincing logo or layout proves nothing. Scammers can copy government branding easily, and a display name can say "myGov" or "ATO" even when the underlying address is something else entirely.

QR codes deserve the same caution as links. Scanning one in an email simply takes you to a web address chosen by the sender.

There is an extra reason for care this month. The ATO says its online services for individuals, agents and businesses will get a design and navigation refresh from November 2026, with the ATO app to follow from early 2027. It describes the change as "a design and navigation refresh only".

When familiar screens change, it can be harder to tell what a genuine page should look like. That makes the ATO's guidance on typing the address yourself more relevant than spotting a fake by its appearance.

If a message says something has changed in your account, the safe test is to log in independently and see whether anything is there. Genuine notices generally appear in your myGov inbox.

Illustrative scenario: the 'discrepancy' email

Illustrative scenario: Alex lodged a return through myGov on deadline day. Two days later, an email arrives headed "Dear myGov Customer". It says a discrepancy has been found, warns that legal action may follow, and asks Alex to open an attached document to resolve it.

The email has three red flags at once: a generic greeting, a threat, and an attachment. Alex doesn't open the file or reply.

Instead, Alex types my.gov.au into a browser, signs in and checks the inbox. There is nothing new. Alex then calls the ATO's verification line, 1800 008 540, using the number published by the ATO rather than any number in the email.

Alex deletes the email and reports it. If Alex had already opened the attachment or entered details, the scenario involves contacting the bank promptly, changing passwords and seeking help through official channels.

The scenario is illustrative, but the steps reflect the published guidance from Services Australia and the ATO.

If you think you have been caught

Act quickly. If you have shared bank or card details, contact your financial institution straight away.

Where sign-in details were entered on a fake page, the password would need changing through the genuine site and the account checked for changes such as new bank details.

Reporting scams helps authorities warn others. Official reporting services accept reports from the public, and the ATO can confirm whether a contact claiming to be from it is real.

What to watch

  • Now: stay alert for tax-themed messages while you wait for a refund after the 2 November deadline.
  • November 2026: the ATO's online services design refresh begins.
  • Refund emails: be wary of any message asking you to update EFT or bank details to receive a refund.
  • 21 November: self-preparers' tax bills fall due, a likely theme for payment-demand scams.
  • Any time: verify on 1800 008 540 and never use contact details supplied in a suspicious message.