The ATO has issued a fresh warning about fake emails telling taxpayers they have a "payment update" in their ATO profile or need to review their income statement. Clicking the link does not open a tax record. It downloads remote desktop software that can hand scammers access to the victim's device.

With millions of Australians still finalising 2025–26 returns ahead of the October deadline, messages about income statements and payments look routine, and that is exactly what makes them dangerous.

What the September 2026 scam email looks like

According to the ATO's scam alerts page, the fraudulent emails claim that "you either have a new payment update in your ATO profile or that you need to review your income statement". Recipients are urged to click a link to see the details.

Instead of a legitimate ATO page, the link downloads malicious remote desktop software. Once installed, this type of software can let a third party see and control the device, potentially exposing online banking, email accounts and stored passwords.

Remote access tools also have legitimate uses, which is part of the problem. Security software may not always flag them, and once connected, a scammer may be able to watch what a victim types, including passwords and one-time codes.

The ATO is blunt about the core red flag: "The ATO will never send an unsolicited message that directs you to a log in page."

Why an "income statement review" is such effective bait

The lure works because it mirrors something real. Employers report pay and tax withheld to the ATO through Single Touch Payroll, and employees can see their income statement in ATO online services through myGov.

At this time of year, many workers are waiting for their income statement to be marked "tax ready" or are checking it against their payslips before lodging. An email asking them to "review" it can feel like a normal step in the process.

The ATO's own figures show how many people are engaged with tax right now. As at 27 August 2026, more than 6.3 million individual returns had been lodged, according to the ATO's lodgment statistics, with the self-lodgment deadline still ahead.

Genuine income statements are not delivered by email link or attachment. They are accessed by signing in to myGov directly, or through the ATO app.

Part of a pattern of ATO impersonation in 2026

The September alert is the latest in a series of ATO-themed scams flagged this year.

In July 2026, the ATO warned about emails falsely claiming "a phone appointment with the ATO has been scheduled". The attachment linked to a fake myGov sign-in page designed to steal login details. The ATO says it will never email an attachment containing a link to a myGov sign-in page.

In February 2026, fake ATO or myGov emails claimed recipients held crypto in "non-KYC wallets" and demanded "cryptocurrency disclosure declarations", pushing people to call a phone number.

What links these campaigns is the method. Each offers a plausible reason to act, followed by a request to log in, download something or phone a number the scammer controls.

The ATO has also tightened how myGov accounts are linked to its online services, adding security questions and recommending the myID digital identity app, as reported in June 2026.

Red flags and safe habits this tax time

The ATO's scam guidance gives several clear rules of thumb. It says it will never send an unsolicited SMS containing a hyperlink, and will never ask people to access ATO services through links in unsolicited emails.

Practical habits that may reduce risk include:

  • Typing my.gov.au into the browser, or opening the ATO app, rather than following a link.
  • Treating unexpected attachments and download prompts as suspicious, even if the branding looks official.
  • Checking whether a message genuinely appears in your myGov inbox before acting on it.
  • Being wary of urgency, such as threats of penalties, frozen refunds or account suspension.
  • Never installing software because an email or caller asks you to.

The ATO app, updated at Tax Time 2025, includes real-time alerts and the ability to lock an account instantly, which can add a layer of protection for people who use it.

Scammers also borrow from real news. With the $1,000 standard deduction for work-related expenses and the Working Australians Tax Offset in the headlines, messages promising early access may appear, even though neither can be claimed in 2025–26 returns.

What to do if you clicked the link

Anyone unsure whether a message is genuine can call the ATO's scam line on 1800 008 540 to verify or report it. Suspicious emails can be forwarded to [email protected], according to the ATO.

If remote desktop software may have been installed, it may help to disconnect the device from the internet and seek help from a trusted IT professional. Changing passwords from a separate, clean device and contacting your bank promptly are also commonly recommended steps.

Because tax file numbers, myGov credentials and bank details can be used for identity fraud, including attempts to lodge false returns or redirect refunds, it is worth acting quickly. People who believe their identity has been compromised can also contact the ATO so it can apply extra protections to their record.

A registered tax agent can help check whether anything unusual has been lodged in your name, depending on individual circumstances.

What to watch as the deadline nears

Scam activity often tracks the tax calendar, so the weeks before the deadline are likely to remain a high-risk period.

The self-lodger deadline for 2025–26 returns is 31 October 2026. Because that date falls on a Saturday, the ATO's general weekend rule means self-lodgers can lodge on Monday 2 November without penalty. Tax agents face a firm 31 October cut-off for adding new clients to their lists.

After lodgment, messages about refunds, "processing delays" or amended assessments are common lures. The ATO says most returns are processed within 12 business days, and genuine updates can be checked in myGov.

Anyone who sees a new variant can check the ATO's scam alerts page, which the agency updates as fresh threats emerge.