Key Highlights

  • The ATO identified fraudulent activity affecting the systems of a small number of tax professionals.
  • Malicious links may install unauthorised software and expose confidential client information.
  • Taxpayers should verify unexpected messages before sharing tax, banking or identity details.
  • Affected clients can contact the ATO’s Client Identity Support Centre for assistance.

Most taxpayers trust their Accountant with some of their most sensitive information. A tax professional may hold copies of identity documents, financial records, contact details and information needed to prepare a return. That makes security around a tax practice important for every client—not only the accountant managing the system. The Australian Taxation Office has warned about fraudulent activity targeting the systems of a small number of tax professionals. The activity involved malicious links placed in communications such as emails, Job applications and CVs. Clicking one of these links could install malware or other unauthorised software on a device. The ATO confirmed that its own systems remained secure and were not compromised.

How Could a Tax Agent’s System Affect a Client?

A compromised computer may give an unauthorised third party access to information stored or accessed by a tax practice. According to the ATO, criminals may obtain client information and potentially interact with Online services for agents. For an ordinary taxpayer, this means the risk may extend beyond an unusual email. Personal information collected for legitimate tax work could become useful to someone attempting identity fraud. The warning does not mean every tax agent has been affected. The ATO referred to a small number of compromised systems and introduced additional security measures for the relevant agents and their clients.

Warning Signs Taxpayers Should Not Ignore

Clients should pay attention to unexpected communications that appear to come from their accountant, tax practice or the ATO. A message should be treated cautiously if it asks the recipient to open an unfamiliar link, download an unexpected file or disclose personal information without a clear explanation. Rather than replying immediately, taxpayers can contact their tax agent through a telephone number or email address they have used previously. Independently checking a message is especially important when it concerns identity documents, bank details, refunds or access to an online tax account.

Practical Steps Before Lodging a Tax Return

Before approving a return, clients should review the information carefully. Names, addresses, income details, deductions and bank account information should match the taxpayer’s records. Taxpayers should avoid sending sensitive documents through an unfamiliar link simply because the message contains a tax agent’s name or logo. The ATO advises using multi-factor authentication across devices and services. Software, applications and operating systems should also be kept updated. These measures reduce avoidable weaknesses, although no security measure removes every risk.

What to Do If Something Appears Wrong

A taxpayer who receives a suspicious message should avoid opening its links or attachments. If a potentially malicious link has already been clicked, the issue should be reported promptly. Where a tax professional’s system may have been compromised and clients could be affected, the ATO directs people to its Client Identity Support Centre on 1800 467 033. IDCARE also offers free and confidential advice on 1800 595 160. Early reporting allows suspicious activity to be investigated and gives the taxpayer an opportunity to secure affected information or accounts.

A Simple Habit Can Prevent a Larger Problem

Cyber Fraud often relies on urgency. A message may encourage the recipient to act quickly, download a document or confirm information without checking who sent it. Taking a few minutes to verify a request can therefore be valuable. Taxpayers do not need technical expertise to question an unexpected message, review their return or call their accountant through an established contact number.