An email lands with the ATO logo and a document called "Declaration and Final Release." The subject line mentions a notice of assessment. A button invites you to review it. Click it, and you land on a page that looks exactly like the myGov sign-in screen.
Type your details there and you've just handed a stranger your credentials, your identity, and your tax refund in one move.
Is This ATO Email Real?
No. The Australian Taxation Office will never send an unsolicited email containing a link to sign into myGov. That single rule catches almost every version of this scam, regardless of how the message is dressed up. If an email asks you to click through and log in, delete it.
Everything below covers what these emails look like, why tax time makes them work, and what to do if one has already caught you.
Why ATO Scams Spike Right Now
Scammers time these campaigns to the calendar. The ATO consistently records its highest volume of scam reports between July and October, the exact window when millions of Australians are genuinely lodging returns, checking refund status, and exchanging real messages with the tax office. A fake "your return is ready" email doesn't stand out in July the way it would in March.
The money involved makes the timing worse. Scamwatch recorded $119 million in losses in just four months of reporting, even as the total number of reports fell. Fewer attacks, more damage each time. Phishing losses tied to ATO impersonation nearly tripled in the first four months of 2025 compared to the same period a year earlier.
The Three Variants Circulating Right Now
The DocuSign refund scam. An email arrives with a document titled "Declaration and Final Release," often paired with a subject line referencing a notice of assessment or audit. The "Review Document" button leads to a cloned myGov sign-in page built to capture your credentials, name, date of birth, and driver's licence details.
The refund notification. The oldest version of this scam and still the most common. A message tells you the ATO has processed a refund and asks you to confirm your bank details to receive it. Real ATO refunds go straight to the bank account already registered in your myGov account. Nobody needs to contact you first.
The cryptocurrency declaration threat. A newer variant claims you hold undeclared cryptocurrency in a "non-KYC wallet" and demands you call a number to resolve it before facing legal action. The ATO does not email demanding immediate disclosure of assets, and it does not threaten arrest or prosecution by email.
How the Scam Works
Step 1: The email arrives during tax season. Sender lists come from data breaches and broker databases, not from ATO or myGov records. Having never lodged a return with a particular email address doesn't protect you.
Step 2: A familiar brand lowers your guard. Millions of people are used to receiving genuine tax correspondence at this time of year. That familiarity is the entire mechanism. A message referencing a notice of assessment reads as routine instead of suspicious.
Step 3: The link leads to a cloned sign-in page. The fake myGov page is built to look identical to the real one. Some versions ask for a username and password, then request an SMS authentication code, then redirect you to the genuine myGov site to complete the illusion that nothing went wrong.
Step 4: The stolen details get used immediately. Credentials, personal information, and identity documents collected this way support refund fraud, account takeover, and identity theft, or get sold on to other criminals entirely.
Red Flags That Expose Every Fake
It contains a sign-in link. This is the single most reliable tell. The ATO tells you to log in yourself, by typing the address into your browser or opening the app, never by clicking a link in a message.
The sender address doesn't end in .gov.au. Check the full address behind the display name. A display name reading "ATO" attached to a personal or business domain is fake regardless of how official the name looks.
It asks for a refund, then wants your bank details first. Real refunds go to the account already registered in myGov. Nobody needs your card number or BSB to release money that's already sitting in the system.
It demands disclosure of assets over email. Requests to declare cryptocurrency holdings, superannuation details, or other assets through an email reply are never genuine ATO process.
It threatens arrest or prosecution. Legal threats delivered by email or text are a pressure tactic, not a real legal process. The ATO does not operate this way.
It creates urgency around a document you weren't expecting. A "Declaration and Final Release" you never requested, tied to a tight deadline, is designed to get you clicking before you think.
What to Do If You Receive One
- Don't click anything. Not the button, not an attachment, not a "check if this is real" link.
- Forward it to [email protected], then delete the message.
- Call the ATO directly on 1800 008 540 if you want to verify whether a specific communication is genuine. Never use a number from the email itself.
- Check your account the normal way. Open the ATO app or type the address into your browser yourself and log in from there.
- Warn anyone who lodges with the same tax agent or shares a household, since these lists often target several people at similar addresses.
What to Do If You Already Entered Your Details
Call the ATO on 1800 008 540 immediately. They can help protect your ATO and myGov accounts and flag the compromise before it's used for refund fraud.
If you entered your myGov password, change it right away, and change it anywhere else you reused that password. Turn on multi-factor authentication if you haven't already.
If you provided a Tax File Number, date of birth, or driver's licence details, place a fraud alert with the credit reference agencies and watch for accounts or loans opened in your name that you didn't authorise.
If you entered bank details or made any payment through the scam, contact your bank straight away and ask them to flag the account for fraud.
How Your Details End Up on These Lists
Scammers don't guess which email addresses belong to Australian taxpayers. They buy lists compiled from data breaches and broker databases, then cross-reference names, phone numbers, and addresses to make a message feel personally targeted.
Every account you sign up for with your real email adds one more place that data can leak from. Using a disposable address for services you don't need a lasting relationship with keeps your primary inbox off those lists in the first place. VanishInbox gives you a working inbox instantly, with no account required, so a confirmation email can arrive and the address can disappear afterward. Your real address never enters that company's database, so it's never part of the breach when that database eventually surfaces somewhere it shouldn't. For the full mechanics of how that pipeline runs, see what actually happens when a website sells your email address.
The same government-impersonation playbook shows up outside Australia too. See our guide to the DWP scam text messages circulating in the UK for the identical urgency-and-brand-trust tactics applied to a different benefits system. Retail brands get the same treatment in Australia as well — see our Bunnings email scam guide for the fake gift card and prize version of the same playbook.
Frequently Asked Questions
Does the ATO ever email a link to sign into myGov?
No. The ATO will never send an unsolicited email or text containing a link to a myGov sign-in page. If a message asks you to click through and log in, it's a scam regardless of how convincing it looks.
The email shows "ATO" as the sender name. Does that mean it's real?
No. Display names can say anything the sender wants. Check the full address after the @ symbol. If it doesn't end in .gov.au, the message isn't from the ATO.
What's the DocuSign tax refund email that's going around?
A phishing campaign uses a fake document called "Declaration and Final Release," paired with a subject line about a notice of assessment or audit. Clicking through leads to a cloned myGov login page designed to steal your credentials and personal details.
I clicked the link but didn't enter anything. Am I safe?
Likely, but run a security scan on your device as a precaution. Watch your myGov and bank accounts for unusual activity over the following weeks.
Can I get my money back if I already lost some?
Contact your bank immediately and explain what happened. Call the ATO on 1800 008 540 to help protect your accounts, and report the scam to Scamwatch. Acting quickly gives you the best chance of recovering funds or stopping further damage.
How do I report an ATO scam email?
Forward it to [email protected], then delete it. You can also report it through Scamwatch to help authorities track the campaign.
