Skip to content

Australian Taxation Office tax refund scam message examples

These are real, reported examples of scam messages impersonating Australian Taxation Office — fully defanged and shown here so you can recognise the pattern. They are illustrations, not genuine Australian Taxation Office messages. Got a message you're unsure about right now? Check it in the free scanner.

Example scam messages

Example scam text messageExample only. Not a real message.

ATO: Your income tax assessment has been finalised and a refund is ready for release. Confirm your identity today at ato-refund-portal[.]example or the payment will be returned to the Commonwealth.

What gives it away:

  • The ATO never sends links asking you to log in or 'confirm your identity'; a real refund lands in the bank account already registered with the ATO, no click required
  • The lookalike link is not ato.gov.au or my.gov.au
  • A refund that expires on a deadline is a pressure device; real assessments sit safely in your myGov inbox
Example scam phone callExample only. Not a real message.

A robocall states that the Tax Office has filed a lawsuit against you for tax evasion and that a warrant will be executed today unless you press 1. A 'case officer' then demands the debt be settled immediately through Bitcoin or Google Play gift cards, and tells you not to hang up or contact your accountant.

What gives it away:

  • Arrest threats over a tax debt are always fraudulent; the ATO resolves genuine debts through letters, your myGov inbox and payment plans
  • No government agency accepts gift cards or cryptocurrency; the payment method alone ends the question
  • Being told not to speak to your accountant, bank or family is isolation, and it only serves the scammer
Example scam emailExample only. Not a real message.

Subject: Your updated tax lodgement statement is available. Dear Taxpayer, your recent lodgement has been amended. Review the attached statement and sign in via secure-mygov-statements[.]example to accept the changes before your account is restricted.

What gives it away:

  • Generic 'Dear Taxpayer' greeting and a sign-in link; the ATO tells you to log in yourself at my.gov.au and never links you to a login page
  • The domain is a myGov lookalike, not my.gov.au (note the real address is 'my.gov.au' with the dot)
  • An 'account restriction' deadline attached to a routine statement is manufactured urgency

How to check a message you've received

Never tap a link in an unexpected message. Instead, paste the text into the free message checker for an instant verdict, or check a suspicious link with the link & website checker. To verify directly, contact Australian Taxation Office through its official app or the number on its real website — never the details in the message itself.

Understand the scam and the brand

Not sure about a message?

Paste it in and get an instant scam verdict with the exact red flags highlighted — free, no signup.

See all free scam checker tools →

Frequently asked questions

Is this Australian Taxation Office message real or a scam?

The messages on this page are defanged examples of Australian Taxation Office impersonation scams — real reported patterns, not genuine Australian Taxation Office messages. To judge a specific message you've received, paste it into the free Scam Scanner checker for an instant verdict, or verify it directly through Australian Taxation Office's official app or website.

How can I tell a fake Australian Taxation Office message from a genuine one?

Genuine messages: Genuine ATO SMS show sender IDs like 'ATO', 'ATOGOV' or 'myGov' — but scammers can spoof these, so judge the message itself, not just the sender name (a text from a mobile number is a red flag). The examples below break down the tells that give a fake away — unexpected links, urgency, and requests for payment or details. If anything asks you to click a link or hand over information, treat it as suspicious until you've verified it independently.

What should I do if I already clicked a link or paid?

Act quickly: contact your bank, then follow the step-by-step recovery guide at /what-to-do. It walks you through who to contact — your bank, IDCARE and the right reporting channel — in the order that matters most.