Is this invoice or account email from MYOB a scam?
No. MYOB is a long-established Australian accounting software company used by businesses across the country. The real problem is the reverse: scammers copy MYOB's invoice emails, attach malware-carrying files and send fake payment-link texts, especially around EOFY when a genuine MYOB invoice would look routine. The good news: a few quick checks almost always tell a real MYOB message from a fake.
Genuine MYOB links lead to myob.com — but a link can be made to look real, so don't go by the link alone. Below is exactly what a real MYOB message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real MYOB message looks like
Genuine messages from MYOB link to myob.com. Treat a link to any other address as a warning sign.
- Genuine MYOB emails are sent from myob.com addresses (including email.myob.com) — but a sender address can be spoofed, so judge the message, not just who it appears to be from
- A genuine MYOB message won't need you to open an attachment to 'view an invoice' or tap an SMS link to 'fix' a payment — log in by typing myob.com yourself or using the MYOB app
- Real invoice and billing details can be checked by logging in to your MYOB account directly, rather than through a link in an email
- You can report a suspicious MYOB email to securityincidents@myob.com, and MYOB's phishing guidance lists the warning signs to check
What MYOB will never do
- Need you to open or run an attachment to 'view an invoice' (a genuine MYOB message won't; invoices can be checked by logging in at myob.com or in the MYOB app)
- Ask you to pay or log in through a link in an SMS (scam texts with MYOB payment links exist to capture your username and password)
- Ask for your password or your banking details by email (no legitimate accounting platform does)
- Leave you without a safe way to check: anything real will still be there when you log in to your MYOB account directly
Common MYOB scams
- MYOB-branded invoice emails that copy MYOB's real invoice template and carry attachments — often zipped files — that install malware when opened
- Phishing emails impersonating MYOB invoices that have been used to spread malware which steals banking details
- SMS messages with invoice payment links designed to capture your MYOB username and password
- Fake billing or 'account' emails timed to EOFY, when businesses are expecting genuine MYOB invoices and statements
Red flags to watch for
- An MYOB-branded email with an attachment you're asked to open or run to 'view an invoice'
- An SMS with a payment or login link claiming to be from MYOB
- A sender address that isn't an myob.com address — though a matching address doesn't prove it's genuine, since it can be spoofed
- Urgent wording about an overdue invoice, failed payment or account problem
- A link or web address that imitates myob.com — lookalikes such as my0b[.]example or rnyob[.]example are a known trick, so on hover a genuine link points to myob.com
MYOB scam examples
These composed examples show how scams impersonating MYOB typically read, with the tells that give each one away. Compare them against anything you've received.
Subject: Your MYOB invoice INV-20447 is overdue. Dear Customer, payment for the attached invoice has not been received. Open the attached file (Invoice_20447[.]zip) and settle the balance today to avoid late fees and interruption to your service.
What gives it away:
- The zipped attachment is the payload: scammers copy MYOB's real invoice template and use attachments like this to install malware that steals banking details
- A genuine MYOB message won't need you to open an attachment to view an invoice; log in at myob.com yourself and the real invoice, if any, will be there
- Generic 'Dear Customer' greeting plus late-fee pressure is designed to make a busy bookkeeper click before checking
MYOB: A subscription payment on your account has failed. Update your billing details within 24 hours to keep access to your file: myob-billing-renew[.]example
What gives it away:
- The link doesn't point to myob.com; SMS payment and login links in MYOB's name are a known credential-harvesting tactic
- A 24-hour deadline on a billing issue is manufactured urgency; a real problem would still be visible when you sign in yourself
- MYOB billing status lives inside your account, so nothing is lost by deleting the text and checking in the MYOB app instead
Not sure about your message?
Paste the suspicious MYOB text or email and get an instant scam verdict, free.
How to verify a message from MYOB
MYOB's real website is myob.com and the official app is the MYOB app. Reach MYOB through those channels, never through the details inside a message you're unsure about.
- Don't open the attachment, tap the link, or reply to the message itself
- Type myob.com into your browser yourself, or open the MYOB app, and check your invoices and billing status there; anything genuine will be waiting inside
- If you're still unsure, forward the suspicious email to securityincidents@myob.com or contact MYOB through the support section on myob.com
- Compare the message against the warning signs on MYOB's phishing guidance page (linked below)
If you have been scammed in MYOB's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- If you opened an attachment, disconnect the device from your network and run a full security scan before using it for banking or payroll again
- Change your MYOB password immediately by going to myob.com directly, and change it anywhere else you reused it
- If you entered card or banking details, call your bank straight away to block the card and dispute any charges
- If business or identity documents may be exposed, contact IDCARE (idcare.org) for free identity support
- Report the scam to Scamwatch and ReportCyber using the links below, and forward any scam SMS to 7226 so carriers can block the sender
Where to report a scam impersonating MYOB
Received — or fell for — a message impersonating MYOB? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- MYOB scam alerts — MYOB's own page on current scams and how to report one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Latest MYOB scams in 2026
MYOB impersonation in 2026 still leans on the fake invoice email: a convincing copy of MYOB's own template, an attached 'invoice' that is really malware, and wording that a busy business owner processes on autopilot. Campaigns cluster around EOFY, when genuine MYOB invoices and statements are expected and one more billing email raises no eyebrows, with SMS payment links filling the gaps between waves. What never changes is the ask: open the attachment or tap the link. The habit that defeats it is just as constant: check every invoice and billing prompt by logging in at myob.com or the MYOB app yourself, and report anything doubtful to securityincidents@myob.com.
Frequently asked questions
I received an MYOB invoice email with an attachment — is it safe to open?
Be cautious. Scammers send phishing emails that copy MYOB's invoice template and carry attachments — often zipped files — that can install malware. Don't open the attachment; log in to MYOB by typing myob.com yourself to check whether the invoice is real, and report the suspicious email to securityincidents@myob.com.
Does MYOB send text messages with payment links?
Treat an SMS with an MYOB payment or login link as suspicious — scammers have sent MYOB-branded texts with invoice links to capture usernames and passwords. Don't tap the link; open the MYOB app or type myob.com yourself to check.
What should I do if I clicked an MYOB phishing link or opened an attachment?
Change your MYOB password immediately by going to myob.com directly, run a security scan on your device, and contact MYOB. If you entered banking details or business data may be exposed, contact your bank and IDCARE as well.
What is MYOB's real website?
MYOB's only official website is myob.com, and genuine emails come from myob.com addresses such as email.myob.com. The safe habit is to type myob.com into your browser yourself or use the MYOB app, rather than following a link in an email or text. Lookalike addresses that imitate myob.com are a known scam trick.
How do I report an MYOB scam email or text?
Forward the suspicious email to securityincidents@myob.com so MYOB can act on it, and report it to Scamwatch (scamwatch.gov.au) so the National Anti-Scam Centre can track the campaign. If it arrived by SMS, forward it to 7226 (spells SCAM) so carriers can block the sender. If you lost money or business data, also report to ReportCyber at cyber.gov.au.
Related scam types
Scams impersonating MYOB usually fit one of these patterns. Learn how each works:
Related brands
Other accounting names scammers impersonate — check a message from one:
Sources
- Protecting yourself against phishing (MYOB)
- Email scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams (Scamwatch (National Anti-Scam Centre))
This guide is general information, not legal or financial advice — always verify with MYOB through an official channel.