Getting an email saying the Australian Taxation Office has recalculated your tax return and found money waiting for you is exactly the kind of message most people will at least open. A refund sounds good, and when the email adds a deadline saying the money will expire unless you confirm your myGov identity and bank details today, it becomes much harder to ignore. That combination of a possible refund and a ticking clock is what makes the latest ATO scam email so convincing.
I looked into this particular type of ATO refund email because the wording sounds believable enough to catch someone who is busy, expecting a tax refund, or simply assumes that anything involving myGov must be legitimate. The problem is that the message is not really about helping you receive your money. It is designed to get you to follow the instructions inside the email, and that can eventually put your myGov login, tax information, identity details and banking information in the hands of a scammer.
The email may look polished, use the Australian Taxation Office name and logo, and even send you to a website that appears almost identical to an official government page. That does not make it genuine. Scamwatch and the ATO issued a specific warning in June 2026 about ATO and myGov impersonation scams, saying criminals are using fake emails, text messages and websites to steal personal information.
What Is the ATO Scam Email?
The ATO scam email is a phishing attempt that pretends to come from the Australian Taxation Office, myGov or another tax-related service. The story can change from one campaign to another, but the basic idea remains the same: there is supposedly something important involving your tax account and you need to take action through the message.
In the version getting attention now, the recipient is told that the ATO has recalculated their tax return and that a refund is waiting. The email then introduces the pressure by saying the refund will expire unless the recipient confirms their myGov identity and bank details within a short period. That is a clever setup because the person does not feel as though they are being asked to give information to a stranger. Instead, it feels as though they are completing a normal step to receive money that already belongs to them.
That is where the scam changes from a simple fake refund message into a potentially serious identity-theft attempt. The link in the email can lead to a fake myGov or ATO login page where information entered by the victim is collected by the criminals operating the site.
The ATO has previously warned about fake myGov websites using almost exactly this approach. Messages have claimed that someone is due an ATO refund, needs to update details before a tax return can be processed, or needs to verify an incoming tax deposit. The ATO has also warned that scammers can use stolen myGov credentials to access accounts and potentially change bank details so that legitimate payments are redirected.
Why the “Tax Refund Expires Today” Story Works So Well
The most believable part of this scam is probably not the fake ATO branding. It is the urgency.
A message that simply says “You may be entitled to a tax refund” gives the recipient plenty of time to think about it. Add “your refund will expire today” and suddenly the reader is being pushed toward the link before they have a chance to question what is happening. That pressure is deliberate.
Scammers understand that people behave differently when they think they are about to lose money. A refund is even more effective because the victim is not being asked to pay anything at the beginning. They are being told that money is already waiting for them, and all they need to do is confirm their identity.
There is also a psychological advantage in using myGov. Most Australians are familiar with myGov and may already use it for government services, so seeing the name in an email does not immediately feel unusual. A convincing logo, government-style wording and a familiar-looking login page can make the whole thing appear routine.
Scamwatch specifically warns that criminals use official logos, branding and language in ATO and myGov impersonation scams to make their messages look genuine. The current warning also says unexpected requests for personal or financial information, particularly when combined with urgency, should be treated carefully.
The Link Is Where the Real Trouble Starts
The email itself may not steal anything simply by sitting in your inbox. The bigger problem begins when you follow its instructions.
A typical version may contain a button such as “Confirm Refund,” “Verify Identity,” “Access Refund,” or something similar. Clicking it can take you to a website designed to imitate myGov or an ATO service. The page may ask for your email address, password, security information or other details before moving you through several screens.
This is one reason these scams can be more dangerous than the badly written phishing emails people are used to seeing. You do not necessarily encounter an obvious fake page with strange spelling and flashing advertisements. Modern phishing sites can be made to look surprisingly professional, with familiar colours, government logos and layouts that are intended to make you feel comfortable enough to enter information.
The ATO says taxpayers should access its online services directly rather than using links supplied in unexpected emails or messages. Scamwatch likewise advises people not to click links in unsolicited ATO or myGov messages that ask them to sign in.
What Information Can an ATO Phishing Email Try to Collect?
The information requested can vary, which is one reason I would not judge the legitimacy of the message simply by looking at one particular form.
A fake refund page may ask for myGov login details, your tax file number, date of birth, address, telephone number, identity information, bank account number and BSB. Some versions can go further and request card information or identity documents.
The dangerous part is how these pieces of information can fit together. A tax file number by itself is not the same thing as access to someone’s entire identity, but combined with other personal information it can become valuable to criminals attempting identity fraud.
A fake myGov login is particularly concerning because the account may contain access to several government services and sensitive information. The ATO has previously reported that fake myGov phishing pages have been used to capture sign-in credentials and that compromised accounts can then be abused by scammers.
Does the ATO Send Emails?
This is where things can get confusing.
The existence of an ATO email does not automatically mean the email is fake. The ATO does communicate electronically in some circumstances. The important question is what the message is asking you to do.
The ATO says it will not ask you to provide your tax file number or bank details by replying to an email, SMS or social-media message. Scamwatch also warns that an unsolicited message containing a link that claims to be from the ATO is a major reason to stop and verify the communication independently.
So, if an unexpected email says you have a refund and then sends you to a link where you are supposed to enter your myGov credentials and financial information, I would not use that link. I would open my browser separately, go to the official government service myself and check the account there.
That small change makes a huge difference because you are no longer allowing the person who sent the email to decide where you log in.
What If I Actually Have an ATO Refund?
This is probably the question that makes people hesitate before deleting the email.
You could genuinely be entitled to a tax refund and still receive a scam email about it. The two things are not mutually exclusive. Scammers do not need to know whether you actually have a refund. They can send the same message to thousands of people and wait for those who happen to be expecting money.
That is why the correct response is not to panic or assume the refund is fake. Check independently.
Open the official ATO or myGov website yourself using an address you already know is correct, rather than clicking the button inside the email. If there really is an issue with your tax return or payment, you should be able to find information about it through your legitimate account or by contacting the ATO through its official channels.
The current Scamwatch advice is essentially built around this approach: stop, do not rush, check through the official ATO website, app or phone number, and only then take action.
What If the Email Has My Name or Other Personal Details?
This is another thing that can make an ATO phishing email feel frighteningly authentic.
Seeing your name, address or other information in a message does not prove that it came from the ATO. Personal information can be obtained through previous data breaches, compromised accounts, public sources and other scams. Criminals can use whatever information they already have to make a new phishing attempt look more personal.
The ATO has warned that scammers may know some information about their targets and use it to create the impression that they are dealing with a genuine government representative. That is why personal details appearing in the email should not be treated as proof of authenticity.
What Happens If You Clicked the ATO Scam Email?
Clicking the link does not necessarily mean your identity has already been stolen. What matters is what happened after you clicked.
If you opened the page but did not enter anything, close it and avoid interacting with it further. If you entered a myGov password or other login information, change the affected credentials through the legitimate service and take the situation seriously. If you supplied bank or card information, contact your financial institution promptly and explain that the information may have been exposed to a scammer.
If you provided your myGov sign-in information, you should also contact the ATO using its official contact details so they can help protect your account. Scamwatch specifically advises people who have shared money or personal information with an ATO impersonator to act quickly and contact the ATO.
Do not continue communicating with the person behind the email in an attempt to recover your information yourself. Once scammers know someone has responded, they may send additional messages or make follow-up calls pretending to be from the ATO, a bank, myGov or another organisation involved in fixing the supposed problem.
How to Check an ATO Email Without Taking a Risk
The safest habit is to stop treating the email itself as the place where you need to solve the problem.
If the message says there is an issue with your tax return, open the official ATO or myGov service independently and check your account. Do not copy a phone number from the suspicious email and do not use its embedded link simply because the page looks official.
The sender address deserves a look as well, but I would not rely on that alone. Scam emails can be made to look convincing, and a familiar-looking sender name is not enough to prove that the message is genuine. Scamwatch specifically notes that legitimate government agency communications should be checked carefully, including whether the sender details actually correspond with the relevant government domain.
I would also be very cautious about QR codes. People have become accustomed to scanning them without thinking about where they lead, and a QR code in a tax-related email can simply move the phishing attempt from your computer to your phone.
Is the ATO Refund Email a Scam?
Yes. The particular message described here, an unexpected ATO refund notification saying that your refund will expire unless you confirm your myGov identity and bank details, fits the pattern of an ATO and myGov impersonation phishing scam.
The important thing is that this does not mean the Australian Taxation Office or myGov is a scam. They are legitimate government services. The criminals are impersonating them and using their names, branding and familiar tax language to make the phishing attempt believable.
That difference matters because someone who receives one of these emails might search for “ATO refund email” and find genuine information about tax refunds, then assume the message in their inbox must also be genuine. It is the individual email and the action it asks you to take that needs to be checked.
Conclusion
I would treat this email as a scam and would not click the refund link, scan its QR code, call a number included in the message or enter my myGov, tax or banking information through the email.
What makes this campaign effective is that the story itself is perfectly believable. Australians really do lodge tax returns, refunds really do happen, and myGov really is used for government services. The scammers have simply put those familiar pieces together and added enough urgency to make the recipient act before thinking.
The safest response is surprisingly simple: ignore the instructions inside the suspicious message and check your tax situation directly through the official ATO or myGov service. If something genuinely needs your attention, you will be able to deal with it there without giving a stranger control over the process.
For anyone who has already entered information, I would not wait to see what happens next. Contact the ATO through its official channels and, where banking or card details were exposed, contact your financial institution immediately. Suspected ATO scam emails can also be reported to the ATO, while scams can be reported through Scamwatch.
The bigger lesson from this particular ATO phishing scam is that a refund message does not have to look ridiculous to be dangerous. In fact, the more ordinary it feels, the more careful I would be. When an unexpected email tells you that money is waiting but only if you verify your identity today, that is exactly when it pays to close the email and check the information yourself.