The ATO 'Refund Pending' SMS Scam Hitting Australian Seniors

Australia's tax year ends on 30 June, and every year the eight weeks leading up to it are the busiest season in the scammer's calendar. I've spoken to three readers in Queensland, New South Wales, and Victoria who all received near-identical text messages in April 2026:

"ATO: A refund of $928.40 is pending in your name. Verify your bank details to release the payment: [link]"

The link goes to a site that looks exactly like myGov or ato.gov.au. The URL, though, is usually something like ato-refund.com.au or mygov-tax.net — close-sounding but not the real addresses.

Let me put the single most important sentence of this article at the top:

The Australian Taxation Office does not send SMS messages with links asking you to confirm bank details or claim a refund. All legitimate ATO refunds are processed through your myGov account or lodged tax return — never through an SMS link.

If you remember only one thing from this page, make it that sentence.

Why Australian seniors are the prime target

The ATO has flagged SMS impersonation as one of the fastest-growing scams, and Scamwatch (run by the ACCC) reports that Australians lost hundreds of millions of dollars to impersonation scams in 2024–25. Older Australians are targeted disproportionately for three reasons:

1. Many over-60s are self-funded retirees with multiple income streams — super, dividends, rental income, pensions — where a refund is genuinely plausible.
2. The transition to myGov has been gradual for older Australians, so the "check your details" angle feels reasonable.
3. Mobile numbers of retirees are widely available on leaked data sets and are cheaper for scammers to bulk-text than landlines.

None of this makes seniors foolish for being targeted — it makes them worth protecting. The defence is simple once you know the pattern.

How the fake ATO SMS actually works

Stage 1 — The text. It arrives from a mobile number or a short code and almost always names a specific amount ($412.60, $928.40, $1,243.15). The specificity is deliberate — it feels computed.

Stage 2 — The fake urgency. "Verify within 24 hours or the refund will expire." The ATO does not expire refunds on a 24-hour timer.

Stage 3 — The fake myGov page. The link opens a near-perfect clone of myGov or the ATO site. The crown emblem, the fonts, the colour scheme — all copied.

Stage 4 — The data harvest. The fake page asks for your name, date of birth, TFN (Tax File Number), Medicare number, myGov login, bank BSB and account number, and sometimes card details "to verify the refund destination." Each piece is worth money to the scammer.

Stage 5 — The drain. Within minutes, the scammer uses the myGov login to redirect a real refund if there is one, or — more commonly — uses the bank details to initiate withdrawals. A stolen TFN can also be used to lodge a fraudulent tax return in your name the following year.

7 red flags that expose the scam

• Red flag 1 — A link in an SMS claiming to be the ATO. The ATO does not send links by SMS for refunds. Full stop.
• Red flag 2 — A request for your TFN, bank login, or card PIN. The ATO will never ask for these through SMS or email.
• Red flag 3 — Urgency ("expires in 24 hours"). The real ATO does not operate on sub-week deadlines for refunds.
• Red flag 4 — A suspiciously specific dollar amount. Specificity is a scam tactic, not evidence of legitimacy.
• Red flag 5 — A URL that is not .gov.au. Real ATO URLs always end in ato.gov.au. Real myGov URLs always end in my.gov.au. Anything else is fake.
• Red flag 6 — Threats of prosecution or arrest if you don't respond. The ATO does not threaten arrest over SMS.
• Red flag 7 — WhatsApp or Messenger messages claiming to be the ATO. The ATO does not use messaging apps.

What the real ATO does

The real ATO will:

• Communicate through your myGov Inbox (linked to your ATO account) and through paper mail to your registered address.
• Pay refunds directly to the bank account listed on your last lodged tax return — they do not ask you to "verify" it separately by SMS.
• Occasionally send an SMS reminding you to lodge or reminding you of a due date — but these SMS messages never contain a link and never ask for personal details.

The real ATO will never:

• Send an SMS with a link to a refund page.
• Ask for your TFN, bank login, Medicare number, or card PIN by SMS, email, WhatsApp, or social media.
• Demand payment by cryptocurrency, gift cards, or "pre-paid debit vouchers" — all real red flags the ATO itself publishes.
• Threaten immediate arrest or deportation over the phone.
• Transfer you to the "Australian Federal Police" or "Border Force" during a tax call.

What to do when a suspicious text arrives

1. Do not tap the link. Even opening the page gives the scammer device data.
2. Forward the text to the ATO at ReportScam@ato.gov.au — the ATO's dedicated reporting inbox. You can either forward the email version or take a screenshot of the text and email it in.
3. Report to Scamwatch at scamwatch.gov.au/report-a-scam — the ACCC's national scam reporting centre, which tracks patterns and warns other Australians.
4. Delete the message from your phone.
5. Block the sender number to prevent follow-up messages.

If you already tapped the link or entered details

Move quickly — Australian banks can often reverse fraudulent transactions if reported within hours.

1. Call your bank's fraud line immediately. The number is on the back of your card and is free from any Australian mobile. Request a block on pending transactions, a card replacement, and — most importantly — check that your bank account on file with the ATO has not been changed.
2. Change your myGov password from a different device. Sign in at my.gov.au and update the password using your laptop or a family member's phone, not the phone you tapped the link on. Enable myGov two-factor (the myGov Code Generator app) while you are there.
3. Call the ATO's Client Identity Support Centre on 1800 467 033 (Monday to Friday, 8am to 6pm AEST). This free service helps victims of identity theft protect their tax file number and lodge a fraud alert on their ATO account.
4. Report to Scamwatch at scamwatch.gov.au/report-a-scam.
5. If your TFN has been exposed, the ATO can flag your account against fraudulent returns being lodged. That flag is free and worth activating.
6. Contact IDCARE on 1800 595 160 — Australia's national identity and cyber support service. It is free and staffed by specialist case managers.

Check a suspicious message before you act

If you're not sure whether a message is real, paste the text into our free scam message checker — it flags the specific phrases and URL patterns we see in ATO impostor messages every tax season.

If the scam page asked you to log into a fake myGov, run that password through our password checker to see if it's exposed in a known breach before you use it anywhere else.

Brief the family before 30 June

Every year, tax season catches someone off guard. Spend 10 minutes this weekend:

• Tell older relatives: "The ATO never texts you a link. If you get one, send it to ReportScam@ato.gov.au and delete it."
• Save 1800 467 033 in their phone as "ATO Identity Support."
• Save 1800 595 160 as "IDCARE."
• Agree that any refund question will be checked by logging into my.gov.au directly — not through any link.

Frequently Asked Questions

Does the ATO ever send text messages?

The ATO occasionally sends SMS reminders (e.g. about lodgement deadlines), but these never contain a link and never ask for personal details. Any SMS with a link asking for bank or login details is a scam.

How will I receive a real refund?

A real refund is paid to the bank account listed on your last lodged tax return. You can check the status by signing into my.gov.au and viewing your ATO account. There is no separate SMS verification step.

Is ReportScam@ato.gov.au a real address?

Yes. It is the ATO's official scam-reporting inbox. Forward suspicious emails or texts there — no commentary needed.

What should I do if I gave my TFN to a scammer?

Call the ATO's Client Identity Support Centre on 1800 467 033 and IDCARE on 1800 595 160. Both services are free and will help you lock down your tax and financial records against identity fraud.

Can I get my money back if I entered bank details?

Often yes, if you call your bank within hours. Australian banks have mature fraud teams that can reverse transactions that have not yet settled. The key is speed.

Keep reading

• Safety & security guides for seniors
• HMRC Tax Rebate Texts — the UK scam targeting over-60s
• Tax Scams and IRS Impersonation Fraud
• UPS, USPS and FedEx delivery scam texts
• How to spot scam emails
• How to Report a Scam

Reviewed by Eleanor Shaw — techfor60s editorial desk, last verified 2026-04-18.