Tax time is stressful enough. You are pulling together BAS statements, reconciling accounts, checking your lodgement status, and hoping your bookkeeper has not missed anything. The last thing you need is a scammer piling on, but that’s exactly what they’re counting on.
Tax-time scams often increase around tax season, and the numbers are getting harder to shrug off. In 2024, small businesses lost nearly $19.9 million to scams, with 65% of that hitting micro and small enterprises.
Queensland businesses alone reported $2.5 million in losses across 411 incidents, more than $6,000 per business on average.
Think about what $6,000 actually means when you are running a small business. That is not an inconvenience. For some operators, it is a payroll run. It is the equipment deposit they have been putting off for two quarters. It’s gone, and most of the time, it doesn’t come back.
If you run a small or medium-sized business in Australia, you are being targeted. The question is whether you will see it coming.
Why Scammers Love Tax Season
Think about what tax time does to a business owner’s headspace. You are distracted, you are under deadline pressure, and you are dealing with a flood of legitimate emails from your accountant, the ATO, myGov, and half a dozen other parties. Scammers know this very well. They time their attacks to land when your guard is lowest.
Scammers also know that small businesses often lack a dedicated IT team or a compliance officer who spots red flags before someone clicks a link. You are doing it yourself, or your office manager is, between answering the phone and chasing unpaid invoices.
According to the ATO data, tax season scams in Australia have surged more than 300% in recent years. That growth is huge, and it is not accidental. Scammers are running coordinated operations, updating their tactics constantly, and targeting businesses that do not have time to double-check everything.
The Scams You are Most Likely to See
ATO and myGov Impersonation
This is the most common scam type, and it is getting harder to spot.
You get an email or SMS that looks like it is from the ATO. It tells you your taxable income has been recalculated, and you are owed a refund. Or it warns you about an outstanding amount that needs immediate attention. There’s a link. There’s a deadline. It feels urgent.
Scammers send links and QR codes to fake login pages designed to steal your credentials.
Be wary of unsolicited links or QR codes claiming to be from the ATO. Not for a refund. Not for any reason.
If you get one… STOP IMMEDIATELY!!! DO NOT CLICK ANYTHING… Go directly to ato.gov.au by typing it into your browser.
Fake Debt and Arrest Threats
Take Marcus, who runs a small construction company in outer Melbourne. One afternoon, he got a call from someone claiming to be an ATO officer. The caller read out a case reference number, told Marcus he owed $14,000 in unpaid tax, and said a warrant for his arrest would be issued within two hours if he did not pay via bank transfer immediately.
Marcus almost did it. The caller knew his ABN, his business name, and the suburb where he operated. It felt real. But it was not!
The ATO does not demand immediate payment via threats, gift cards, or cryptocurrency in unsolicited calls. If someone is threatening you with jail time over a tax debt, terminate the call. Then contact the ATO directly on 1800 008 540 to check your actual account status.
False Billing (Invoice Fraud)
This one hits businesses where it hurts most: the accounts payable process.
During tax season, your business is processing more invoices than usual. Scammers send fake invoices that look like they are from suppliers you actually use. Same logo. Similar email address. Correct ABN format. The only difference is that the bank account number has been changed.
Sometimes the scammer does not even create a fake invoice from scratch. They intercept a legitimate one, usually through a compromised email account, and alter just the payment details before forwarding it on.
Before paying any invoice, especially one that arrives with updated bank details, call the supplier directly using a number you already have on file. Not the number on the invoice.
Business Email Compromise (BEC)
BEC scams go a step further. The scammer gains access to a real email account, yours, your accountant’s, or a supplier’s, and uses it to make fraudulent payment requests that appear completely legitimate.
These are particularly dangerous because there is no suspicious email address to spot. The email comes from a real account. The name is familiar. The thread might even include prior legitimate correspondence.
Protect yourself by establishing a rule in your business: any change to payment details, regardless of who the email appears to come from, requires a phone call to verify. No exceptions.
R&D Tax Incentive and Grant Scheme Fraud
This angle does not get enough attention. If your startup or business is eligible for the R&D Tax Incentive, you may be approached by promoters offering to handle your claim and guarantee large refunds.
Some of these promoters are bad actors in Australia’s business grants industry. They will pad your timesheet records, make up your R&D activities, or churn funds through interconnected entities to inflate your claimed notional expenditure.
If you are cold-called, offered a guaranteed R&D tax offset and pressured to sign documents immediately, it is not a legitimate R&D Tax Incentive consultant. Report this to the Australian Taxation Office. Check any consultant you engage with on the Tax Practitioners Board register before you provide any information.
Also read: Strategies for Securing High Probability Small Business Grants in Australia 2026
Red Flags: Your Fast Checklist
Before you respond to any communication that touches your tax affairs, run through this list:
- Urgency. Any message demanding action within 24 or 48 hours. Real tax matters have formal timelines.
- Links or QR codes. The ATO will not send these in unsolicited messages.
- Unusual payment methods. Gift cards, crypto, prepaid cards, or wire transfers.
- Requests for credentials. Your TFN, myGov login, Medicare number, or driver’s licence via email or text.
- Phone numbers are showing in the caller ID. Verify the caller using the official ATO number.”
- A fee to receive your refund. The ATO never charges you to access money you’re owed.
- Unsolicited grant or R&D advice. Especially from someone who cold-called you.
STOP. CHECK. PROTECT.
This three-step framework is the most practical thing you can apply right now. Print it. Stick it near the person who handles your accounts.
STOP
Do not act on urgency. Scammers manufacture pressure because pressure short-circuits your judgment. Before you pay anything, share anything, or click anything — pause.
Never give your TFN, bank account information, or myGov details to people who contact you out of the blue. Your bank, your registered tax agent, and your employer may need this information, but an unexpected caller does not.
CHECK
Look hard at the sender. An email from “ato-refunds@gov-au.net” is not from the ATO. Check the actual email domain against ato.gov.au.
If you have linked your ATO account to myGov, any real communication from the ATO will generate a notification in your myGov inbox, not a link in an SMS.
When in doubt, contact the ATO directly on 1800 008 540. Not through any number in the suspicious message. From the ATO’s official website.
PROTECT
If you suspect something is wrong, terminate contact immediately. Do not reply. Do not try to “catch” the scammer by engaging.
Report it to Scamwatch at scamwatch.gov.au and to ReportCyber at cyber.gov.au. These reports help authorities track patterns and warn other businesses.
If you have already clicked a link or shared information, contact your bank immediately. Ask them to freeze transactions and review recent activity. Then contact the ATO’s Client Identity Support Centre on 1800 467 033.
Protecting Your Business at the Systems Level
Individual awareness matters, but scam prevention also needs to be built into how your business operates. These are the controls worth building in before tax season hits:
- Multi-factor authentication (MFA). Turn it on for every account that touches financial data, your accounting software, your email, and your ATO online services. MFA means a compromised password alone isn’t enough.
- Dual approval for payments. Any payment above a set threshold or any change to supplier bank details should require sign-off from two people. This single control stops most BEC scams cold.
- Staff training. Your team is your first line of defence. Run a short session before tax season each year. Show them what a phishing email looks like. Tell them what to do if they receive one. Make it safe to report a suspected scam without judgment.
- Secure document handling. Use encrypted portals to share tax documents. Avoid emailing TFNs or sensitive financial records as plain attachments.
- Registered agents only. Verify your tax agent against the Tax Practitioners Board’s public register at tpb.gov.au before giving them access to your records or lodging any claims on your behalf.
First and foremost, don’t be embarrassed. These scams are designed to target busy, successful business people, day in and day out. The people running these scams are experts at psychological warfare and manipulation.
What to Do If You Have Been Scammed
Move quickly. Banks can sometimes reverse transactions if they are flagged fast enough, but the window closes within hours, not days.
- Contact your bank immediately and ask them to stop any transactions.
- Call the ATO Client Identity Support Centre on 1800 467 033.
- Report the scam to Scamwatch and ReportCyber.
- Change your passwords for any accounts that may have been accessed.
- Contact your tax agent or accountant and let them know what happened.
The Bigger Picture
Tax season scams in Australia are not a fringe problem affecting careless people. They are a coordinated industry targeting the segment of the economy least equipped to absorb the losses, small and medium businesses operating on thin margins, without dedicated fraud teams, doing their best to meet obligations and keep the doors open.
The scammers have refined their approach over the years. They know your calendar. They know your stress points. They know that a convincing email at the right moment can bypass years of good judgment.
Your defence is not complicated. STOP, CHECK, PROTECT applied consistently, built into your processes, and passed on to whoever handles your payments.
A moment of pause before clicking a link costs you thirty seconds. Getting scammed costs you a lot more than that.
Useful contacts:
- ATO general enquiries: 13 28 61
- ATO scam hotline: 1800 008 540
- ATO Client Identity Support Centre (if you’ve been scammed): 1800 467 033
- Scamwatch: scamwatch.gov.au
- ReportCyber: cyber.gov.au
- Tax Practitioners Board register: tpb.gov.au
