“Don’t Click That Link!” – How to Spot ATO, MyGov and Banking Scams

In today’s digital world, scammers are becoming increasingly sophisticated. At PBS Accountants & Advisers, we’re seeing more clients fall victim to convincing scam emails and text messages that appear to be from legitimate organisations like the Australian Taxation Office (ATO), MyGov, or major banks.

Watch our latest video on this topic [here], and please share it with your friends, family, and team members. These scams can have devastating consequences – from stolen personal information to drained bank accounts. That’s why we’ve launched a new video series to help protect you, your family, and your team from these threats.

The Red Flag You Need to Know

The single biggest red flag in any official-looking email or text? Clickable links. Here’s the truth: The ATO, MyGov, and Australian banks will never include clickable links asking you to log in through their emails or text messages. Never. Instead, these legitimate organisations will always instruct you to independently access your account by:
  • Typing their official website directly into your browser
  • Using their official mobile app
  • Calling their published customer service number
Why? Because they understand the security risks of email links and want to protect you.

Real-Life Example: A MyGov Scam Caught in the Act

Recently, I received a perfect example of these scams – a fake MyGov email that’s worth breaking down:
In this email, the sender appears as “MY-GOV” (notice the unusual capitalisation and hyphen) claiming I have “6 new messages” in my MyGov inbox. The message tries to create urgency by highlighting the number “6” in bright red.
The email lists enticing items supposedly waiting in my inbox, including:
  • “Official government correspondence”
  • “New refund notification”
  • “Update regarding your benefits”
Notice how they specifically mention a “refund” – this is a deliberate psychological trigger. Scammers know the possibility of missing out on money can cause people to act without thinking. Who wouldn’t want to claim a refund they’re owed? The email concludes with a prominent green “View Message” button – exactly the type of clickable link that legitimate government communications would never include. Had I clicked that button, I would’ve been directed to a fake MyGov login page designed to steal my credentials, potentially giving scammers access to my tax information, personal details, and connected services.
 
How Government Agencies Actually Communicate

The real MyGov will never send you emails with direct login links. Instead, they might notify you that you have messages, but they’ll always direct you to:
  • Log in separately at my.gov.au
  • Use the official MyGov app
The same applies to the ATO and all major Australian banks. They’ll ask you to log in, but through your normal, independent channel – not via a convenient (and dangerous) email link.

Why Scammers Use Links

Scammers rely on our busy lives and the convenience factor. It’s so much easier to just click a link than to open a new browser window and type in a web address. They’re banking on our hurried habits and trust in official-looking communications.
They’ve become experts at creating emails that look legitimate, often copying exact formats, logos, and language from the real organisations they’re impersonating.

More Red Flags in the Example

Looking closer at the scam email I received:
  1. Sent to a personal email address – The email was sent directly to a personal email account (dm……y@bigpond.com) rather than through MyGov’s secure messaging system
  2. Vague message content – The email uses generic terminology about “important updates about your tax, pension, and other government services” without any specific details
  3. Poor branding – While scammers are getting better, there are often subtle differences in logos, fonts, or colours compared to official communications
  4. Mobile formatting – Many scams are designed to be viewed on mobile devices, where it’s harder to spot suspicious details like unusual sender addresses
Protecting Yourself and Your Business

Beyond avoiding suspicious links, here are additional steps to protect yourself:
  1. Verify independently – If you receive a concerning email from “MyGov” or the “ATO,” don’t use any contact details in the email. Instead, look up the organisation’s official contact information separately.
  2. Check the sender’s email address – Look carefully at the actual email address, not just the display name. Scammers often use addresses that look similar to legitimate ones but with small variations.
  3. Be suspicious of urgency – Phrases like “new messages” highlighted in red or mentions of “refunds” are designed to make you act without thinking.
  4. Update your security – Use strong, unique passwords for different accounts, enable two-factor authentication wherever possible, and keep your devices updated.
  5. Educate your team – Share this information with everyone in your business. Security is only as strong as the least-informed person with access to your systems.
We’re Here to Help

At PBS Accountants & Advisers, we’re committed to helping our clients navigate not just their financial journeys but also the security challenges that come with doing business in the digital age.
This blog post is the first in our new security awareness series. In future posts and videos, we’ll continue sharing real examples of scams and providing practical tips to keep you and your business safe.
Remember, when it comes to protecting your financial information, a healthy dose of scepticism is your best friend. If something feels off, it probably is.

Watch our latest video on this topic [here], and please share it with your friends, family, and team members. The more people who know about these scams, the fewer victims the scammers will find.

Take Action Now:
  1. Bookmark the official websites for MyGov, the ATO, and your bank
  2. Never click links in emails claiming to be from these organisations
  3. Share this information with your team and family
  4. Subscribe to our channel/newsletter for more security tips
Disclaimer: This content is provided for educational purposes only and should not be considered specific technical or security advice. While we strive to provide helpful information about common scams, new threats emerge regularly. For specific security concerns or if you believe you’ve been compromised, consult with a cybersecurity professional.