Tax Agent Cyber Fraud: What Australian Taxpayers Should Check Before Lodging a Return in 2026

Quick answer: Tax agent cyber fraud involves criminals impersonating or compromising legitimate tax agents to steal your refund or personal details. Before you lodge your 2026 return, verify your agent's registration on the Tax Practitioners Board register, check your myGov account for unauthorised activity, and confirm your bank details directly with the ATO — never through a link in an email or text message.

Australian taxpayers lodge more than 14 million returns every year, and that predictable annual window has become prime hunting season for cybercriminals. Scammers have grown increasingly sophisticated: rather than impersonating the ATO in a cold call, many are now targeting the tax agents themselves — hacking their practice management software, intercepting client correspondence, and redirecting refunds before anyone notices. If your agent's systems are compromised, you may not realise your refund has been stolen until weeks after it should have arrived.

This guide explains exactly how tax agent cyber fraud works in 2026, the red flags every Australian taxpayer should know, and the practical steps you can take right now to protect your refund and your identity.

How Tax Agent Cyber Fraud Actually Works

Understanding the mechanics of these schemes helps you spot them before they cause damage.

Compromised Tax Agent Portals

Tax agents use specialised practice management software — platforms like Xero Tax, MYOB Tax, HandiSoft, and the ATO's Online Services for Agents portal — to prepare and lodge returns on behalf of clients. When a criminal gains access to one of these portals, they can:

Alter the bank account number on a client's return so the refund is paid to the fraudster's account
Access stored tax file numbers (TFNs), bank details, and identity documents for dozens or hundreds of clients at once
Lodge returns on behalf of clients without their knowledge, often claiming inflated deductions to maximise the fraudulent refund

A single compromised agent account can expose every client on that agent's books. The ATO has reported that credential-stuffing attacks — where stolen username and password combinations from previous data breaches are tried against ATO portals — are one of the primary vectors used to compromise agent logins.

Phishing Attacks Targeting Agents

Many fraudsters don't bother with technical hacking at all. Instead, they send convincing phishing emails to tax agents — emails that appear to come from the ATO, the Tax Practitioners Board (TPB), or software vendors — tricking agents into handing over their login credentials. Once the criminals have those credentials, they can operate inside the agent's account undetected for days or weeks.

Business Email Compromise (BEC)

In a Business Email Compromise attack, fraudsters gain access to or spoof a tax agent's email address and then contact the agent's clients directly. They might send an email that looks exactly like it came from your accountant, asking you to "update your bank details" or "confirm your TFN for lodgement". Clients who trust their agent implicitly may hand over sensitive information without hesitation.

Fake Tax Agents

At the simpler end of the fraud spectrum, some criminals simply advertise as tax agents — on social media, through flyers in community groups, or via word-of-mouth — without ever holding a legitimate registration. They collect fees, gather your personal information, and either disappear or lodge fraudulent returns in your name.

The Scale of the Problem in Australia

The ATO and the Australian Signals Directorate (ASD) have both flagged the tax system as a high-value target for cybercriminals. Key data points worth knowing:

The ATO received more than 100,000 reports of tax-related scams in 2024–25, with dollar losses running into the tens of millions
The most common scam type involved fake ATO refund notifications via SMS and email
Agent portal compromises — while less frequent — typically result in much larger individual losses because a single breach can affect an entire client database
The Tax Practitioners Board suspended or deregistered dozens of agents in 2024–25 following complaints related to fraud, negligence, or data breaches

These figures almost certainly undercount the true scale, because many victims don't realise what happened until long after the event — or never realise at all.

Warning Signs Your Tax Agent May Have Been Compromised

You don't need to be a cybersecurity expert to spot the red flags. Watch for these signals:

Unexpected Correspondence from the ATO

If you receive a letter or message from the ATO about a return you didn't lodge, a debt you don't recognise, or a refund that's already been paid when you haven't finalised anything with your agent — treat it as urgent. Contact the ATO directly on 13 28 61 to find out what's on your account.

Your Refund Is Paid to an Unknown Account

The ATO will only pay your refund to the bank account linked to your myGov/myTax profile, or to your registered agent for distribution. If your agent tells you the refund "went to the wrong account" or asks you to send money back to receive your refund, stop all contact and report it immediately.

Requests to Update Bank Details Via Email or Text

Legitimate tax agents will never ask you to provide or update your bank details via an email link, SMS, or social media message. If you receive such a request — even if it appears to come from your agent — call the agent's office directly using a phone number you've sourced independently (not from the email itself) to verify.

Pressure to Lodge Quickly or Claims of "Special Deals"

Fraudsters often create urgency: "Lodge in the next 48 hours for a guaranteed bigger refund." No legitimate agent can guarantee a specific refund amount before they've reviewed your income and deductions. Anyone who makes that promise is likely fraudulent.

Agent Is Not on the TPB Register

Every registered tax agent in Australia must be listed on the Tax Practitioners Board (TPB) register at tpb.gov.au. You can search by name, business name, or registration number. If your agent isn't there, they are operating illegally and you should not use them.

What to Check Before You Lodge Your 2026 Return

Take these steps before handing anything over to your agent this tax season.

1. Verify Your Agent's Registration

Go to tpb.gov.au/search-register and search for your agent by name or registration number. Confirm their registration is current and not suspended. This takes two minutes and is the single most important check you can make.

2. Log Into myGov and Review Your Account

Sign into your myGov account linked to the ATO and check:

The bank account details on file — make sure they're yours
Any lodgements or notices you don't recognise
The contact details (email, phone, address) — have they been changed without your knowledge?
Any tax agents currently authorised to act on your behalf

If anything looks unfamiliar, call the ATO immediately.

3. Check Your Income Pre-fill Data

The ATO pre-fills your return with data from employers, banks, health insurers, and government agencies. Before you confirm any details, review the pre-fill information for accuracy. If income has been added that you don't recognise — or if income you know about is missing — it could indicate your TFN has been used fraudulently.

4. Confirm Lodgement Only After You've Reviewed Everything

Don't authorise your agent to lodge your return until you have reviewed and agreed to every figure on the return. Reputable agents will always provide you with a copy of the return for your approval before lodgement. If an agent lodges without your explicit approval, that is a breach of their professional obligations.

5. Store Your TFN Securely

Your Tax File Number is the skeleton key to your tax identity. Store it in a secure password manager or physical lockbox — not in an email draft, not in your notes app, and certainly not in a message on social media. If you believe your TFN has been compromised, contact the ATO to discuss options.

What to Do If You've Been a Victim

Acting quickly minimises the damage. Here's the order of operations:

Contact the ATO Immediately

Call 13 28 61 (individuals) or 13 72 26 (tax professionals) and report what's happened. The ATO has a dedicated fraud team and can place a flag on your account to prevent further unauthorised activity. Ask them to verify what returns have been lodged in your name and what bank details are currently on file.

Report to the Australian Cyber Security Centre (ACSC)

Lodge a report at cyber.gov.au/report. The ACSC tracks cybercrime trends and your report contributes to intelligence that helps protect other Australians.

Report the Tax Agent to the TPB

If you believe your tax agent's systems have been compromised — or if your agent was the source of the fraud — lodge a complaint with the Tax Practitioners Board at tpb.gov.au. The TPB can investigate, suspend, or deregister agents who have breached their obligations.

Alert Your Bank

If your bank account details were compromised or if you transferred money to a fraudster, contact your bank's fraud line immediately. Under the Scams Prevention Framework introduced in 2025, Australian banks have strengthened obligations to assist scam victims, including faster freezing of suspect accounts and improved reimbursement processes for certain scam types.

Place an Alert on Your Credit File

Contact Equifax, Illion, or Experian — Australia's three credit reporting bodies — to place a credit alert on your file. This doesn't freeze your credit but flags to lenders that extra verification is required before credit is issued in your name.

Consider Requesting a New TFN

In serious cases where your TFN has been widely exposed, the ATO may issue a new TFN. This is not automatic — you'll need to make a formal request and demonstrate that the existing number has been misused or is at significant risk.

How to Choose a Trustworthy Tax Agent

If you're looking for a new agent or want to reassess your current one, here's what to look for:

Factor	What to check
Registration	Listed on the TPB register with a current, active status
Communication security	Uses secure client portals (not plain email) for document exchange
Authorisation process	Requires your signed or electronic approval before lodgement
Transparent fees	Fee is fixed or clearly explained — not a percentage of your refund
Privacy policy	Has a written policy explaining how your data is stored and protected
Cyber hygiene	Uses multi-factor authentication (MFA) on all practice software

Important: It is illegal under Australian law for a tax agent to charge a fee that is calculated as a percentage of your tax refund. If an agent offers this arrangement, walk away and report them to the TPB.

Protecting Yourself Year-Round, Not Just at Tax Time

Tax fraud doesn't only happen in July and August. Criminals can access compromised information months before tax time and use it well after. A few year-round habits significantly reduce your risk:

Enable multi-factor authentication on myGov. This single step makes it dramatically harder for anyone to access your ATO account even if they have your password. Go to myGov settings and activate it now if you haven't already.

Use strong, unique passwords. If you use the same password across multiple sites and one of those sites suffers a data breach, your ATO and myGov accounts may be next. A password manager (such as Bitwarden, 1Password, or the built-in options in iOS and Android) removes the burden of remembering unique passwords for every site.

Review your myGov account after major data breaches. Australia has seen large-scale breaches at major companies in recent years. After any significant breach that may have exposed your details, log into myGov and check for unauthorised activity.

Be sceptical of unsolicited contact about your tax affairs. The ATO will not ask for payment via gift cards, cryptocurrency, or wire transfer. It will not threaten immediate arrest. If you receive a call, email, or text that creates panic about your tax account, hang up and call the ATO directly to verify.

Worked Example: How a Refund Redirect Scam Plays Out

To make this concrete, here's how a typical refund redirect attack unfolds — and where it could have been stopped.

Scenario: Sarah is a Melbourne nurse earning $95,000 per year. She uses a registered tax agent, Ben, who has looked after her returns for five years. Ben's practice management software is breached via a phishing email in June. The criminals log into Ben's portal and change the bank account on Sarah's pending return from Sarah's account to a mule account. Ben lodges the return in late July. Sarah's $2,400 refund is paid to the mule account. The criminals withdraw it within hours.

Sarah doesn't notice until mid-August when she asks Ben why the refund hasn't arrived. Ben checks the return and realises what happened. By then, the money is gone.

Where it could have been stopped:

Ben enables MFA on his software portal → phishing attack fails
Sarah logs into myGov and checks her bank details before lodgement → she notices the unfamiliar account
Ben sends Sarah a copy of the return for approval before lodgement → Sarah sees the wrong bank account listed

If you want to understand how your income and deductions affect your expected refund amount so you know what to look out for, use the Income Tax Calculator at Dolaro to estimate your liability before your agent lodges anything. Knowing your approximate refund in advance makes it much harder for a fraudster to redirect it without you noticing.

Frequently Asked Questions

How do I know if someone has already lodged a tax return in my name?

Log into your myGov account linked to the ATO and check the "Lodgements" section. If a return appears that you didn't authorise, call the ATO on 13 28 61 immediately. The ATO can verify lodgement dates and agent details and flag your account for investigation.

Can the ATO recover my stolen refund?

In some cases, yes — particularly if the fraud is reported quickly and the funds haven't yet been withdrawn from the receiving account. However, recovery is not guaranteed. The sooner you report, the better the chances. The ATO also has a formal dispute process for refunds paid as a result of fraud.

What is the Tax Practitioners Board and how does it protect me?

The Tax Practitioners Board (TPB) is the national regulator for tax agents, BAS agents, and tax (financial) advisers. It sets registration standards, investigates complaints, and can suspend or deregister practitioners who breach their obligations. If your agent behaves fraudulently or negligently, the TPB is the body to contact.

Is my tax agent legally required to get my approval before lodging my return?

Yes. The TPB's Code of Professional Conduct requires registered tax practitioners to obtain client approval before lodging a return on their behalf. Lodging without your knowledge or consent is a breach of that code and may also constitute fraud. You can report such conduct to the TPB.

Does the ATO ever contact people by SMS or email about refunds?

The ATO does send some SMS and email notifications, but it will never include a link asking you to provide bank details, TFN, or payment information via those messages. Any message asking you to click a link to claim a refund or update payment details is a scam. Forward suspicious SMS messages to 7226 (SCAM) and report emails to ReportEmailFraud@ato.gov.au.

What should I do if my accountant tells me to pay a fee to release my refund?

Do not pay. Legitimate agents deduct their fee before lodgement or invoice you separately — they do not hold your refund hostage. If an agent demands payment to release a refund, stop all contact, report them to the TPB, and call the ATO to check the status of your return directly.

Can I lodge my return myself to avoid agent fraud risk?

Yes. If your tax affairs are straightforward — PAYG income, simple deductions, no investment properties or complex assets — you can lodge directly through myTax via myGov at no cost. This removes the agent as a potential attack vector entirely. If your affairs are complex, the benefits of a registered agent usually outweigh the risks, provided you take the verification steps outlined in this article.

Related Calculators and Guides

Income Tax Calculator — estimate your tax payable and expected refund before lodgement so you know what to watch for
Pay Calculator — work out your after-tax take-home pay to cross-check your employer's PAYG withholding
Rental Income Tax Calculator — if you have investment property income, calculate your tax position before your agent lodges
HECS-HELP Repayment Calculator — check whether your HECS repayment threshold triggers in the current year so you can verify the amount on your return
Capital Gains Tax Calculator — if you've sold shares or property, estimate your CGT liability so you can confirm what your agent has calculated

Information in this article is current as at September 2026. ATO scam tactics, TPB regulations, and cybersecurity guidance evolve regularly — always verify current details at ato.gov.au, tpb.gov.au, and cyber.gov.au before acting.

This article is for general information only and does not constitute financial, tax or legal advice. Individual circumstances vary. Consult a registered tax agent or licensed financial adviser before making decisions based on this information.