Tax Season Scams Are Starting Early. Here’s the One That Hits Small Businesses First.

Tax time in Australia runs from 1 July to the 31 October lodgement deadline. Your accountant and bookkeeper are busy chasing paperwork, your payroll person is finalising Single Touch Payroll, and everyone expects to hear from the ATO.

Scammers know this. In July 2025 alone, the ATO received almost 7,500 reports of ATO impersonation scams.

The first tax time scam to hit a small business often isn’t a fake ATO message at all. It’s an email to your payroll team that looks like it came from you.

The payroll data scam

Here’s how it works.

Someone who handles payroll or HR receives an email that appears to come from the owner, managing director or another senior manager.

The message is short and urgent:

“I need a full payroll report with everyone’s TFNs, dates of birth and bank details for the accountant this afternoon. Can you send it through ASAP? I’m in meetings all day.”

It sounds right. The tone fits, tax time is busy, and sending payroll information to the accountant is something that happens every year.

So they export the report and send it.

The email didn’t come from the boss. It came from a criminal using a spoofed sender address or a look-alike domain, such as t4-group.com.au instead of t4group.com.au.

The scammer now has every employee’s:

• Full name and date of birth
• Tax file number
• Home address
• Bank account details
• Salary

That’s everything needed to lodge fraudulent tax returns, open accounts, redirect pay or super, and commit identity theft.

What happens next

Most businesses find out when an employee goes to lodge their return and discovers one has already been lodged in their name, or when a refund lands in an account nobody recognises.

Your staff are then stuck dealing with the ATO, IDCARE and their banks, and reapplying for identity documents, all because of one email.

Now multiply that across your whole payroll.

There’s a business cost too. A breach involving tax file numbers is likely to be notifiable under the Notifiable Data Breaches scheme, which means reporting it to the OAIC and telling every affected employee. Rebuilding trust with your team after that takes a long time.

Why it works so well

This isn’t a clumsy scam. It works because:

• The timing is right. Payroll and tax requests are normal between July and October.
• The request is reasonable. It isn’t a demand for gift cards or an urgent bank transfer. It’s a routine document.
• The urgency feels normal. Everyone is busy at tax time.
• The sender looks genuine. Scammers research your business on LinkedIn and your website, so the names, titles and email style are right.
• People want to help. Especially when they think the request is from their boss.

Five rules that stop it

This scam is preventable. It takes clear rules and a team that feels comfortable checking. Technology alone won’t stop it.

1. Payroll data never goes by email. No payroll reports, TFN declarations or employee bank details as email attachments. No exceptions, including for the owner. If the accountant needs payroll information, they get it through your payroll software or a secure portal.
2. Check every sensitive request on a second channel. Call the person on a number you already have, ask them in person, or message them on Teams. Never reply to the email or use the contact details in it.
3. Brief your payroll and finance staff before July. Ten minutes on what this scam looks like and what to do if they see it. Include anyone who can change bank details or approve payments.
4. Turn on multi-factor authentication for email, payroll software, accounting software and your myGov and ATO online services access. If a password is stolen, MFA stops it from being enough on its own.
5. Make checking normal. Thank people who question an unusual request, even when it turns out to be genuine. The person who double-checks is the one who stops the breach.

The other tax time scams to watch for

The payroll data scam is usually first, but it isn’t the only one. Between July and October, expect:

• Fake ATO and myGov emails and texts claiming you’re owed a refund, your account is suspended, or you have a tax debt to pay. The ATO says it will never send an unsolicited message with a link asking you to log in or provide personal information.
• Fake ATO phone calls threatening fines or arrest unless you pay now. The ATO app now has a verify call feature: if someone says they’re calling from the ATO, open the app and check. If no confirmation appears within 30 seconds, hang up.
• Requests to change bank details, either from an “employee” asking for their pay to go to a new account, or a “supplier” sending updated payment details. Always confirm by phone using a number you already have.
• Fake invoices and documents from “your accountant” with links or attachments that steal your email login.

If you’re not sure whether a message is really from the ATO, don’t engage. Call the ATO’s scam line on 1800 008 540.

Is your business ready?

If you already have these rules in place and your team follows them, you’re ahead of most small businesses.

If not, now is the time to fix it, before tax time rather than during it.

Book a free 15-minute Tax Time Security Check. We’ll review:

• MFA on your email, payroll and accounting systems
• How your team handles requests for payroll data and bank detail changes
• Whether your email is protected against spoofing and look-alike domains
• The one policy gap we find in most small businesses

Call us on 1300 765 014 or book online.

If you know a business owner who isn’t prepared, send them this article. It could save them and their staff a lot of pain this tax time.

Sources

• ATO: Scam emails, real consequences (ATO never sends unsolicited links asking you to log in; scam line 1800 008 540)
• Accountants Daily: ATO launches call verification app (almost 7,500 reports in July 2025; verify call within 30 seconds)
• ATO: Scam alerts (current scam examples, updated September 2026)
• Scamwatch: ATO and myGov impersonation scams

The Notifiable Data Breaches point is general guidance, not legal advice. The OAIC treats tax file numbers as information whose loss is likely to cause serious harm.