Tax time creates believable reasons to call, click and change refund details. Protect clients in both directions: from the fake authority and from the fake client.
Scamwatch warns that criminals impersonate the Australian Taxation Office and myGov through calls, texts, emails and websites. The lure may promise a refund, claim an account is suspended, allege a tax debt or demand identity information. Tax time gives each story a familiar setting.
The reverse attack receives less attention. Someone calls the accounting practice pretending to be a client. They may know names, tax details or the existence of a refund because an inbox or document has been compromised. Their goal is to change the bank account before the refund is paid, alter contact details or extract information that supports another fraud.
Caller ID, a familiar voice and knowledge questions are weak evidence. Caller ID can be spoofed, voices can be imitated and private facts can be stolen. The useful question is whether the person can complete a check through the trusted contact point the firm established before the suspicious request.
The methods are not confined to one month, but the stories track the tax cycle. Use this calendar as a communication and training rhythm, not as a claim that scams stop outside the dates shown.
Fake tax-preparation offers, myGov sign-in lures and calls warning of an urgent account problem begin to meet genuine EOFY planning. Firms should brief staff and publish client warnings before the volume rises.
Clients expect ATO messages and may act quickly on a supposed refund, debt or identity alert. Fraudsters can also call practices asking to replace the bank account recorded for a refund.
Busy inboxes and queues make urgency effective. Messages may imitate the ATO or myGov, while callers use real tax context to sound like clients and pressure staff to skip normal checks.
Deadline anxiety, delayed refunds and amendment conversations create another reason to respond. Keep the same verification rule after the campaign has faded from staff attention.
Schedule the staff refresher and client message for May or June. During the season, use short queue reminders and discuss real attempts without exposing client information. After October, review failed checks and exceptions while the operational detail is still fresh.
The criminal borrows the ATO or myGov identity to create urgency. They direct the client to a false sign-in page, ask for credentials or codes, demand payment, or use a conversation to collect identity data.
Stop contact, avoid links and attachments, and navigate independently to the official service. If uncertain, contact the ATO or the practice through a trusted, independently sourced channel.
The criminal borrows the client's identity to influence the firm. They ask reception to “quickly” replace refund details, update a mobile number first, reset access or disclose enough information to make a later attempt stronger.
Pause the request, disclose nothing further and return to the trusted mobile number already held on file. A failed independent check is a reason to escalate, not to keep testing the caller with more private questions.
Never verify through the channel that delivered the suspicious request. Do not use a link in the message, reply to the email or trust the incoming caller ID. Start again from an official service or a contact record established independently.
“To protect every client, we independently verify requests that change bank or contact details. I can't complete the change during this incoming call. I'll use the mobile number already recorded in our practice system and send a Vericode SMS. Please read that Vericode code back when we reconnect. We will never ask for your myGov, ATO or bank security code. If the recorded number is no longer available, I'll pause the request and have an authorised team member follow our alternate verification process.”
Treat changed refund accounts, contact numbers, authorities, email addresses and urgent requests for disclosure as high-risk, even when the caller knows the client's file.
Tell the caller the firm applies the same protection to every consequential change. Do not confirm private file details to establish rapport.
Use the mobile number already held in the practice system. Do not use the incoming caller ID or a replacement number supplied during the call.
Send a one-time SMS code to the trusted mobile number. Ask the person reached to read it back; never ask them to send the code by email or disclose a myGov code.
Stop the request, reveal no further information, preserve the call details and follow the firm's escalation and suspicious-activity process.
Connect the original request, trusted contact source, verification result, escalation, approval and final action in the client record.
Print this section beside the phone or adapt it to the firm's approved procedure. A standalone downloadable script pack is planned; the complete working script and procedure are provided here in the meantime.
Staff highlight a phone number already visible in a browser-based practice system, tax portal or email client, right-click and send a one-time SMS code. The person reads the code back. Verification messages are sent through Australian SMS provider MobileMessage, using Vericode's ACMA-registered sender ID, VERICODE.
Each check is logged with who requested it, the masked target number, its time, method and outcome. Authorised-contact register events also form a per-contact hash chain. Compliance-authorised users can export the result as PDF or CSV. The record can support the firm's procedure, but it does not prove bank-account ownership, replace professional judgement or complete customer due diligence.
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the subprocessor information below.
Public guidance is cited for context. No government or CPA Australia endorsement of Vericode is implied.
Brief staff before EOFY, warn clients through a trusted channel and independently verify consequential changes before the practice acts.