Lba Knowledge - September 2024

It wasn't me: the tax fraud scam

You login to your myGov account to find that your activity statements for the last 12 months have been amended and GST credits of $100k issued. But it wasn’t you. And you certainly didn’t get a $100k refund in your bank account. What happens now? 

In what is rapidly becoming the most common tax scam, myGov accounts are being accessed for their rich source of personal data, bank accounts changed, and personal data used to generate up to hundreds of thousands in fraudulent refunds. For all intents and purposes, it is you, or at least that’s what it seems. And, the worst part is, you probably gave the scammers access to your account.

But it’s not just activity statements. Any myGov linked service that has the capacity to issue refunds or payments is being targeted. Scammers are using the amendment periods available in the tax law to adjust existing data and trigger refunds on personal income tax, goods and services tax (GST), and through variations to pay as you go (PAYG) instalments. In some cases, the level of sophistication and knowledge of how Australia’s tax and social security system operates is next level.

Once the scammers have access to your myGov account, there is a lot of damage they can do.

So, how does this happen and why is it so pervasive? Humans are often the weakest link.

Common scams utilise emails (78.9% of reported tax related scams in the last 12 months) or SMS (18.4% of reported scams) that mimic communication you might normally expect to see. The lines of attack used by tax related scammers are commonly:

• Fake warnings about attempted attacks on your account (and requiring you to click on the link and confirm your details);
• Opportunistic baiting where some form of reward is flagged, like a tax refund, that you need to click on the link to confirm and access; and
• Mimicking common administrative notifications from the Australian Taxation Office (ATO) like a new message accessible from a link.

Approximately 75% of all email scams reported to the ATO to March 2024 were linked to a fake myGov sign in page.

How to spot a fake

Often the first sign that something is amiss is alerts about activity on your myGov account or a change in details - which might seem a little ironic if the way in which scammers got into your account in the first place is via these very same messages. But, there are ways to spot a fake:

• The ATO, Centrelink and MyGov don’t use hyperlinks in messages. If you receive a message with a link, it’s a fake.
• The ATO will not use QR codes as a method for you to access your account.
• The ATO will never ask for your tax file number (TFN), bank account details or your myGov login details over social media. Some scammers have used fake social media accounts mimicking the ATO and other Government agencies. When a query comes in, they respond by asking for information to verify it’s you. The ATO will never slide into your DMs. ATO Assistant Commissioner Tim Loh said, “it’s like giving your house keys to a stranger and watching them change your locks.”
• The ATO do not use pre-recorded messages to alert you to outstanding tax debt
• The ATO will not cancel your TFN. Some scammers suggest that your TFN has been cancelled or suspended due to criminal activity or money laundering and then tell you to either pay a fee to correct it, or transfer your money to a ‘safe’ bank account to protect you against your corrupted TFN.
• The ATO will not initiate a conference call between you and your tax agent and someone from a law enforcement agency. In one case, the taxpayer was told that the caller was from the ATO and a person from her accounting firm was on the call as well to represent her and work through a problem. The ATO caller and the tax agent were fake. Just hang up and call our office if you are ever concerned. The ATO will never initiate a conference call of this type.
• The ATO will also not ask you to reconfirm your details because of security updates to myGov. The link, when activated, takes you to a fake myGov web page that can look very convincing.

In general, you should always log into your myGov account directly to check on any details alerted in messages rather than clicking on links. This way, you know that you are not being redirected to somewhere you should not be.

And, don’t log into your myGov account on free wifi networks. Ever.

Who is getting scammed?

There is a pervasive view that older, technology challenged individuals are the most at risk. And while this might be the case generally, scamming is impacting all age groups.

The ATO says that the demographic who most reported providing personal information to scammers was 25 to 34 year olds. And, the younger generation are more likely to fall for investment scams. According to the AFP-led Joint Policing Cybercrime Coordination Centre (JPC3), people under the age of 50 are overtaking older Australians as the most reported victims of investment scams. Australians reported losing $382 million to investment scams in the 2023-24 financial year. Nearly half (47%) of the investment scam losses involved cryptocurrency. 

Other scams

Scammers are in the business of scamming and they will use every trick and opportunity to part you from your money.

Investment scams

If you are a tax resident of Australia and the beneficiary of a foreign trust, it’s possible that at least some of the amounts paid to you (or applied for your benefit) will need to be declared in your tax return. This applies even if you were not the direct beneficiary of the foreign trust, for example, a family member received money from a foreign trust and then gifted it to you. This applies to cash, loans, land, shares, etc.

Inheritances

Pig butchering. Pig butchering is a tactic where scammers devote weeks or months to building a close relationship with their victims on social media or messaging apps, before encouraging them to invest in the share market, cryptocurrency, or foreign currency exchanges. Victims think they are trading on legitimate platforms, but the money is siphoned into an account owned by the scammers, who created fake platforms that look identical to well-known trading and cryptocurrency sites. Scammers will show fake returns on these platforms to convince victims to invest more money. Once they have extracted as much money as possible, the scammers disappear with all the invested funds.

Deepfakes. Deepfakes are lifelike impersonations of real people created by artificial intelligence technologies. Scammers create video ads, images and news articles of celebrities and other trusted public figures to promote fake investment schemes, which can appear on social media feeds or be sent by scammers through messaging apps. Unusual pauses, odd pitches, or facial movement not matching their speaking tone are often giveaways but increasingly, the fakes are difficult to spot.

Invoice scams

The names and details of legitimate businesses are used to issue fake invoices with the money transferred to the scammer’s account. These scams are often tied to cyber breachers where hackers have accessed your systems and have identified your suppliers.

Bank scams

There has been a lot in the media of late about people receiving phone calls purporting to be from their bank, advising them there is a problem with their account, and then walking them through a resolution that involves transferring all their money into a ‘safe’ scammers account. Victims commonly state that they believed the scammer because of the level of personal information they relayed.

Your bank will never send an email or text message asking for any account or financial details, this includes updating your address or log in details for phone, mobile or internet banking.

A CHOICE survey found that four out of five of the victims of banking scams in their report said their banks did nothing to flag a scam before they transferred their money to the perpetrator.

The Australian Banking Association have stated that, if not already, banks will introduce warnings and payment delays by the end of 2024. And, in addition to other measures, they will limit payments to high-risk channels such as crypto platforms. 

Prize Winnings

On a personal note, this is how Wayne got scammed - nearly!

Having scratched a prize purportedly USD185,000 I was surprised, and I must confess mildly excited. Emails & phone calls to verify its legitimacy ensued; there was heaps of contact back & forth. All sounded legit until some days later my suspicion was aroused when I was asked to deposit via crypto a "Court fee" to Hong Kong. In a very friendly and professional sounding phone call later backed up by an extensive email, the scammer stated "approval sanctioned by our Hong Kong Government Court” is a requirement and USD security deposit is required. I was given the option of travelling to HK to pay the Court fee personally but hey, who has the time to do that. Instead, I decided to check with a HK based lawyer if in fact it is a requirement the Hong Kong Government approve what would be sizable funds transferring out of Hong Kong. The lawyer promptly responded there is no such requirement, and this is almost certainly a scam. Having ignored repeated phone calls for some days now, my phone eventually went silent. Glad I didn't book that expensive overseas holiday in advance!