Is this ATO myGov scam message a scam?
Commonly seen since 2023. Last reviewed 2026-06-05.
Check your exact messageExample only - do not act on it
Example only: myGov/ATO: your refund or payment is on hold. Sign in to verify: [fake-link removed]
Why this message is suspicious
- ATO and myGov don't send links asking you to sign in to release money.
- Fake sign-in pages capture your myGov credentials.
- Access to myGov enables wider identity fraud.
What the scammer wants
- A payment 'to clear your name', pay a fine, or release a refund
- Your ID details (passport, Aadhaar/PAN, national ID) for identity theft
- Fear and pressure so you act before verifying
Common variations
- Example only: ATO: action required on your account: [fake-link removed].
- Example only: myGov security alert - confirm details: [fake-link removed]
Red flags to watch for
What to do now
- Don't act on the message or call/reply to numbers in it.
- Verify only through the agency's official website, app, or a phone number you look up yourself - never a number or link from the message.
- Save evidence, then report through your country's official cybercrime channel.
What not to do
- Do not stay on threatening calls or follow remote instructions.
- Do not pay fines or 'clearance fees' via links, gift cards, crypto, or transfers.
- Do not share Aadhaar/PAN/passport/KYC details from a message link.
If you already responded
Act quickly - the sooner you respond, the more you can limit. Find the situation that matches what you did:
If you clicked a link: Close any page; don't enter ID, card, or login details.If you entered details, treat them as compromised and secure those accounts.Expect follow-up 'official' calls - they're part of the scam.
If you paid: Contact your bank immediately to try to stop or recall the payment.Report to your national cybercrime portal/police with all evidence.Beware 'recovery agents' who contact you afterwards - that's a second scam.
If you shared a code, OTP, or login: Never share a one-time code; no genuine agency needs it.If you shared one, secure the linked account and enable app-based 2FA.Tell your bank if it related to a payment or login.
If you only clicked the link but entered nothing: close the page, don't enter anything, and watch the linked accounts for unusual activity. Full steps →
If you entered card details: contact your bank now to freeze the card and dispute charges, then watch your statement. Full steps →
If you shared an OTP or one-time code: the scammer may be logging in right now - change the password, sign out other sessions, and turn on app-based 2FA. Full steps →
If you sent money: contact your bank or payment provider immediately to try to stop or recall it, and report it. Full steps →
If you installed an app / gave remote access: disconnect from the internet, uninstall it, and change key passwords from a different, trusted device. Full steps →
If you shared passport, ID, or KYC documents: watch for identity theft, consider a credit freeze or fraud alert, and keep the evidence. Full steps →
Watch out for a second scam. People who've just lost money are often contacted again by a fake "recovery" service promising to get it back for an upfront fee. Legitimate recovery never starts with a fee paid to someone who contacted you - see recovery scams.
First time dealing with this? Start with the first 24 hours after a scam checklist and how to save evidence.
How to verify safely
Verify only through the agency's official website, app, or a phone number you look up yourself - never a number or link from the message.
How to report it
Report through official channels for your country. Use our scam reporting directory to find the right authority, and never use phone numbers or links from the suspicious message itself. If an official link looks outdated, tell us so we can review it.
Official sources checked
- FTC Consumer Advice - Imposter scams High reliability
Government alert
-
Law-enforcement alert
Reviewed 2026-06-05. See our methodology for how we select sources.
Related pages
- Government benefit scam
- Police or legal threat scam
- Smishing (SMS phishing)
- What to do if you sent money to a scammer
- What to do if you shared your ID or passport
- How to save scam evidence
Related platforms
Report in your country
Related terms
Frequently asked questions
Does myGov/ATO send sign-in links?
No. Always type the official myGov address yourself rather than tapping a link.