Australia markets closed
  • ALL ORDS

    6,784.30
    -33.80 (-0.50%)
     
  • AUD/USD

    0.6810
    +0.0010 (+0.15%)
     
  • ASX 200

    6,594.50
    -34.80 (-0.52%)
     
  • OIL

    100.94
    +1.44 (+1.45%)
     
  • GOLD

    1,768.40
    +4.50 (+0.26%)
     
  • BTC-AUD

    29,697.13
    -10.54 (-0.04%)
     
  • CMC Crypto 200

    438.29
    -1.74 (-0.39%)
     

Warning over $736 'myGov' email: ‘Outstanding refund’

·Personal Finance Editor
·4-min read
A copy of the myGov email scam and a person filling out their tax return deductions form.
Aussies are being warned to be on the lookout for this myGov scam as we approach the end of financial year. (Source: MailGuard/Getty)

The end of financial year is upon us and Aussies are being warned to be on the lookout for an email claiming to be from myGov saying they have an outstanding tax refund.

The phishing scam, intercepted by MailGuard, impersonates myGov and seeks to steal unsuspecting Aussies' accounts and credit card credentials.

MailGuard has warned Aussies to be on the lookout for an email with the subject line: “You have an outstanding refund from myGov.”

The sender name shows “myGov – Refund Service”; however, even the display address has been edited, and the sending address is a jumble of letters and numbers with a domain that has been linked to other scams.

“The email itself has been craftily designed to appear as one you could expect to receive from myGov,” MailGuard said.

“Although there are a few minor grammatical errors, it’s convincing enough to potentially fool many unsuspecting individuals.”

The body of the email alerts the recipient that they have an outstanding refund of $736.98 and, in order to “accept fast payment online”, they’re instructed to click a link.

A copy of the myGov email phishing scam.
The scam email looks quite convincing. (Source: MailGuard)

After clicking the link, the user is taken to the first phishing site, which is almost an exact replica of the myGov login page, the only immediately obvious difference being the URL.

The user is directed to enter the email and password they use for their myGov account to sign in, although these details will be harvested by the attacker, MailGuard warned.

Next, the user is taken directly to a page where they’re instructed to update their information in order to receive their refund.

The authentic myGov login page uses multi-factor authentication (MFA) when you sign in, meaning, on top of your password, you’ll have to answer a secret question or enter a code that’s received on your mobile.

This step is skipped by the scammers, although this could easily be overlooked by someone who is eager to receive their refund.

On this page, the victim is asked to enter their:

  • Name on the card

  • Card number

  • Expiration date

  • CVV

  • Date of birth

  • Phone number

“Given that interest rates are rising and the cost of living continues to increase, many Australians will be facing anxieties coming into this EOFY and would welcome a payment of $736.98,” MailGuard said.

“This scam preys on the heightened emotions that tax time brings and, given the attention to detail at every stage, it has potential to be very damaging.”

MailGuard said, while myGov’s MFA process should help to limit what access a criminal may get to their victims’ personal information, you can never be too certain what they’re capable of.

“It’s especially important to ensure all of your passwords are unique, so if one were to be compromised in a situation such as this, the attacker can’t use it to access any of your other accounts,” MailGuard said.

How to protect yourself from scams

MyGov offers the following advice in order to protect your account:

  • Don't share your myGov sign in details with anybody else

  • Use a strong password that is easy for you to remember but hard for others to guess

  • Use a different password to your other online accounts

  • Change your password and myGov PIN regularly

  • Don't let other people see your computer screen when you use the 'show password' option

  • Don't send your password and myGov PIN to anyone by email or text message

  • Don't tell anyone your email account password

  • Always sign out of your myGov account when you have finished using it

  • Check for the Extended Validation Certificate indicator in your browser's address bar when accessing myGov. Each browser shows the Extended Validation Certificate in a different way. Usually this is a green box or bar with a padlock icon.

Follow Yahoo Finance on Facebook, LinkedIn, Instagram and Twitter, and subscribe to the free Fully Briefed daily newsletter.

Our goal is to create a safe and engaging place for users to connect over interests and passions. In order to improve our community experience, we are temporarily suspending article commenting