Beware scam ATO text messages offering rebates or refunds

Scam text messages claim that a recipient can receive a refund or tax rebate from the Australian Tax Office (ATO) and to click a link to claim that refund.

Such scams are phishing scams (or smishing, which is phishing scams that arrive through SMS.) The links will lead to spoof websites that are designed to look like the Australian Tax Office website.

However these website will actually belong to criminals, and any information entered into the spoof website is transmitted to those same crooks. This in turn will lead to identity theft as the crooks come into possession with a victim’s personal and sensitive information.

An example of such a scam text message is below.

You are due to receive an ATO DIRECT refund of $3742.11 AUD. Please visit https://www.ato.gov.au.loginservices.info/ Thanks, Australian Taxation Office.

At first glance the link may appear to belong to the official ATO website, which is located at www.ato.gov.au. However the website has been cleverly disguised. The real web domain in this example is loginservices.info The real domain will always appear directly left of the TLD (top level domain, which is .info, but other examples can include .co.uk, .au, .nz and, of course, .com)

Sponsored Content. Continued below...

The ato.gov.au are all subdomains, which appear left of the main web domain. Subdomains can have any name, and are named by the owner of the main web domain (again, in this case, that’s loginservices.info.)

See the below graphic for reference.

In the example above, crooks are in control of the loginservices.info domain and have designed it to look like the real ATO website. Any information entered into the website will be stolen and sent to the criminals.

Text (and email) scams purporting to offer free rebates and tax relief are popular ways of tricking recipients into compromising their own security. Never click on the links contained in any of these messages. If you’re not sure if such an email is legitimate, you can contact your tax entity directly using the contact information on their official website or any paperwork you may have.