The Fake ATO Refund Email Doing the Rounds: How to Spot It in 30 Seconds
A convincing 'DocuSign' email is impersonating the ATO this tax time. Here's the exact trick, the red flags, and the three things the ATO simply never does.
Tax time is also scam season. The ATO records its highest volumes of scam reports between July and October each year — exactly when millions of us are lodging returns, waiting on refunds, and half-expecting a message from the tax office. Scammers know that, and 2026 is no different.
The good news: almost every one of these scams falls apart the moment you know the two or three things the ATO simply never does. Learn those, and you can size up a suspicious message in about 30 seconds — no tech skills required.
The scam doing the rounds right now
The one to watch this tax time is a fake 'DocuSign' email. It's designed to look like a genuine DocuSign message (DocuSign is a real, widely-used e-signature service), and it claims to carry an official ATO document — often one titled 'Declaration and Final Release', with wording like 'notice of assessment' in the subject line.
The story it tells is clever: the ATO is supposedly holding your tax refund until you review and 'sign' this document. There's a big 'Review Document' button that begs to be clicked. Click it and you land on a counterfeit myGov sign-in page that looks like the real thing — but it's built to harvest your username, password, name, date of birth and driver licence details.
Once they have those, criminals can log in to your real myGov account, redirect your refund to their own bank account, raid your super, or sell your identity to organised crime. This isn't a small-time trick.
The ATO does not use DocuSign
Full stop. The ATO will never ask you to 'release' or 'finalise' a refund by signing a document through DocuSign. Any email that claims this is fake — don't click it, report it, delete it.
Worked example: spotting the fake
Say this lands in your inbox during tax time. Here's how to read it, line by line, without clicking a thing:
- Subject: 'ATO Notice of Assessment — action required to release your refund'. Red flag: real refunds are never gated behind an 'action' you have to take by email.
- Sender: something like 'ATO via DocuSign <noreply@docusign-ato-secure.com>'. Red flag: an odd, look-almost-right domain. The ATO doesn't send assessments through DocuSign at all.
- Body: 'Your refund of $2,184.50 is on hold. Review and sign the attached Declaration and Final Release within 24 hours.' Red flag: a suspiciously exact dollar figure plus a countdown — urgency is the scammer's favourite lever.
- Button: 'Review Document', which (if you hover without clicking) points to a random web address, not my.gov.au or ato.gov.au. Red flag: the link doesn't go where it says.
The three things the ATO never does
You don't need to memorise every scam variant. Just remember these, because a genuine ATO or myGov message will never break them:
- It never sends you an email or text with a link to log in. The ATO and myGov will never include a hyperlink to their sign-in pages in a message — and the ATO no longer puts links in its unsolicited text messages at all.
- It never asks you to send personal details by return email or SMS. Your tax file number, bank details, date of birth, licence — the ATO won't ask you to reply with any of that.
- It never threatens you into paying on the spot. Fake 'tax debt' calls demanding immediate payment by gift cards, vouchers or cryptocurrency — or threatening arrest if you hang up — are always scams. The real ATO doesn't work that way.
A refund isn't 'released' by clicking anything
This is the misconception the DocuSign scam feeds on. Your refund isn't held hostage behind a button. Once your return is processed, the ATO pays it automatically to the bank account on your file — no signing, no confirming, no clicking required.
The 30-second check
Got a message you're not sure about? Don't tap the link and don't reply. Do this instead:
Open a fresh browser tab (or your phone's app store version of the app) and go to myGov or the ATO yourself — type my.gov.au or ato.gov.au, or open the official myGov and ATO apps. If the message is genuine, it'll be sitting in your myGov Inbox when you log in the normal way. If it's not there, it wasn't real.
Still unsure? Call the ATO's scam line on 1800 008 540 and ask them to check. It's free, and they'd far rather take that call than clean up afterwards.
If you already clicked or handed over details
Don't panic, but move quickly — the faster you act, the less damage a scammer can do. Work through this list:
- Change your myGov password straight away, and turn on two-step sign-in if it's off. If you reused that password anywhere else, change it there too.
- Call the ATO on 1800 008 540 to report it and flag your account.
- Call the Services Australia Scams and Identity Theft help desk on 1800 941 126 (Mon–Fri, 8am–5pm AEST) if your myGov, Centrelink or Medicare details were exposed.
- Contact IDCARE, the free national identity and cyber support service, on 1800 595 160 (Mon–Fri, 8am–5pm AEST). They'll help you build a recovery plan at no cost.
- Forward the scam email to ReportScams@ato.gov.au, then delete it. Keep an eye on your bank and super accounts for anything you didn't do.
Reused passwords are the real danger
If your myGov password is the same one you use for email or online banking, one leaked login can unlock everything. A password manager and unique passwords turn a scary click into a minor annoyance.
FAQ
Does the ATO use DocuSign?
No. The ATO does not use DocuSign and will never ask you to review, sign or 'release' a tax refund through it. Any email claiming to hold your refund until you sign a DocuSign document is a scam — report it to ReportScams@ato.gov.au and delete it.
Will the ATO or myGov ever text or email me a link to log in?
No. The ATO and myGov will never send you an email or SMS with a hyperlink to their login pages, and the ATO no longer includes links in unsolicited text messages. If you get one, don't click it — log in by typing my.gov.au or ato.gov.au yourself, or use the official apps.
I gave a scammer my myGov details — who do I call?
Change your myGov password immediately, then call the ATO on 1800 008 540 and the Services Australia Scams and Identity Theft help desk on 1800 941 126. For free identity-recovery support, contact IDCARE on 1800 595 160.
How can I tell if a message is really from the ATO?
Log in to myGov or the ATO the normal way — type the address yourself or use the official app — and check your myGov Inbox. Genuine messages appear there. If it's not in your Inbox, or you're unsure, call the ATO on 1800 008 540 to verify before doing anything.
Run your own numbers