The ATO is warning taxpayers and businesses about a new scam email doing the rounds under the guise of a payment update or an income statement review. Clicking the link doesn't just risk a stolen password — it installs remote desktop software, handing a scammer direct access to the device. If your business runs correspondence or bookkeeping through a shared inbox, that exposure is already live.
September 2026
Ato Alert Issued
Remote Desktop Software
What the Link Installs
1800 008 540
ATO Scam Reporting Hotline
Forward Suspicious Emails Here
IN BRIEF
The ATO has confirmed a scam email impersonating a "payment update" or "income statement review" notice. Instead of just phishing for a password, the link installs remote access malware on the device. The ATO will never send an unsolicited email that directs you to a login page, treat any email that does as suspicious, and report it rather than clicking through.
What does the scam email look like?
The email arrives with a subject line suggesting something routine needs attention — a payment update sitting in your ATO profile, or a request to review your income statement. It's designed to look like standard ATO correspondence and to prompt a quick click rather than close reading.
Earlier versions of this type of scam asked you to click through to a fake myGov login page to steal your credentials. This one is different: the link instead downloads remote desktop software. Once installed, it can give the scammer live access to whatever is on that screen — not just a password, but emails, banking portals, and client files open at the time.
KEY CHANGE
This scam doesn't stop at stealing a login. It installs software that gives the scammer direct, live access to the device itself — a bigger step up in risk than the credential-phishing emails the ATO has flagged in previous alerts.
What the ATO will actually do
Make updates and messages available for you to find by logging in to myGov or ato.gov.au independently.
Contact you by phone, where you can verify who you're speaking with and call back through a published number.
Ask you to lodge or respond to something through ATO online services, not by replying to an email.
What the ATO will never do
Send an unsolicited email or SMS with a link to a login page.
Ask for your myGov username, password or security codes by email.
Use DocuSign, or any third-party e-signature tool, to finalise a refund.
Request urgent payment or personal details through an unexpected email or phone call.
What should business owners do now?
Brief your team
If anyone other than you checks the business inbox — a bookkeeper, office manager or admin assistant — make sure they know not to click links in unexpected ATO emails, even when the subject line looks routine. A thirty-second heads-up now is cheaper than a cleanup later.
Go direct, not via the email
If a message claims something needs your attention, don't click through. Log in to ato.gov.au or the ATO app directly and check your account from there. Anything genuine will be sitting in your account waiting for you regardless.
Isolate and report if you've already clicked
Disconnect the device from your network straight away, then contact your IT support to check for and remove any remote-access software. Report the email to the ATO on 1800 008 540, or forward it to ReportScams@ato.gov.au.
Check shared devices and logins
If your business uses shared computers or shared logins for bookkeeping or admin, it's worth checking now whether any remote-access software has been installed without your knowledge, particularly on machines with access to banking or payroll platforms.
This article is intended as general information only and does not constitute tax advice. Every business's situation is different. We recommend speaking with us directly to understand how these changes apply to your specific circumstances.
Not sure if that ATO email is genuine?
Our team can help you verify suspicious correspondence and tighten up how your business handles anything claiming to be from the ATO.