The start of a new financial year is a busy stretch for every small business. Returns are being prepared, BAS is due, and inboxes fill with messages about refunds, statements and payments. It is also the season when scammers are most active, because they know how much financial activity is happening and how easy it is to act quickly when something looks routine.
The good news is that a few clear habits go a long way. With the right awareness and a small number of sensible controls, an Australian small business can move through tax time with confidence.
The scale of the activity is worth understanding. The National Anti-Scam Centre reported that Australians lost $2.18 billion to scams in 2025, up 7.8 per cent on the previous year. Phishing accounted for $97.6 million of that total, and payment redirection scams, often known as business email compromise, were the single biggest contributor to losses for small and micro businesses at $166.8 million. The Australian Taxation Office has also reported that ATO impersonation email scams rose by more than 300 per cent year on year in the lead up to tax time.
These numbers are not a reason for alarm. They are a reminder that good practice matters most during the periods scammers target, and tax time is one of them.
What tax-time scams tend to look like
Most tax-time scams are impersonation scams. A message arrives by email, SMS or phone claiming to be from the ATO, myGov, a bank or even a supplier or staff member. It often points to a refund waiting to be claimed, a payment that needs to be made urgently, or a login that needs to be confirmed. The aim is to capture personal details such as a Tax File Number, myGov credentials or bank information, or to redirect a genuine payment to the wrong account.
The ATO is clear about how it operates. It will never send an email or SMS with a link asking you to log in to online services, and it will never ask for personal or financial information through those channels. That single fact rules out a large share of the messages doing the rounds at this time of year.
Practical steps that protect your business
A short checklist covers most of what matters for a business with 1 to 50 staff.
- Pause before acting on anything urgent. Scammers rely on speed and pressure, so a moment to verify is the most valuable habit of all. If a message claims to be from the ATO, you can confirm it by calling 1800 008 540 or checking the ATO app rather than using any contact details in the message itself.
- Verify payment changes independently. If a supplier or staff member asks to update bank details, confirm it by calling a known number, not one supplied in the email. This one step is the most effective defence against payment redirection scams.
- Switch on multifactor authentication everywhere. Adding a second layer to email, myGov, accounting platforms and banking makes stolen passwords far less useful to anyone who obtains them.
- Talk to your team. A quick conversation about what to expect at tax time means everyone knows to slow down, check, and ask before clicking a link or approving a payment.
- Know how to report. Suspicious ATO messages can be forwarded to ReportScams@ato.gov.au or reported to Scamwatch. If money or sensitive information has already been shared, calling the ATO promptly on 1800 008 540 and contacting your bank gives the best chance of limiting any impact.
Bringing it together
Staying secure at tax time is less about technology and more about good routines, backed by a few well-placed controls. The businesses that handle this season best are the ones who have these habits in place before the busy period begins, rather than scrambling once a suspicious message lands.
Helping Australian small businesses put those controls in place, from multifactor authentication to staff awareness and the right protections around email and payments, is the kind of practical, advisory work Reef IT provides as part of an ongoing partnership.
Looking for an IT partner who puts your business first? Talk to the team at Reef IT today.
