Your myGov or ATO account has been hacked — what to do now

Reach myGov by typing my.gov.au, never through a link in a message, and change how you sign in before you change anything else. myGov's published advice is to use a multifactor option — a passkey, or Digital ID through myID — and then to turn the password off as a sign-in option entirely. That second half is the step almost everyone skips. A password left enabled is still a working route in, and if the credentials were bought from a marketplace rather than guessed, the attacker already holds them. Secure the email account behind it at the same time, with a different password again, because email is the recovery channel for everything else.

Then turn off your email address and mobile number as usernames. myGov lets you sign in with either, and its guidance is explicit that you should switch this off and use your myGov-generated username instead, because an email address you have used across a dozen other platforms has almost certainly appeared in someone else's breach. The generated username has not. It is ugly and unmemorable, which is the point.

Now read the account history. Under Account settings, Account history lists the last 50 actions on the account — sign-ins, attempted sign-ins, and changes to settings including your email address, mobile number, a connected Digital ID and any added passkey — with the local date and time and the device used. myGov states the test in one sentence: if there is activity that was not done by you, that indicates unauthorised access. Screenshot the list first. It holds fifty entries, and your own remediation will push the attacker's off the bottom of it.

Check connected devices on the same screen and disconnect anything you do not recognise. A connected device or app can hold a live session that survives a password change, so an attacker signed in on their own handset stays signed in while you congratulate yourself on the new passkey. Disconnecting forces every device to authenticate again — which is why you harden the sign-in first and disconnect second.

Then call the Services Australia Scams and Identity Theft Helpdesk on 1800 941 126, open Monday to Friday 8 am to 5 pm AEST, and AEDT during daylight saving. This is not the general Centrelink line and it is not the myGov helpdesk. Services Australia publishes exactly what it does: give advice on protecting your information, check your customer records for suspicious activity, make corrections where needed, and add extra security measures to prevent further unauthorised access. The last two are the reason to phone rather than email. An interpreter can be arranged free, and the line is reachable through the National Relay Service.

If you cannot sign in at all, treat that as a symptom rather than an inconvenience. Unusual sign-in activity can lock an account, and an attacker who has changed the registered email address and mobile number has taken the recovery path with them. Call the myGov helpdesk on 132 307 and select option 1 — Monday to Friday 7 am to 10 pm and weekends 10 am to 5 pm in local time zones, closed on national public holidays. It deals only with your own account: if you are calling for someone else, even as their nominee, that person has to be on the call with you.

myGov is a front door, not a record. It holds your sign-in, contact details and Inbox; the money, the claims and the bank account fields live inside the member services behind it. myGov's instruction after unauthorised access is to check your linked services for changes to your personal information, singling out bank account details, and to contact that service directly if anything looks wrong. The myGov helpdesk cannot correct an ATO record or reverse a Centrelink claim. Every agency has to be told, and each runs its own identity check.

Start with the two that move money fastest. In ATO online services, check the bank account nominated for refunds, then look for returns, activity statements or amendments lodged in your name, then the super accounts listed against you and your contact details. The ATO folds all of this into one number: it publishes 1800 467 033 for someone who thinks their myGov account or linked ATO services were accessed without permission, and for someone who thinks fraudulent updates were made to their ATO record — naming changed bank account details as the example.

In your Centrelink online account, check the payment destination, your address, and your payment and transaction history. Look for claims and advance payments made in your name, changes to Centrepay deductions, and new entries under Money you owe. This is not hypothetical: the Commonwealth Ombudsman's investigation documented perpetrators lodging false claims for payments, advances and loans in victims' names and redirecting pension payments, with some victims then unable to claim assistance such as the Child Care Subsidy until the agencies had finished investigating.

Medicare is where people look last and should not. Your Medicare online account shows three years of claims history for your current card, and lets you order a replacement card, update your address and bank details, manage who is listed on the card and view a digital copy. Check the bank account that receives benefits, whether a replacement card has been ordered to an address that is not yours, and whether anyone has been added to or removed from the card. Claims information older than three years, or from a past card, needs a paper request or a service centre visit.

Child Support, My Health Record, the Department of Veterans' Affairs, the NDIS, My Aged Care, the Unique Student Identifier and Workforce Australia each hold their own record and their own contact details, which is why myGov publishes a contact list per service rather than one number. Read the linked services list itself: myGov tells you what to look for there — whether new services have been linked, or services are missing. A service you never linked means someone else has been at your account. A service that has quietly disappeared is often more alarming, because unlinking is how a record gets moved somewhere you can no longer see it.

Write down what you find as you find it, with dates, times and reference numbers, and keep the file somewhere other than the email account you have just had to secure. Every agency you call will ask for it, and the ATO's standing advice to fraud victims is to document everything — communications, transactions and any evidence related to the fraud. It is also the raw material for a Commonwealth Victims' Certificate application or a dispute with a bank.

There is a version of this attack that leaves your myGov account untouched, and it is the one worth understanding before you conclude you are fine. The Commonwealth Ombudsman's 2024 investigation named it unauthorised linking: a genuine person's member service account — their Centrelink, Medicare or ATO record — is linked to a second, fake myGov account created by somebody else. Your account history shows nothing unusual, because nothing unusual happened in your account. The record was reached through a different front door.

The finding was blunt. As reported when the investigation was released, it concluded that myGov's security controls at the time did not adequately protect people from unauthorised linking where identity theft had occurred, and that those controls focused on stopping fraudsters getting into genuine customer accounts rather than preventing them taking, in the report's phrase, a side entrance to member service accounts. Four recommendations were made to Services Australia and all four were accepted.

What that meant in practice was false claims for payments, advances and loans lodged in victims' names, redirected pension payments, and bogus tax claims worth thousands of dollars. Many victims then had their accounts locked and their payments suspended while the agencies investigated — a second injury delivered by the response to the first. Expect that sequence, because it changes what you should ask for on the phone: not only that the fraud be stopped, but that your legitimate payments keep running while it is investigated, and the name of the person who agrees to it.

The practical consequence is that a clean myGov account history proves very little on its own. If money has moved, or a claim exists that you did not make, or a card was issued you did not order, the compromise may sit at the agency layer rather than the myGov layer, and calling the myGov helpdesk alone will never surface it. Ask each agency directly whether any account other than yours has been linked to your record, and when — that is a question the agency can answer and myGov cannot.

Services Australia has been working through the recommendations and publishes its progress. Its February 2026 update states that three of the four recommendations and both of the report's suggestions are complete, and lists what changed: additional controls on sensitive account changes such as banking details, multifactor authentication steps when updating myGov account settings, stronger customer authentication when linking Centrelink, Medicare and Child Support accounts to myGov, and closer work with member services on shared risks. Work on the final recommendation continues, with further measures against fraudulent payment redirections promised.

The same update reports that almost 3.7 million myGov accounts moved to stronger sign-in methods such as passkeys or Digital ID after the Security Review feature was introduced in December 2024. That is the most concrete argument available for completing the security review prompt in your own account rather than dismissing it for a fourth time, because the attack described above works best against accounts still protected by a reusable password.

Services Australia publishes a set of protections almost nobody knows about, for a structural reason: none of them can be switched on from a screen. You have to ask, by phone or in person. If you are already on the call to the Scams and Identity Theft Helpdesk, ask for all of them at once.

The first is a secret password added to your Medicare, Centrelink and Child Support records. It sits on top of the usual identity questions and you must give it to a Service Officer when you speak to them by phone or in person. You cannot add it online — you phone or visit a service centre — and Services Australia's warning travels with it: never tell it to anyone unless you are certain you are speaking to its staff, which in practice means a call you placed.

The second is a lock. You can ask Services Australia to lock access to your Centrelink, Medicare and Child Support online accounts, to phone self-service, and to the Express Plus apps. This too requires a phone call or a visit. It is inconvenient by design, and it is the right choice when you know credentials are circulating and would rather transact in person for a few weeks than leave a door ajar while an investigation runs.

If your Customer Reference Number has been exposed, you can ask for additional authentication measures on your Centrelink information; the department directs you to call your payment line. If a Child Support Reference Number has been exposed, Services Australia says it will put additional security measures in place and asks you to phone the Child Support enquiry line so the requirement is recorded. A concession card that has been exposed does not need replacing — it keeps working, and the department says so plainly, which saves a call.

A Medicare card is the exception. If the number has been exposed you can order a replacement through myGov or the myGov app, and the replacement carries a new issue number and expiry date, which makes the old card invalid. That is not the same as a new Medicare number: to change the number itself you must transfer to a new Medicare card, a separate request. A digital copy appears in the myGov app straight away; the physical card takes three to four weeks.

On the tax side, ask the ATO's Client Identity Support Centre what safeguards it can apply. The ATO publishes three categories: additional proof of record ownership before it will discuss your affairs at all, additional monitoring that flags irregular activity before automatic processing, and additional security measures inside its systems. It also states the exit condition — the measures stay on your file until the ATO determines there is no further risk. This is not a setting you switch off when it becomes annoying in October.

Do all of this in a single pass if you can. Every one of these calls requires you to prove your identity to an agency that has just been told your identity is compromised, which is slower than a normal call by design. Have your identity documents in front of you before you dial, along with your log and any report reference number.

The safeguards the ATO applies after fraud are useful and also disruptive, and the disruption is rarely explained before it lands. The ATO sets out what the measures can do. You may lose ongoing access to ATO online services and myGov unless you hold a Strong Digital ID such as myID. Pre-fill data may not be available. Extra checks may delay returns and other forms. Business activity statements may stop issuing automatically, so you or your agent must contact the ATO before each lodgment. And your Digital ID may itself be suspended while a compromise is investigated.

Read that list again against your own year. No pre-fill means assembling your income statement, bank interest, dividends and private health information by hand from the source documents. Delayed processing means a refund you had budgeted for in a fortnight may take considerably longer, so do not commit it. A suspended Digital ID means the recovery route you were relying on to get back into myGov is, temporarily, not there.

The fix for most of that is the same thing the ATO recommends as the protection. Its position is that a Strong myID is the most secure way to reach ATO online services through myGov, because setting one up requires verified identity documents plus a one-off face verification check in the app, and because it sets your online access strength — which gives you unrestricted access even where additional safeguards have been applied to your record. The thing that keeps the fraudster out is also the thing that keeps you in.

If the documents that would get you to Strong are themselves among those compromised, this becomes circular, and it is worth saying so on the phone rather than struggling on alone. The ATO's Client Identity Support Centre discusses which identification documents you will need when you call, and it exists precisely because the standard proofs of identity are often the things that were stolen. The same applies to a driver licence reissued with a new number after a fraud — tell the ATO rather than letting a mismatch fail silently in the app.

One boundary is worth stating clearly. What happens to a return lodged in your name, a refund paid to an account that is not yours, and the interest or penalties that followed is a separate process from securing the account. The ATO can extend time to lodge a replacement return, remit general interest charge where that is fair and reasonable, and arrange payment by instalments where a resulting debt causes hardship. It also publishes where it cannot help — where an assessment is valid, where a refund has already issued to the destination you or your authorised representative instructed, or where there is insufficient evidence of fraud.

myGov and Services Australia give the same advice, and it still surprises people: where there is activity on the account that was not done by you, and you cannot secure it or cannot reach the helpdesk, the safest step is to close the myGov account and create a new one. Services Australia repeats it in its out-of-hours guidance, and myGov repeats it on both its unauthorised-access and account-history pages. It is the published position, not a counsel of despair.

Understand what closing does before you do it. It is permanent. It unlinks every service you have connected, and you lose access to every message in your myGov Inbox. What it does not do is delete your underlying records: your Centrelink customer record, your Medicare enrolment and your ATO record live with those agencies, not with myGov, and survive intact. What dies is your copy of everything they have sent you — for most people, several years of letters nobody printed.

So spend twenty minutes first. Download or print anything in the Inbox you might plausibly need: Centrelink letters and payment summaries, Medicare statements, notices of assessment, income statements, concession card correspondence. Write down your Customer Reference Number, your Medicare card number including the individual reference number beside your name, and your tax file number — and store all of it somewhere other than the email account you have just had to secure.

Then close it: sign in, Account settings, Close account. myGov asks you to enter your password or use your Digital ID again before it proceeds, which is the last time that password will be useful to you. Create the new account with a different email address from the compromised one, and set it up from the start with the strongest sign-in option available — Digital ID or a passkey — with the password disabled and without reusing a password from any other account.

Relinking is the slow part, and it is where the duplicate-account trap lives. Do not create the second account while the first still exists, and do not abandon a half-relinked new account and start a third when a linking code expires. Link each service deliberately, using a linking code from that agency or a verified myID, and check as you go that each service shows the history you expect. A service that links but shows an empty or unfamiliar record is a signal to stop and phone that agency rather than push on.

Closing is not always proportionate. If you still control the account, the history shows a single failed sign-in attempt from an unfamiliar device, and nothing in any linked service has changed, then hardening the sign-in, disconnecting stale devices and completing the security review is enough. The trade is simple: closing costs you the Inbox archive and most of a day, while keeping a genuinely compromised account costs you everything behind it.

Superannuation is the largest number attached to your identity and the one almost nobody checks after a breach. The ATO lists it as its own scenario on the same helpline: someone falsely using your personal information to set up a self-managed super fund in your name, or changing an existing SMSF to reach your superannuation, is a call to 1800 467 033 on the same footing as a stolen tax file number.

Check with the fund itself, not only through myGov. Log in to each superannuation account directly and look at the contact details, the nominated bank account, any rollover requests in progress and any recent withdrawals. The ATO's advice to fraud victims is to check super accounts regularly for unusual transactions and to contact the fund if something does not look right — the fund, not the ATO, is the party that can stop a payment that has not yet left.

Be alert to the messages that arrive afterwards. A text or email telling you your myGov details have been changed, or that you have applied for early release of super when you have not, is a signal to treat as identity misuse rather than a system error — and a reason to phone the numbers on this page rather than reply. The same channel runs the other way: a message claiming your account is locked, with a link attached, is the classic myGov impersonation and is never legitimate.

On Medicare, read the claims history statement carefully before reporting anything, because a name you do not recognise is usually not fraud. The Department of Health, Disability and Ageing says so directly: consider whether you might have had a service such as an eye test, pathology or diagnostic imaging from someone other than your usual provider, and note that pathology is claimed by the practitioner who reports the result, not the person who collected the sample.

Where a claim genuinely was not yours, the reporting split matters and getting it wrong costs weeks. Suspected incorrect billing or claiming by a health provider — a doctor, pharmacist, dentist or allied health professional, or a practice or hospital — goes to the Department of Health, Disability and Ageing on its Provider Benefits Integrity Hotline, 1800 314 808. Suspected Medicare or Centrelink fraud by a member of the public, including a stolen Medicare card or details exposed in a breach, goes to Services Australia instead. The department publishes that division explicitly because reports keep arriving at the wrong door.

Finally, check the bank details each service holds rather than only looking for outgoing fraud. A benefit that should have reached you and did not is as much a symptom as a claim you did not make, and the account details recorded against your Medicare, Centrelink and ATO records are what an attacker changes first. Confirming all three point at an account you control is the closing move — worth repeating a week later, once the agencies have made their own corrections.

Report the cybercrime through ReportCyber on the Australian Cyber Security Centre's site. The report is routed to police and produces a reference number that banks, insurers, credit bodies and agencies routinely ask for before they will act, so getting it early removes a round of argument later. Report the scam itself separately to Scamwatch, run by the ACCC's National Anti-Scam Centre — it does not investigate individual cases or recover money, but reports are used to take scam websites down, and it will connect you with IDCARE if you are at risk of identity misuse.

Call IDCARE on 1800 595 160. It is Australia and New Zealand's national identity and cyber support service, free to individuals, and a case manager produces a written response plan for your specific exposure rather than a generic checklist. That matters because the correct order of steps differs depending on whether what leaked was a driver licence number, a myGov credential or a Medicare card. Services Australia, the ATO and the Attorney-General's Department all point to it, and nobody legitimate charges for identity recovery help.

If the compromise traces back to a data breach, the notification you receive is not just information. Services Australia is required under the Privacy Act 1988 to notify the Office of the Australian Information Commissioner and the affected individuals of a notifiable data breach, and it says a letter about potential unauthorised access or changes to a Centrelink record will reach you by post or in your myGov Inbox depending on your preference. If one arrives, treat it as an instruction to audit your record that day.

Then there is a document almost nobody knows exists. A Commonwealth Victims' Certificate is issued by a state or territory magistrate to a victim of Commonwealth identity crime under the Criminal Code. The Attorney-General's Department's own examples are this page's subject matter almost exactly: someone using your birth certificate to falsely claim a Centrelink payment in your name, or using your identification details to have your Medicare rebates redirected to their bank account. The certificate records your name and describes the circumstances; it does not identify the perpetrator.

Be clear about what it is and is not. No prosecution or conviction is required, and the magistrate need not decide that a particular person committed the offence — only that, on the balance of probabilities, identification information was dealt with in the relevant way and that a certificate may help you address the resulting problems. You apply with an application form and a Commonwealth statutory declaration, and present proof of identity. The department states the limits plainly: a certificate compels no organisation to do anything, will not automatically restore your credit rating or remove a fraudulent transaction, and is not admissible in legal proceedings.

Its real value is leverage with an agency, a bank or a credit body that has stopped moving. If a magistrate declines to issue one, you can still ask the organisation for help with whatever evidence you have gathered. And keep the log going — the ATO's advice to fraud victims is to keep records of every communication, transaction and piece of evidence, and that log is what a certificate application, a complaint to the Commonwealth Ombudsman or a dispute with your bank is built from.