What to do if your tax refund is stolen

The most common first signal is a notice of assessment, or a myGov message pointing to one, for an income year you have not lodged. Read it properly rather than assuming it is a system error. A fabricated return will usually show income from employers you have never worked for, deductions you did not claim, and a refund figure that bears no relationship to the tax withheld from your actual pay. The assessment is a legal document; until it is amended, the ATO's records say that is your position for the year.

The second signal shows up before lodgment rather than after it. When you open your own return, the pre-filled income statement data does not match your payslips or your employer's Single Touch Payroll reporting, or an employer appears that you have never had. Pre-fill is assembled from what third parties report to the ATO, so a mismatch is not automatically fraud — but it is worth resolving before you lodge on top of it rather than afterwards.

The third is the one this page is named for. ATO online services shows the return status as Issued with a dollar amount, meaning processing finished and an assessment went out, and the refund never arrived in your account. The ATO's guidance is unambiguous about the first thing to check: sign in and look at which bank account the refund was actually sent to. That single field determines which recovery path is open to you, and it is visible without phoning anyone.

The fourth is a change you did not make. New contact details, a new nominated financial institution account, a new authorised contact, or a tax agent appearing against your record that you never engaged. The ATO lists fraudulent updates to your record, including changed bank account details, as one of the four situations that go straight to 1800 467 033. Do not treat a changed bank account as an administrative glitch to sort out later.

Be careful about the opposite mistake. Not every missing or delayed refund is theft, and several published processing statuses look alarming and are not: In progress — Balancing account means the ATO is reconciling your result with other Commonwealth agencies and may transfer funds where you owe them, and In progress — Under review means a manual check is running. Returns are also delayed because you lodged twice, because a debt previously placed on hold has been re-raised, or because part of the refund has gone to Services Australia or Child Support. Those are legitimate outcomes and you will be notified.

The tell is a lodgment or a change you did not make. A slow return you lodged yourself is a processing question for the individuals line on 13 28 61; a return you did not lodge, or a bank account you did not nominate, is an identity question for 1800 467 033. Getting that fork right saves days.

Phone 1800 467 033 between 8 am and 6 pm AEST, Monday to Friday. The ATO describes this as the Client Identity Support Centre and says plainly what it does: it helps you establish your tax identity, and when you call, staff will discuss which identification documents you need to provide. That is a different conversation from the one you get on the general individuals line, where the officer is not equipped to run an identity re-establishment.

Have the material in front of you before you dial, because the identity check is the whole point of the call and a second call to fetch documents costs you another wait. Useful things to hold: your tax file number if you can find it, the notice of assessment for the disputed year, any income statements or payslips that contradict it, bank statements for the account the refund should have gone to, the dates and times you noticed anything change, and the reference number of any police report you have already made.

If you cannot find your TFN, the ATO lists where it normally appears — on a notice of assessment, on letters such as a statement of account, on a payment summary or income statement, and on a superannuation account statement. You do not need the number in hand to call, but it shortens the identity check.

Do not use a phone number, link or email address that came to you in the message that alarmed you. The ATO runs a verification line on 1800 008 540 for exactly this: if you are unsure a call, SMS, email or letter is genuinely from the ATO, do not respond and phone that number instead. The ATO states it will never send an unsolicited message containing a hyperlink or QR code, never ask for your TFN, bank details or myGov login by email or SMS, and never ask you to pay a fee to receive your refund.

A tax file number is not reissued the way a card number is. The ATO's remedy for a compromised TFN is not a new number but a set of protective measures applied to your record — monitoring before automatic processing, and additional checks on lodgments and claims. Those measures stay on your file until the ATO determines there is no further risk. That is why the phone call matters more than it looks: it is the only way those measures get switched on.

Run IDCARE in parallel rather than afterwards. The ATO's own identity-theft page recommends contacting IDCARE on 1800 595 160 where other personal information has been compromised, and describes it as free, confidential support for victims of identity theft. The ATO fixes the tax record; IDCARE deals with the credit file, the licence, the passport and the rest of the spread, and builds you a written response plan.

The same number covers you if you hold other people's information. Employers, bookkeepers and businesses holding tax or superannuation data including TFNs for clients or employees are directed to the same Client Identity Support Centre where they know or suspect a breach.

This is the section that decides how much money comes back, and it turns on a distinction the ATO publishes but does not advertise. Its missing-refunds guidance divides electronic funds transfer refunds that cannot be found into three categories, and the recovery path is different for each. Before anything else, sign in to ATO online services through myGov and look at the bank account the refund was sent to.

If the refund went to an account officially closed with the bank, the money bounces. The ATO says the payment is returned to it by the Reserve Bank of Australia, which can take up to 10 days, and you then update your bank details so it can be re-issued. If no updated details are supplied it re-issues by cheque — and it notes that since January 2025 it has held some cheque refunds for up to 90 days while asking for bank details. Supplying an account is the difference between days and months.

The hard category is a refund paid to what the ATO calls a known bank account: an old account of yours that is still active but unused, an account belonging to a related party such as a spouse or a business, or the trust account of a registered tax agent. The ATO's position is blunt — in most circumstances it cannot retrieve the funds, because the refund was paid into the account as nominated by you, and recovery is a civil matter between you and the account holder. You have to approach the owner of the account yourself.

The third category is where refund fraud usually sits. Where the refund was paid to an incorrect bank account, or to an unrelated third-party bank account, the ATO says to contact it and it will attempt to recover the refund on your behalf. It also warns that identifying, contacting and retrieving funds from third parties can take over 28 days. The same page tells you to contact the ATO if you believe your account has been misused.

So the practical work of the first phone call is to get your case recorded in the third category rather than the second. If a fraudster changed the financial institution details held against your record and the ATO then paid to that account, the account was not nominated by you in any meaningful sense — but the default reading of the data is that a nominated account is a nominated account. Say explicitly that the details were changed without your authority, give the date you last knew the correct account was recorded, and ask for that to be noted on the file.

Tell your bank as well, on the same day, if the destination account was one of yours that someone else now controls. Banks have their own fraud and recall processes and their own dispute timeframes, and the outcome there is separate from anything the ATO does. Where a payment has been pushed through a bank account rather than the tax system, the recovery levers are the ones set out in the guide to getting your money back after a scam payment, not the ones on this page.

Correcting the record is a separate job from recovering the money, and it runs on statutory clocks. When a return is lodged, the ATO issues an original assessment showing your tax liability for that year. Putting a fabricated assessment right means replacing it with an amended assessment that reflects your actual position — the income you really earned, the deductions you really had, and the credits actually withheld from your pay.

For most individuals the amendment period is two years, starting from the day after the notice of assessment is sent to you. The ATO gives a worked example: a myGov email on 3 November 2026 telling you the notice is available starts the period on 4 November 2026, giving you until 4 November 2028. Sole traders had two years for 2023–24 and earlier income years, and have four years from 2024–25 onwards. You can lodge more than one amendment request within a period of review.

The exception that matters here is written into the same page. The ATO says it generally cannot amend an assessment more than two years after it was issued unless you ask it to — but that it may amend outside the time limit in exceptional circumstances, such as when evasion or fraud has occurred. A fraudulent lodgment is precisely that circumstance, so an old year is not automatically beyond repair. Say the word fraud in the request and support it.

If you are out of time to amend, the route is an objection rather than an amendment. For income tax assessments the objection period is generally two years for most individuals and small businesses; for an amended assessment it is the later of 60 days from the date you were given the amended assessment or the remaining time on the original assessment. Objections can attract an extension of time in some circumstances, which amendments cannot — that asymmetry is why the ATO tells people out of time to object instead. There is no fee to lodge an objection.

There is a separate and easily missed window for refunds the ATO holds back. Where you are objecting to a decision to retain a refund, the ATO says the objection period starts 90 days after you lodge your tax return and ends when you receive an amended assessment, and that if the ATO asks you for additional information it extends the period by the time you take to supply it. If your refund has been stopped rather than stolen, that is the clock you are on.

Expect the repair to be slow. The ATO says most online returns process within about two weeks, but manual processing generally takes up to 30 calendar days and cannot be sped up by phoning. It also says that where you are experiencing financial difficulties or serious hardship you may be eligible for priority processing, on evidence of that hardship. If the missing refund is the reason you cannot pay rent, ask for priority processing by name. Keep one file with every reference number, officer name and date, because identity cases move between teams over months.

The cruellest version of this is not a missing refund but a bill. A fabricated return produces an inflated refund paid to someone else; when the ATO reverses it and issues a corrected assessment, the amount wrongly refunded becomes an amount owing on your account. You are then asked to repay money you never received, with interest running on it.

Two charges apply. General interest charge applies to unpaid tax debts and is calculated daily, and the ATO says plainly it will keep accruing while the debt is overdue. Shortfall interest charge applies to shortfall amounts where an assessment has been amended upwards. The ATO also notes that GIC or SIC incurred on or after 1 July 2025 cannot be claimed as a tax deduction, which makes remission worth more than it used to be.

Ask for remission, and argue it properly. The ATO says a remission request should set out the specific event or circumstance that caused the delayed payment, how that prevented you paying by the due date, what steps you took to reduce its effects, and any supporting evidence. It then weighs whether you were responsible for the delay or it was outside your control, whether remission is fair and reasonable, and your prior compliance and payment history. It says remission is considered more favourably where the late payment is out of pattern with several years of on-time behaviour.

Its published list of acceptable evidence includes police reports, court orders and outcomes of proceedings, letters from financial institutions and tax professionals, medical certificates and financial statements. That is why the ReportCyber reference number is worth getting early. Individuals can request a GIC, SIC or failure-to-lodge remission by phone or mail, and requests over $2,500 are escalated to a dedicated team, so you will not get an answer on the call.

Know your review rights before assuming a refusal is the end. On a decision not to remit GIC, the ATO says you cannot lodge an objection and the Administrative Review Tribunal cannot review it — you may submit a fresh request if you left out a key piece of information or a specific error was made, and otherwise your only avenue is judicial review in the Federal Court. On SIC the position is better: you can object where the amount still payable is more than 20 per cent of the shortfall, and request a review where it is 20 per cent or less, with the ART available after an objection decision.

If the debt is real and remains after remission, deal with the payment side separately. The ATO publishes payment plans, deferrals of compulsory study and training loan repayments in serious hardship, and a compromise of tax debt process, and its lodge and pay line on 13 11 42 handles new and existing debts, payment plans, overdue lodgments, penalties and interest. Do not let a disputed debt sit unmanaged while the interest compounds; a payment plan and a remission request can run at the same time.

There is also help that is designed for exactly this situation. The ATO's Emergency Support Infoline on 1800 806 218 handles crisis and hardship contacts, and it runs a free service called Dispute Assist for vulnerable individuals and small businesses going through the objection process. Both are worth asking for by name rather than waiting to be offered them.

Once the ATO accepts that your record has been compromised, it applies protective measures — and they change how you interact with the tax system, sometimes for years. The ATO groups them into three: additional proof of identity, additional monitoring processes, and additional security measures. It is worth knowing what each does before you meet it, because the first encounter usually happens at the worst moment, which is next July.

Additional proof of identity means the ATO may ask for more before it will discuss your tax affairs at all, and — this is the one that surprises people — it says that if you use a tax professional, it may require you to contact it directly instead. A record with an identity flag can therefore be one your accountant cannot simply ring up about on your behalf.

Additional monitoring means the ATO watches the record and may contact you or your registered tax professional to confirm that activity is legitimate before it proceeds. It says outright that this may delay the processing of tax returns and other forms. That is the trade you have accepted: fewer fraudulent lodgments slipping through, and a slower refund for you.

The additional security measures are the most disruptive. The ATO says you may not have ongoing access to its online channels or myGov unless you hold a Strong Digital ID such as myID; pre-fill data may not be available; extra checks may delay returns and other forms; business activity statements may stop issuing automatically, so you or your agent must contact the ATO before each lodgment; and your Digital ID may be suspended while a suspected compromise of the online environment is investigated.

Strong myID is the key that reopens the door without a phone call each time. The ATO states that if your identity has been compromised and safeguards have been applied, signing in with a Strong myID lets you unlock access to ATO online services without phoning every time — and that to keep that access you must use the Strong myID each time you sign in. Setting it up requires verifying your identity documents and completing a one-off face verification check in the app.

Plan your next return around the flags rather than being caught by them. If pre-fill may not be available, keep your own payment summaries, income statements, bank interest records, private health statements and dividend statements as they arrive, because you may have to key them in. If the online channel is closed to you, the fallbacks are a registered tax agent or a paper return — and the ATO notes that most paper refunds issue within 50 business days, which is a different planning horizon from the two weeks an online return usually takes.

The measures are not permanent by design. The ATO says they remain on your file until it determines there is no further risk — a judgement it makes, not a date it publishes. If the friction is still there two years on, it is reasonable to ask on 1800 467 033 whether the flags are still needed.

A large share of stolen refunds in Australia are not stolen by strangers at all. The Tax Practitioners Board — the regulator that registers and disciplines tax and BAS agents — states that it is investigating several cases involving unregistered preparers posing as legitimate registered tax practitioners who lodge tax returns on behalf of their clients, often by accessing their clients' myGov accounts and lodging through myTax. If you handed over a myGov password to someone who promised a bigger refund, that is the scenario.

Two lines from the TPB are worth memorising, because they turn a vague suspicion into a definite answer. First, myTax is for a taxpayer to lodge their own return and is not an approved lodgment channel for registered tax practitioners. Second, a registered tax practitioner does not require access to a client's myGov account to act on their behalf. Anyone who asks for your myGov login to do your tax is, by definition, not doing it the way a registered agent does.

Check the person against the TPB Register before you engage anyone, and check them again now if you already have. Only registered practitioners may provide tax agent services for a fee or other reward, and the TPB publishes the register precisely so a consumer can verify a claim. The TPB also invites complaints about anyone advertising or providing tax agent services for a fee while unregistered.

If the person was registered, the Code of Professional Conduct gives you something concrete to point at. The TPB says the Code requires a registered agent to account to you for any money or other property received on your behalf and held on trust — and it specifies that this includes tax refunds and other payments received from the ATO. A refund that landed in an agent's trust account and did not come out again is a Code matter, not merely a billing dispute.

Registration also decides who wears the penalty. Under the safe harbour provisions administered by the ATO, a taxpayer who used a registered tax or BAS agent may not be liable for certain administrative penalties where the agent failed to lodge on time or made a false or misleading statement that produced a shortfall. The TPB is explicit that you get no safe harbour protection at all if you engaged an unregistered preparer, and that an unregistered preparer may carry no professional indemnity insurance to compensate you for the loss.

The TPB also runs a Client Support Program, under which it contacts the clients of high-risk practitioners who have been suspended or had their registration terminated, tells them what has happened, and points them toward a replacement agent from the register. If you have received that contact out of the blue, it is genuine and it is worth acting on rather than filing.

None of this replaces the ATO call. A crooked preparer creates both a tax problem and an identity problem, and the ATO treats unauthorised access to your myGov account and linked ATO online services as a 1800 467 033 matter regardless of who did it or why you let them in.

Make a police report through ReportCyber, run by the Australian Signals Directorate's Australian Cyber Security Centre. The ATO's own guidance says you must report all tax-related security issues to it and that you can also report other cybercrime through the Cyber Issue Reporting System and identity theft and fraud to your state or territory police. The practical value is the reference number, which the ATO has already listed among the evidence it will consider in a remission request.

Report the scam element to Scamwatch as well. Run by the National Anti-Scam Centre within the ACCC, it states what a report is for: with your consent, working with organisations to remove scam websites, ads and contact details, and warning the community. It also says it can connect you with IDCARE where you are at risk of identity misuse. It will not recover your refund and does not claim to.

Then apply for a Commonwealth Victims' Certificate. The Attorney-General's Department publishes the application form and explains it: if you are a victim of Commonwealth identity crime and meet the criteria, you apply to a magistrate in your state or territory, and the certificate is a further piece of information you can present to a government agency, financial institution or credit agency to support your claim that you were a victim, helping you rectify your personal or business affairs with them. Refund fraud committed against the ATO is Commonwealth identity crime.

Deal with the credit file in parallel, because tax fraud and credit fraud usually come from the same stolen bundle of documents. Australian privacy law gives you a free copy of your credit report and the right to have inaccurate information corrected, and a credit ban stops new credit being opened in your name. The full sequence is set out on our page on what to do if your identity is stolen, and it should run alongside the tax repair, not after it.

If the ATO's handling of your case goes wrong, complain to the ATO first and get the reference number. The Tax Ombudsman — the office of the Inspector-General of Taxation — will only investigate once the matter has been raised with the ATO and not resolved, and it asks for your formal ATO complaint reference number, which it says looks like 1-XXXXXXXXXXX. Its number is 1300 448 829 and it publishes a checklist of what to have ready: the facts and dates, the actions that caused concern, the impact on you, where things stand and the outcome you want.

Two things not to do while the repair runs. Do not lodge the return again if an amendment or review is already in progress — the ATO lists re-lodging, and amending before the original has finished processing, among the specific reasons a return is delayed. And do not hand your myGov credentials to anyone, including someone who says they are helping you fix the fraud.