myGov Scam: How to Spot Fake myGov Texts, Emails and Login Pages

A myGov scam is a fake text, email, call or website that pretends to be myGov, the Australian Government’s online portal for services like Medicare, Centrelink and the ATO, so criminals can steal your sign-in details, identity documents or money. The safest rule is simple: don’t sign in through a link in a message. Open the myGov app or type my.gov.au into your browser yourself, sign in, and check your myGov Inbox, where genuine messages appear. If you’ve already entered your details on a fake page, change your password and sign-in options straight away.

These scams are convincing because myGov really does send notifications, and most of us use it only occasionally, so we don’t know exactly what a real message looks like. Being fooled by one isn’t a sign of carelessness. This guide explains the common versions, how to tell real from fake, and what to do now.

Why scammers target myGov

A myGov account links to some of the most valuable information you have: your tax records, Medicare details, Centrelink payments, your bank account for refunds and your contact details. If a scammer gets in, they can change the bank account a payment goes to, see personal details useful for identity theft, or lodge claims in your name.

That’s why myGov phishing doesn’t usually ask for money directly. It asks you to sign in. The login is the prize.

Common versions of the myGov scam

Version	How it usually looks
Fake myGov text	An SMS says your account has been suspended, your details need updating, or a new message is waiting, with a link to “sign in”.
Refund or payment email	An email promises a tax refund, a Medicare rebate or a cost-of-living payment and links to a fake myGov login page.
Lookalike login site	A copy of the myGov sign-in page, reached through a link or a search ad, that captures your email, password and one-time code.
Fake security alert	A message claims someone has signed in to your account from overseas and asks you to confirm or secure it through a link.
Phone call	A caller says they’re from myGov, Services Australia or the ATO and asks you to read out a code sent to your phone.
Fake help on social media	An account using government branding offers to fix a problem with your claim and asks for your login or ID documents.

Many of these overlap with tax-themed scams. Our guide to the ATO scam covers fake tax debt and refund contact in more detail.

How to tell if a myGov message is genuine

myGov publishes its own guidance on how to spot genuine messages, and it’s worth reading on the official website because details can change. In general terms, it describes a few consistent points:

• Genuine messages point you to your inbox, not to a link. myGov may text or email to tell you a new message is waiting, but you read it by signing in yourself.
• It doesn’t ask you to sign in through a link in a text or email. A message that does is the clearest red flag.
• It doesn’t ask for your password or sign-in code by phone, text or email.
• It doesn’t ask you to pay to receive a refund or payment.

The practical test works every time: close the message, open the myGov app or type the address yourself, sign in and look. If there’s nothing in your inbox that matches, the message was fake.

Warning signs of a myGov scam

• A link in a text or email asking you to sign in, verify or update details.
• Urgency: your account will be locked, your payment cancelled or your refund lost unless you act today.
• A web address that isn’t my.gov.au, or that adds extra words, hyphens or an odd ending.
• A refund or payment you weren’t expecting.
• A request for your sign-in code over the phone. Codes are for you to type, never to read out.
• A request for photos of your driver’s licence, passport or Medicare card outside the official portal.
• Messages in the same thread as real ones. Scammers can sometimes make texts appear alongside genuine messages, so the thread alone proves nothing. Our guide to smishing explains how.

What to do right now if you entered your details

1. Stop. Close the page and don’t enter anything else.
2. Sign in to myGov yourself through the app or by typing the address, and change your password straight away.
3. Check your sign-in options. Remove any phone number, email or device you don’t recognize, and switch to the strongest option available to you, such as a passkey, if you haven’t already.
4. Check linked services and details. Look at your contact details and the bank account recorded for payments and refunds in each linked service, such as the ATO, Medicare and Centrelink. Look for changes you didn’t make.
5. Contact Services Australia using details on its official website if you think someone has accessed your account. It explains how to report myGov scams and suspected misuse.
6. If you shared banking details, call your bank using the number on your card or in its official app.
7. If you shared ID documents, contact IDCARE, the not-for-profit identity and cyber support service for Australia and New Zealand, for a plan to protect your identity.
8. Save evidence: screenshots, the sender’s number or email, the fake web address and the time you entered your details.

Where to report a myGov scam

• myGov and Services Australia: the official website explains how to report scam messages and suspected account misuse. Use those instructions, not contact details from the message.
• Scamwatch: report the scam to Scamwatch, run by the National Anti-Scam Centre. Our guide on how to report a scam to Scamwatch walks through it.
• ReportCyber: if you lost money or someone accessed your accounts, report it through ReportCyber at cyber.gov.au, the Australian Government’s cybercrime reporting service.
• Your bank, if any banking details were shared or money was taken.
• The platform, for fake social media accounts or search ads.

For reporting routes in other countries, and general steps after any scam, see our guide on how to report a scammer.

Can you get money back?

myGov scams usually aim for access rather than a payment, so the loss often comes later: a refund redirected to a scammer’s account, or a claim lodged in your name. Report it quickly so the agencies involved can check your records and, where possible, stop payments before they’re made.

If you paid money or shared card details, contact your bank straight away. Card payments may be disputable through a chargeback. Bank transfers can sometimes be recalled if you act fast, but it isn’t assured. If you’re unhappy with your bank’s response, complain to the bank first, then to the Australian Financial Complaints Authority (AFCA), which is free.

Anyone who contacts you afterwards offering to recover your money for a fee is likely running a second scam. Our guide to recovery scams explains what to look for.

A worked example

This is an illustrative scenario, not a real case. Helen, a retired teacher in Brisbane, gets a text saying her myGov account has been “restricted due to unusual activity” and that she must verify her identity within 24 hours. The link looks official. She taps it and enters her email and password, then pauses when the page asks for her Medicare card number and a photo of her driver’s licence.

1. She closes the page without uploading anything.
2. She opens the myGov app she already has on her phone and signs in. There’s no restriction and no new message.
3. She changes her password, checks her sign-in options and switches to a passkey.
4. She checks the bank details linked to her ATO and Medicare records. Nothing has changed.
5. She reports the text to Scamwatch and follows the myGov website’s instructions for reporting a scam.

Helen acted within minutes and changed her password before anything was altered. Had she uploaded her licence, contacting IDCARE and the licence issuer would have been her next steps.

How to protect your myGov account

• Use the strongest sign-in option available to you, such as a passkey or the myGov app, rather than codes by text alone.
• Treat your myGov Inbox as the source of truth. Sign in to check any message that claims to come from a government service.
• Never share your password or codes, including with someone helping you on the phone.
• Use a unique password for myGov and for the email account linked to it.
• Be extra careful around tax time and during announced government payments, when these messages tend to increase.
• Talk to older relatives and people new to Australia, who are often targeted with messages about payments and visas.

Scammers also impersonate other Australian brands with the same tactics. Our guides to the Telstra scam and the Australia Post scam cover two of the most common.

Common mistakes to avoid

• Signing in from a link “because it looked right”. Fake pages copy the real design exactly.
• Searching for myGov and clicking the first result. It may be an ad for a fake site.
• Only changing your password. Also check sign-in options, contact details and linked bank accounts.
• Deleting the message before reporting it. Screenshot it first.
• Feeling too embarrassed to report. Reports help authorities warn others. If you’re stressed, our help resources list support services.

If your identity has been misused and false information is appearing online, our personal reputation management team can help you understand what’s showing up and what can be corrected.

Frequently asked questions

Does myGov send text messages with links?

myGov may send texts and emails to tell you a message is waiting, but it describes on its official website how to spot genuine messages, and it doesn’t ask you to sign in through a link. Treat any message with a sign-in link as a scam and check your inbox by signing in yourself.

What should I do if I entered my myGov details on a fake site?

Sign in yourself and change your password immediately, review your sign-in options and contact details, check the bank accounts linked to your services, and report it to Services Australia through its official website and to Scamwatch.

How do I check if a myGov message is real?

Close the message, open the myGov app or type my.gov.au yourself, sign in and look at your inbox. If there’s nothing matching the message, it was fake.

Where do I report a myGov scam?

Follow the reporting instructions on the official myGov or Services Australia website, report to Scamwatch, and use ReportCyber if you lost money or someone accessed your accounts.

Can someone steal my identity through myGov?

Yes, if they get your sign-in details, they may see personal information and change details in linked services. Secure the account quickly and contact IDCARE for identity support if you shared documents.