Scam texts in Australia: how to spot fake myGov, ATO, toll and parcel messages

Scam texts work because they look like the messages we get every day: a toll notice, a note from myGov, a delivery update, a fraud check from the bank. The link is the trap — it leads to a convincing copy of a real website that asks for a payment, your card details or a login. The real organisations have published how they do and don't contact you, so most fakes can be caught in seconds.

The scam texts Australians see most

• Government look-alikes — Scamwatch says scammers use brands such as myGov, Services Australia, Centrelink and the Australian Taxation Office to gain your trust.
• Toll roads — messages claiming you didn't pay a road toll, with a link to pay it.
• Parcels — texts claiming to be from Australia Post or a courier about a delivery.
• Your bank — Scamwatch warns that scam texts can even appear in the same chain as genuine messages from your bank.

Text message scams reported to Scamwatch fell from 77,365 in 2024 to 29,058 in 2025, according to the ACCC — but phishing, which includes these messages, was still the most reported scam, with 65,361 reports.

What the genuine messages look like

• The ATO says it will never send an unsolicited SMS that contains a hyperlink. If you're unsure whether a message is really from the ATO, it says not to respond and to call 1800 008 540 to check.
• Services Australia says that if you get a text message from myGov with a link to click on, it's a scam.
• Since 1 July 2026, texts from businesses and organisations that haven't registered their sender ID can arrive from 'Unverified'. The ACMA says such a message may be a scam or may be from a real business — if in doubt, don't reply, don't click links, and don't give personal details or money.
• Australia Post asks you to be cautious of texts claiming to be from it that appear as 'Unverified' or come from unfamiliar numbers, and suggests its app's notifications for genuine tracking updates.
• The ACMA notes the sender ID rules don't cover messaging apps such as WhatsApp, iMessage and Facebook Messenger — so a message there proves nothing about who sent it.

How to check without tapping the link

1. Don't tap the link and don't reply.
2. Sign in to myGov, your bank or the organisation's app yourself — by typing the address or opening the app — and look for the same message or charge there.
3. For a parcel or toll notice, check on the company's own website or app using details you already have.
4. If you're still unsure, call the organisation on a number you already know is real — for the ATO, 1800 008 540.

How to report a scam text

• Report the scam to the National Anti-Scam Centre's Scamwatch at scamwatch.gov.au.
• myGov, Services Australia, Centrelink, Medicare or Child Support scams: email the details to [email protected].
• ATO scams: take a screenshot and email it to [email protected].
• Australia Post scams: report them to [email protected].
• Then delete the message.

If you've already tapped, paid or shared details

1. Contact your bank or card provider straight away and tell them what you shared.
2. Change the password on any account you entered on the fake site — and anywhere else you use the same password — and turn on two-step verification.
3. If identity details were taken, contact IDCARE, the national identity and cyber support service, and consider asking Equifax, Experian and illion for a free ban on your credit report.
4. If money was lost or your device was accessed, report it to ASD's ACSC at cyber.gov.au or on 1300 CYBER1 (1300 292 371) as well as to Scamwatch.

Can a security app help?

Partly. ASD's ACSC advice is to make sure your antivirus software is turned on and up to date — Windows includes Microsoft Defender and Macs include XProtect. On phones, several security suites now add scam-text and link checking on top of what the phone does itself. It's a useful safety net, especially for family members who are less confident online, but no app replaces the habit of checking through the official app or website before you pay anything.

The message isn't the scam. The link is. Go to the real website yourself, every time.