Exclusive: Cybercriminals unleash fake Centrelink scam on vulnerable Australians

ATO spotlights international partnerships at tax crime summit 

An international tax crime summit hosted by the ATO has delved into how geopolitical shifts, AI and emerging financial technologies are reshaping the threat environment.

An international tax crime summit hosted by the ATO has delved into how geopolitical shifts, AI and emerging financial technologies are reshaping the threat environment.

Last week (10-12 November), the ATO hosted the Global Financial Institutions Partnership (GFIP) summit, an event seeking to strengthen international partnerships against tax evasion, financial crime and money laundering. 

ATO deputy commissioner John Ford underscored the importance of international partnerships in addressing financial crime and strengthening the tax system.

“The ATO, along with our partner agencies, are combating tax evasion and will hold anyone giving themselves an unfair advantage to account,” Ford said.

“The sharing of capabilities between government agencies and private sector groups puts us in the best possible position in detecting these behaviours early and acting swiftly.”

The summit was an initiative of the Joint Chiefs of Global Tax Enforcement (J5), a partnership between tax authorities in Australia, Canada, the Netherlands, the UK and the US seeking to strengthen global financial crime detection and prevention.

Representatives from international revenue agencies, financial institutions and law enforcement were in attendance. The summit focused on how banks, fintech companies, regulators and law enforcement could work together to close compliance gaps.

Participants discussed the evolving threat environment, including how geopolitical shifts, AI and emerging financial technologies were reshaping the tax crime landscape. 

The summit also delved into how complex networks of service providers and opaque relationships could be used to hide financial flows and make it harder to detect illicit activity.

Sessions covered issues including identity crime, cyber threats and the cash compensation model, where businesses use cash from criminal sources to pay employees or cover expenses.

While tax evasion was a global issue, the ATO urged community members to come forward to their confidential tip-off line if they saw evidence of tax crime in their local community.

Since July 2019, the Tax Office has received over 300,000 community tip-offs, mostly related to shadow economy activity, including demands for cash payment or incorrectly claimed business expenses.

The ATO said that tip-offs levelled the playing field and prevented law-abiding businesses from being disadvantaged due to their honesty. Tax evasion could bring on significant penalties and possible criminal sanctions, it cautioned.

“People evading their tax and super obligations are directly harming honest businesses and putting an increased burden on other Australians. There really is no excuse,” ATO assistant commissioner Tony Goding said.

“It’s unfair competition and it’s illegal. And when you’re caught, you don’t just have to cough up the tax. You’ll also face significant penalties plus interest on unpaid taxes and possibly even criminal sanctions.”

 Cybercriminals unleash fake Centrelink scam on vulnerable Australians

More than 270,000 malicious emails impersonating Services Australia and Centrelink have flooded Australian inboxes in one of the nation’s largest phishing campaigns in years, with the sophisticated attacks specifically targeting the country’s most vulnerable citizens.

The massive campaign, uncovered by human risk management platform Mimecast, has been bombarding Australians with fake government emails averaging 70,000 messages per month over the past four months, with attackers using artificial intelligence to create near-perfect clones of legitimate government communications.

The emails mimic government correspondence about Medicare, JobSeeker payments, Superannuation, and Family Tax Benefits with alarming accuracy.

This particular attack is a significant cause for concern,” Mimecast senior director Garrett O’Hara told this masthead. “The targeting of the scam is broad and non-specific, so it’s impacting everyday Aussies trying to access essential government services, as well as targeting a wide range of organisations including schools, hospitals, law firms, corporations, and even government agencies themselves.”

The criminal operation, tracked by Mimecast as MCTO3001, is exploiting trusted email platforms including SendGrid, Mailgun, and Microsoft Office 365 to disguise their origins and evade spam filters.

The scammers are using advanced evasion techniques to hide their infrastructure behind legitimate services to make blocking attempts extremely difficult. Getty Images

These aren’t the clumsy scams of years past,” O’Hara said. “Attackers are using legitimate systems and leveraging detailed knowledge of Australian benefit systems including superannuation, Medicare, JobSeeker payments, and Family Tax Benefits, to make their emails look authentic. They’re exploiting the trust that Australian citizens have in the federal government to deliver their attacks.”

The scammers are using advanced evasion techniques including “reverse tunnelling” – hiding their infrastructure behind legitimate services to make blocking attempts extremely difficult. Some attackers have even compromised real email accounts or hosted fake government login pages on legitimate web services.

“Once a victim clicks a link and enters their details, attackers can gain access to personal or business accounts, leading to data theft, malware installation, or even full-blown ransomware infections,” O’Hara said.

The scale and sophistication of the attacks has raised alarm about AI’s role in cybercrime, and growing evidence that state-backed hackers are exploiting AI systems for cyberattacks. Anthropic, the company behind the Claude AI model, announced on Thursday that Chinese state-backed hackers used Claude to automate roughly 30 attacks on corporations and governments during a September campaign…

‘Quite oppressive’: Dispute erupts over ATO personnel security crackdown

ATO workers are challenging new proposals on travel and social media scrutiny, arguing the changes go well beyond what the PSPF requires

A proposed tightening of personnel security at the Australian Taxation Office has already met strong resistance. The plan, which includes a 28-day travel notice and increased social media scrutiny, has encountered industrial issues before approval.

The Taxation Officers’ Branch of the Australian Services Union has lodged a dispute with the Fair Work Commission over the attempted changes, telling members it is concerned that “changes to the ATO Security CEI [chief executive instructions] and Security Guidelines…appear quite oppressive” and contain “tricky language” that erroneously suggest that the alleged crackdown is “required by the 2025 update to the Protective Security Policy Framework (PSPF).”

The PSPF is reviewed annually to ensure it reflects the current threat environment. In 2025, there are three changes that have been updated in the Security CEI,” the ASU told members in communications.  

The alleged three key changes are the major bones of contention that the ASU has taken to the industrial umpire during the legally required consultation period.

The first is that “all [ATO] employees must complete an ongoing employment suitability check at least every three years, as appropriate for your role”, the ASU says. 

The second is that security clearance holders at the ATO “must notify personnel security about any upcoming personal overseas travel at least 28 days prior to travelling (or as soon as practicable in the case of emergency travel), and participate in an overseas travel briefing with personnel security when required.” 

And the third is that the “ATO says in the proposed amendments to its security guidelines that if its three-yearly checks reveal you have not complied with every single expectation of you, such as its search of your social media, then you may be charged with a breach of the code of conduct or have your employment terminated (p. 14/17).” The ASU is disputing the employers’ interpretation of the new PSPF requirements.

“There is no requirement that any APS employee complete an employment suitability check every three years. Nor does it require any APS employee to notify any upcoming personal overseas travel, let alone at least 28 days before,” the ASU told members.

“The ATO undertakes integrity checks prior to deciding whether to employ you. The ATO does additional integrity checks if you apply for an APS 6 role or above, or any other position that is identified as higher risk.

“The ATO proposal means everyone will have to go through an integrity check, just like the one imposed on all new ATO employees, at least every three years. The ATO says this means you will have to provide any documentation it requires for this check.”

A practical concern for ATO employees is that any imposition of a new 28-day notice means they may well lose access to last-minute or short-discounted airfare inventory, resulting in economic detriment when booking airfares.

Feedback from ASU members to the union said that “the 28-day notification period for personal overseas travel seems like a massive overreach. It basically precludes security clearance holders from booking last-minute overseas holidays (which would otherwise be permissible by the ATO), unless there is an emergency.”

“It could also create confusion and disruption for those on holiday who would like to change their itinerary.”

An ATO staffer told the ASU that there was “a lot of uncertainty. Would they be forced to hand over all their social media handles? What if the staff member has old accounts that have not been used for many years? What are the penalties if they forgot a particular account in disclosures?”

Other members objected to the ostensive duplication of intrusive vetting checks.

“A personal irritant was that I was required to report this information twice. Once to the vetting agency and then the same information to the ATO. Crazy this duplication of effort, you would almost think they should be talking to one another about these issues, and either the ATO trusts the vetting agency call or it doesn’t,” another comment said.

Another ASU member said: “As to access to my social media accounts, that is something I will not do. I have no issue with them searching my public profile (hope they have fun watching a lot of cat videos and memes), but access to my personal accounts is just that personal, and nothing to do with work.”

Before getting the ATO response to the ASU, it’s worth pointing to a few primary and secondary sources. The first is the PSPF main page, which references the 2025 release unleashed in July.

It, helpfully or lazily, comes with a spreadsheet detailing all of the requirements. All 210 of them. Read it and weep.

In response to the ASU, a spokesperson told The Mandarin that the “Protective Security Policy Framework (PSPF) is a set of Australian government policies designed to help APS agencies protect people, information and assets. The PSPF is reviewed annually to ensure it reflects the current environment.”

“In response to changes to the PSPF, the ATO has reviewed its Security CEI and guidelines and is currently consulting with employees on potential changes. Consultation is a standard process for all updates to corporate policies, and all feedback received will be appropriately considered,” the spokesperson said.

“The ATO is in the process of providing further information to all staff to assist them in understanding the proposed changes.”

‘Dark corners’: Business owner reveals torment of tax office’s seven-year pursuit