Scamwatch logged 340 reports of stolen myGov credentials in the three weeks to Tuesday, after criminals blasted Australians with SMS messages claiming a Centrelink cost-of-living bonus required an immediate sign-in.
How the lure works
The messages use shortened links that mimic the myGov domain, then present a pixel-perfect copy of the federal sign-in page hosted on compromised WordPress sites, according to an alert the Australian Signals Directorate issued Monday. Victims who enter passwords and multi-factor codes give attackers access to tax, health and welfare records in a single session.
Services Australia said it is not running any bonus program tied to SMS links, and that legitimate myGov prompts never ask users to click through from text messages. Despite the warnings, report volumes doubled compared with the previous three-week window, with Western Sydney and outer Melbourne postcodes overrepresented in Scamwatch’s breakdown.
Money and identity at stake
The Australian Competition and Consumer Commission, which operates Scamwatch, estimates average losses of $4,800 when criminals pair myGov access with bank transfers, though many reports involve identity theft without immediate financial loss. Riley Paterson’s desk has seen similar kits targeting ATO refund season; the Centrelink hook exploits anxiety over energy rebates ahead of summer.
340 credential-theft reports in three weeksBanks told ASD they are flagging payees named like “Services Australia refund” when customers attempt large transfers within an hour of a reported phishing click. Commonwealth Bank and NAB said they reversed 62 payments last week after joint fraud desk calls.
What to do
ASD recommends changing myGov passwords from a clean device, revoking unknown passkeys, and calling Services Australia on its published number rather than replying to texts. The agency is working with telcos to block newly registered domains within hours, but criminals rotate faster than automated takedowns.
Federal police have not announced arrests linked to this specific kit; investigators said attribution is complicated because hosting bounces through compromised small businesses. For households, the practical defence remains boring: delete the SMS and log in only via a saved bookmark.
Telco and platform response
Optus and Telstra said they are participating in a new SMS sender registry trial that flags messages claiming to be from government agencies unless they originate from approved short codes. Meta removed more than 400 ads linking to the same phishing domains after ASD shared indicators of compromise.
Victims told Scamwatch they clicked because the bonus amount matched figures discussed in genuine budget coverage, blurring the line between news and fraud. Services Australia plans a radio campaign in 12 languages reminding listeners that myGov will never request passwords by text.