IDCARE recorded a sharp jump in reports of forged superannuation rollover forms that mimic Australian Taxation Office letterhead, a scam pattern designed to harvest myGov and fund portal passwords from members rushing year-end contributions.
The national identity and cyber support service said case managers opened more than three hundred files tied to the PDF lures in October, triple the September count, with losses on individual accounts ranging from four thousand to twenty-eight thousand dollars before funds froze outbound rollovers. IDCARE attributed the surge to timing: members chasing contribution caps often click quickly on anything that looks like compliance paperwork.
How the lure works
Victims receive emails or SMS messages claiming a rollover is stalled pending identity verification. The attached PDF uses ATO green branding and fake reference numbers, then links to a cloned myGov login that captures credentials and one-time codes. Scammers immediately attempt to add a new bank account inside the super fund portal and request a partial rollover to that account. Because the forms look like legitimate compliance paperwork, call-centre staff said members often insisted the request was real until fraud teams showed the domain mismatch.
Some lures reference real fund names pulled from public annual reports, which makes the PDF feel personalised even though the sender address is unrelated to either the fund or the ATO. IDCARE case notes describe victims who completed two-factor prompts on the fake site, handing attackers enough session access to add payees within minutes.
Hosting providers have taken down dozens of cloned pages this month, but new domains appear with the same PDF template within days, a whack-a-mole pattern IDCARE said members should expect through November contribution season.
What legitimate process looks like
The ATO does not email unsolicited rollover PDFs demanding password resets. Genuine rollovers initiate inside your fund’s authenticated portal or via paper forms posted to known addresses, and funds call back on registered numbers before large outbound transfers. The ATO’s public guidance repeats that myGov messages about tax affairs appear inside the authenticated portal, not as standalone PDF attachments from unknown senders.
IDCARE advises members to hang up on cold callers, log in only by typing my.gov.au manually, and call their fund on the number printed on their last statement if a rollover message arrives unexpectedly. Funds told IDCARE they will never ask for full portal passwords by email; any message doing so should be treated as fraudulent regardless of letterhead quality.
Employer payroll teams were reminded not to forward super choice forms from unverified inboxes, because some scams pivot to HR inboxes pretending to be employee rollover requests.
Reporting and recovery
Funds that spot the scam early can reverse internal transfers, but money sent to mule accounts within hours is harder to claw back. IDCARE urged anyone who entered credentials on a linked page to change passwords immediately, enable multi-factor authentication, and lodge a ReportCyber entry so the Australian Federal Police can share indicators with banks and hosts.
Early reporting also lets IDCARE coach victims on credit freezes and identity document checks if attackers attempted myGov profile changes. Super funds said they are tightening outbound rollover callbacks when new bank details appear within forty-eight hours of a password reset, a control several victims lacked before October’s spike.
The Australian Cyber Security Centre republished ATO impersonation indicators Sunday, including mismatched reply-to domains and PDFs that demand credentials in the body text. IDCARE said pairing those indicators with fund callback rules cut average loss sizes in cases where members paused before authorising transfers.
Year-end contribution scams often spike again in the final fortnight of June; case managers warned members to expect copycat PDFs if October’s pattern proves profitable for criminals.
Funds asked members to register outbound rollover callbacks through official apps rather than links in email, a step several victims skipped because the PDF looked urgent.
IDCARE’s October tally includes reports where no money moved because funds flagged transfers in time; those cases still count in the file surge because members sought help verifying lures.