Accounting Firm Cyber Security: Beating ATO Scam Emails

Picture a busy Tuesday in September. An email lands in a team member’s inbox, apparently from the Australian Taxation Office, saying there’s a payment update in the ATO profile or an income statement to review. One click later, a page prompts a file download, and the file is remote desktop software that hands a stranger control of the device.

That is the scam the ATO flagged in its September 2026 alert, and it shows why accounting firm cyber security is now a client-service issue, not just an IT one. This guide covers what the latest ATO impersonation scams look like, why firms are higher-value targets, and the layered controls that keep client data safer when one email slips through.

What do the latest ATO impersonation scams look like?

The ATO updates its scam alerts as new campaigns appear. Recent examples show how quickly the tactics change:

• September 2026, malware email. A “payment update” or income statement to review. The link downloads remote desktop software that can give the scammer access to your device.
• July 2026, appointment email. A phone appointment “has been scheduled”, with an attachment linking to a convincing fake myGov sign-in page.
• February 2026, cryptocurrency email. Recipients are told they hold crypto in a “non-KYC decentralised wallet” and must call a number to declare it.
• October 2025, DocuSign email. A fake DocuSign titled “Declaration and Final Release” implies the ATO is holding a refund. The button leads to a fake myGov sign-in page.

The pattern is consistent: each scam borrows a familiar name and creates a reason to click or call. The ATO’s own guidance is the reliable checklist. It will never send an unsolicited message that directs you to a login page, and it will never threaten arrest or legal action by email or SMS.

Why are accounting firms a bigger target than the average taxpayer?

A scammer who compromises an individual taxpayer gets one person’s details. A scammer who compromises a tax practice can reach many clients’ details at once.

A typical practice workstation holds tax file numbers, bank details, identity documents, and often access to ATO online services for tax agents. That concentration is why the ATO publishes separate cyber security advice for businesses and tax professionals.

Timing matters too. Firms are busiest around lodgment deadlines and EOFY, and rushed people click faster. Scammers know the tax calendar as well as your team does.

What layered controls strengthen accounting firm cyber security?

No single control stops every scam. Firms that manage the risk well stack several, so one failure doesn’t become a breach.

1. Verify through a separate channel. Never sign in to ATO or myGov through an emailed link. Type ato.gov.au or my.gov.au into your browser, or phone 1800 008 540 if you’re unsure.
2. Multi-factor authentication everywhere. A stolen password alone shouldn’t be enough to reach client systems.
3. Secure remote access. Staff connect to firm systems through a VPN.
4. Audit trails. Logged access makes unusual activity easier to spot and investigate.
5. Restricted data handling. Client-confidential data stays out of unapproved tools, including AI tools.
6. Encrypted backups. Recovery shouldn’t depend on the attacker’s goodwill.
7. A report-and-respond habit. Staff forward suspect emails to ReportScams@ato.gov.au, delete them, and raise the alarm the moment they’ve clicked.

Where does ISO/IEC 27001:2022 fit in?

ISO/IEC 27001:2022 is the international standard for information security management. It requires an organisation to assess its security risks, put controls in place, and be independently audited against the standard.

Be precise about what that means. Certification shows a structured, audited system exists for managing security. It doesn’t mean nothing can go wrong, and anyone who claims otherwise is overstating it. What it gives you is a reliable way to ask better questions: what controls are in place, who reviews them, and how often.

What security questions should you ask accounting outsourcing companies in Sri Lanka?

Many Australian practices extend their capacity with an offshore team, especially around EOFY. If you plan to outsource accounting to Sri Lanka, the same layered-controls thinking applies to your partner. Worth asking:

• Which security standards is the partner independently certified against, and what does each certification cover?
• How do staff access client systems, and are access logs kept?
• What is the policy on AI tools and client-confidential data?
• How are backups encrypted, and how quickly can operations be restored?
• Which privacy obligations does the partner operate under, such as the Australian Privacy Act 1988?

When looking at offshore accounting in Sri Lanka, compliance should be a starting point, not an afterthought. IOG Global operates a Colombo service centre certified to ISO/IEC 27001:2022 (information security) and ISO 9001:2015 (quality management).

Our staff connect through a VPN with multi-factor authentication and audit trails, and backups are encrypted. Our AI governance policy states that client-confidential data is never entered into an AI tool for live processing. As an Australian-registered and managed business, we operate to the Australian Privacy Act 1988 and are GDPR compliant.

What should you do if someone in your firm clicks?

Speed matters more than perfection. If someone has interacted with a scammer, given personal information or made a payment, the ATO says to phone it immediately on 1800 008 540. In practice:

• Report the email to ReportScams@ato.gov.au, then delete it. The ATO’s verify or report a scam page has the full process, and scams that don’t impersonate the ATO, myGov or Services Australia can be reported through Scamwatch.
• Tell your IT provider straight away so the device can be isolated and checked and credentials changed.
• Check whether the incident could trigger notification obligations under the Privacy Act, and speak to your legal or compliance adviser if in doubt.

Frequently asked questions

Will the ATO ever email me a link to sign in? No. The ATO says it will never send an unsolicited message that directs you to a login page, or an unsolicited SMS containing a hyperlink.

How can I check whether an ATO message is real? Don’t engage with it. Phone the ATO on 1800 008 540 or sign in to myGov by typing the address into your browser. You can also contact your tax agent.

Does ISO/IEC 27001:2022 certification make a firm immune to phishing? No. It shows an audited security management system is in place, which reduces risk and improves response. It isn’t a guarantee.

Next steps: add a data security check to your capacity plan

Scam tactics will keep changing, but the habits behind strong accounting firm cyber security stay the same: verify through a separate channel, layer your controls, and report fast. Before your next busy period, review your practice against the list above, and if you’re weighing an offshore team, ask the security questions early.

Want to see how certified offshore support fits a compliance-first practice? Book a free consultation with IOG Global and we’ll walk you through our security controls and how they apply to your firm.

Sources: ATO scam alerts and cyber security guidance (ato.gov.au), last updated 18 September 2026. This article is general information, not legal or cyber security advice.