Tax time is the most dangerous time of year for Australian businesses. While you are focused on reconciling accounts, gathering receipts, and lodging returns, cybercriminals are running their own operation — one specifically engineered to exploit the pressure, distraction, and volume of EOFY activity. According to the ATO, scam emails surged 179% and scam SMS jumped 414% in a single year. One in four Australians have encountered an EOFY scam. The question is not whether attackers will target your business this tax season. The question is whether you will be ready when they do. This article breaks down the most common EOFY cyber threats facing Australian businesses right now, and the practical steps you can take today to stay protected.
Why EOFY Is Prime Time for Cybercriminals
Every year, the weeks leading up to 30 June see a spike in cyber attack attempts across Australia. The reason is simple: businesses and individuals are expecting communications from their accountant, their tax agent, the ATO, myGov, and their bank.
That expectation is exactly what attackers exploit. When an email about your tax return lands in your inbox, your guard is lower. When a message says your refund is ready, you want to click. Cybercriminals weaponise urgency, familiarity, and trust during this window.
The average cost of a cyber attack on an Australian small business is $56,600 per incident. For medium businesses, that figure rises to $97,200. EOFY is not the time to find out your defences are inadequate.
Recommended Link: Learn how cybersecurity awareness training can protect your team from EOFY threats
The 4 Most Common EOFY Cyber Threats Right Now
1. Accounting and Tax Business Fraud
Attackers impersonate accountants and tax agents to request payments or sensitive information via email. These messages often look completely legitimate, referencing real business names and using professional language.
What to do: If you receive an unexpected email from your accountant or tax agent, do not respond to it. Call them directly on a number you already have stored, not a number provided in the email itself.
2. Phishing Emails and Account Compromise
Phishing emails spike sharply at tax time. Watch closely for:
- Urgent or threatening language designed to create panic
- Requests for login credentials or personal information
- Links that do not match the sender’s official website domain
- Slight misspellings in email addresses (e.g. @ato.gov.au vs @at0.gov.au)
If something feels off, do not click any links. Call the sender directly to verify.
Recommended Link: Understand how phishing and business email compromise target Australian SMBs
3. Bank Fraud and Payment Redirection
This is one of the most financially devastating EOFY cyber threats. Attackers impersonate suppliers, accountants, or the ATO to redirect payments to accounts they control.
Any email advising a change in bank account details is a major red flag. Always call the business directly on a number you have on file before making any payment changes.
4. myGov and Government Account Targeting
Scammers use fake myGov login pages, phishing emails, and SMS scams to steal government account credentials. This gives them access to your tax refunds, super balance, and personal identity information.
Remember these hard rules:
- The ATO and myGov will never send a link asking you to log in
- They will never request your TFN or bank details via email
- They will never threaten you with arrest
Always type https://www.my.gov.au directly into your browser. If you receive a suspicious ATO communication, report it to 1800 008 540.
Simple Measures to Protect Your Business This Tax Season
You do not need a massive IT budget to defend against EOFY cyber threats. These practical steps significantly reduce your exposure:
- Enable MFA on every account — email, myGov, accounting software, and banking. This is your single most effective control.
- Use strong, unique passwords — a password manager like 1Password generates and stores them securely so you never reuse credentials.
- Verify before you act — always call the sender directly on a known number before responding to any suspicious email request.
- Never click suspicious links — type URLs directly into your browser, especially for ATO or myGov.
- Keep all devices and software updated — security patches close the vulnerabilities attackers actively exploit at tax time.
- Report suspicious emails — forward ATO impersonation attempts to ReportScams@ato.gov.au. Report other scams to the ACSC at https://www.cyber.gov.au/report.
Recommended Link: See how Netlogyx implements vulnerability management and security monitoring for Gold Coast businesses
The One Rule That Stops Most EOFY Attacks
If you take nothing else from this article, take this: Stop. Verify. Then act.
Before responding to any email involving money, bank details, login credentials, or personal information — stop. Pick up the phone. Call the person or organisation on a number you independently know. Then, and only then, act.
A phone call takes 60 seconds. A successful payment redirection scam can take everything.
Train your team on this rule. Share it with your accountant. Post it near the printer if you have to.
Ready to Know Where Your Business Actually Stands on Cybersecurity?
EOFY is the most targeted time of year. Now is the right moment to get a clear picture of your current cybersecurity posture — before attackers find the gaps.
We are offering a complimentary Cyber Discovery Session exclusively for our current clients, normally valued at $250, at absolutely no cost to you.
In this session, we will:
- Review your current cybersecurity posture
- Identify vulnerabilities and gaps in your defences
- Provide clear, practical recommendations tailored to your business
This is a no-obligation conversation designed to give you confidence and clarity heading into the new financial year.
Please note: Only 5 spots are available, exclusively for current clients. This offer closes 15 July — reach out now to secure your spot.
Reply to this email or contact us directly at neil@netlogyx.com.au or call +61 7 5520 1211.
Recommended Internal Link: Learn more about Netlogyx cybersecurity services for Gold Coast and SE Queensland businesses
Frequently Asked Questions
Q: How do I know if an email from the ATO is real?
A: The ATO will never send an unsolicited email or SMS containing a hyperlink asking you to log in. Legitimate ATO correspondence can always be verified by logging into your myGov account directly — type the URL yourself — or by calling 1800 008 540. If a message creates urgency, threatens consequences, or asks for personal information, treat it as suspicious regardless of how official it looks.
Q: What should I do if I think I have already clicked a suspicious link?
A: Do not enter any information on the page that opened. Close your browser immediately. Change your myGov and email passwords, and contact your bank if you provided any financial details. Run a security scan on your device and report the incident to the ATO at ReportScams@ato.gov.au. The sooner you act, the better your chances of limiting the damage.
Q: Are small businesses really targeted during EOFY, or just large companies?
A: Small and medium businesses are disproportionately targeted precisely because their defences are typically weaker. The ATO received over 7,400 impersonation scam reports in July 2025 alone. Attackers cast a wide net during EOFY — every inbox, every business, regardless of size.
Finish EOFY Feeling Confident, Not Compromised
EOFY cyber threats are real, they are surging, and they are specifically designed to catch busy business owners off guard. The good news is that awareness is your most powerful first line of defence. Know the tactics. Trust your instincts. Verify before you act.
And if you want the peace of mind of knowing your business has the right protections in place — not just for EOFY, but for every season — that is exactly what we are here to help with.
Stay safe and have a productive end of financial year.
(We are not looking to replace your current provider, just offering an alternative perspective)
Written by Neil Frick
Sources & References
- Australian Taxation Office – Scam Alerts: https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/scam-alerts
- Customer Owned Banking Association – Tax Scams Explained EOFY: https://www.customerownedbanking.asn.au/tax-scams-explained-and-how-to-protect-yourself-this-eofy/
- Insurance Advisernet – Protecting Yourself from Cyber Attacks This EOFY: https://insuranceadviser.net/News/Don%E2%80%99t-Let-Tax-Time-Be-the-End-of-Your-Business-Protecting-Yourself-from-Cyber-Attacks-This-EOFY
- ITP Accounting Professionals – Protect Yourself from ATO Tax Scams 2025: https://itp.com.au/protect-yourself-from-ato-tax-scams-2025-safety-guide/
- Yahoo Finance Australia – Major ATO Change and $97.6M Scam Warning: https://au.finance.yahoo.com/news/major-ato-change-for-aussies-as-warning-issued-over-976-million-rip-off-set-to-peak-at-tax-time-002621988.html
- Australian Cyber Security Centre – Report a Cyber Incident: https://www.cyber.gov.au/report