The Australian Taxation Office has an active alert out right now for a fake “payment update” message that’s been doing the rounds — and it’s worth five minutes to make sure everyone in your business knows what to look out for, because this one doesn’t rely on a stolen password to work.
How this particular scam works
The message (by SMS, email, or sometimes a call) claims there’s a problem with a payment or refund and asks the recipient to update their details or “fix” the issue. The trick is what happens next: rather than asking for a password directly, it talks the person into installing remote-desktop software — the same kind of tool a legitimate IT support person might use. Once that’s installed and the scammer has control of the device, they don’t need a password at all; they’re already in.
Separately, Scamwatch has its own active alert for fake investment platforms that borrow the branding and logos of trusted companies (including, in one warning, a major bank) to make the pitch look legitimate. Both alerts have stayed current on the ATO’s and Scamwatch’s own pages for weeks now, which tells you this isn’t a one-off — it’s a live, ongoing pattern.
Why this is worth a staff conversation, not just an IT fix
Neither of these scams depends on finding a technical weakness in your systems. They depend on one person, on one ordinary day, deciding that the message looks real enough to act on. That’s a people problem as much as a technology one, and no amount of antivirus software changes that on its own.
The genuinely useful habit to build into your team: the ATO and the ATO’s legitimate systems will never ask you to install remote-access software to “fix” a payment issue, and a bank will never need you to use a link from a text message to access an investment opportunity. If a message creates urgency and asks for either of those two things, that’s reason enough to stop and check independently — by calling the organisation directly on a number you already have, not one from the message itself.
What to do this week
1. Mention this specific scam pattern to your team — not as a generic “watch out for scams” reminder, but the actual detail: fake payment messages leading to remote-access software installs. 2. Agree on a simple rule: nobody installs remote-access software, or clicks through from an unexpected payment message, without checking with someone else first. 3. If anyone has already installed anything in response to a message like this, that’s worth acting on immediately, not waiting to mention at the next team meeting.
You can see the ATO’s current alert directly at their scam alerts page — it’s worth bookmarking, since they keep it updated as new patterns emerge. And if you’d like a short, practical staff briefing on this kind of thing rather than a dense policy document, that’s something our cybersecurity team puts together regularly for clients.
The technology side of security matters, but this particular scam is designed to walk straight past it.