What are the red flags of this scam?

myGov, Medicare, Centrelink, and the ATO never text you asking to click a link and re-verify your account or Medicare number • The link is not my.gov.au — it's a lookalike like 'mygov-au.com', 'medicare-verify.com', 'my-gov-services.com', or a shortened URL • The message threatens suspension of Medicare, Centrelink payments, or myGov access within 24-48 hours • The fake site asks for your myGov username, password, Medicare card number, TFN, driver's licence, AND bank details — a real service would need at most one of these • After you enter details on the fake site, you may be prompted with a 'verification code' step asking for the SMS code you just received from real myGov — that's the scammer using your creds to reset your MFA

What should I do if this happened to me?

Do not click the link. Log into myGov by typing https://my.gov.au yourself and check your inbox for any real messages • For Medicare enquiries, log into your Medicare online account via my.gov.au or call 132 011 — never use a number from a text • If you already entered myGov credentials on the fake site: change your myGov password immediately from a clean device and check that your linked services (Medicare, Centrelink, ATO) are still yours • If you provided your Medicare number, TFN, or driver's licence, place a fraud alert with IDCARE (https://www.idcare.org) and monitor your credit file at Equifax and illion • Enable myGov Sign-in Options (passkeys or two-factor authentication with the myGov Code Generator app) • Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

HIGH government impersonation Last reported: 4 Nov 2026 Share

A text or email says myGov, Medicare, or Centrelink needs urgent verification

Q: Is this a scam?

Yes. This is a documented scam pattern. A text, email, or SMS pretends to be from myGov, Medicare, Centrelink, or the ATO saying your account needs re-verification, that a payment is pending, or that access will be suspended. The link leads to a fake my.gov.au lookalike site that captures your myGov login, TFN, Medicare number, and driver's licence — data reused for tax refund theft and identity fraud.

A text, email, or SMS pretends to be from myGov, Medicare, Centrelink, or the ATO saying your account needs re-verification, that a payment is pending, or that access will be suspended. The link leads to a fake my.gov.au lookalike site that captures your myGov login, TFN, Medicare number, and driver's licence — data reused for tax refund theft and identity fraud.

Also known as: fake myGov text, Medicare phishing SMS, Centrelink verification scam, myGov login phishing, "my.gov.au" lookalike

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Do not click the link. Log into myGov by typing https://my.gov.au yourself and check your inbox for any real messages
2 For Medicare enquiries, log into your Medicare online account via my.gov.au or call 132 011 — never use a number from a text
3 If you already entered myGov credentials on the fake site: change your myGov password immediately from a clean device and check that your linked services (Medicare, Centrelink, ATO) are still yours
4 If you provided your Medicare number, TFN, or driver's licence, place a fraud alert with IDCARE (https://www.idcare.org) and monitor your credit file at Equifax and illion
5 Enable myGov Sign-in Options (passkeys or two-factor authentication with the myGov Code Generator app)
6 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

Red flags

⚠ myGov, Medicare, Centrelink, and the ATO never text you asking to click a link and re-verify your account or Medicare number
⚠ The link is not my.gov.au — it's a lookalike like 'mygov-au.com', 'medicare-verify.com', 'my-gov-services.com', or a shortened URL
⚠ The message threatens suspension of Medicare, Centrelink payments, or myGov access within 24-48 hours
⚠ The fake site asks for your myGov username, password, Medicare card number, TFN, driver's licence, AND bank details — a real service would need at most one of these
⚠ After you enter details on the fake site, you may be prompted with a 'verification code' step asking for the SMS code you just received from real myGov — that's the scammer using your creds to reset your MFA

Known variants

Fake Centrelink refund variant: text or email says you have an unclaimed Centrelink refund or one-off payment, click the link to receive it. Fake site captures bank details 'to deposit the payment'. Real Centrelink refunds go automatically to the bank account on your file — no application required.

Last seen: 6/1/2026
'Suspicious myGov login' text: message pretending to be a legitimate security alert asking you to 'confirm this login attempt' by clicking a link — the fake site captures the code you're now about to receive from the real myGov 2FA prompt.

Last seen: 6/20/2026
'Secure message' multi-step harvest: email says 'You have a secure message from myGov' and leads to a fake login. After capturing credentials it prompts for multiple SMS codes then demands a driver's licence photo — used for tax refund theft and identity fraud.

Last seen: 9/27/2026
'Account locked' variant: SMS or email says your myGov account is locked due to suspicious activity — click a link to restore access. 2026 lookalike domains include my-gov.online, mygov-australia.com, mygov-secure.net. Multi-step flow: credentials, then OTP, then licence photo. Highest-volume myGov phishing campaign in 2026.

Last seen: 11/4/2026
Centrelink payment redirection: scammer uses SMS-phished myGov credentials to log in and change the nominated bank account for Centrelink, NDIS, or Veterans' Affairs payments. Victim notices only when the next payment fails to arrive. Operation Cedar (Nov 2026) attributed $2.5M in redirected payments to this method.

Last seen: 11/4/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources