ATO warns taxpayers of fake refund phishing scam

Stephen Withers
Monday, 15 June 2009 08:05

Business IT - Security

Recipients are asked to supply details of the bank or credit card account where the supposed refund is to be deposited, including the three-digit security code from the back of the credit/debit card, or the ATM PIN for that account.

If that's not enough to make you suspicious (you never give anyone your PIN), ask yourself why the form is personalised with the amount of your 'refund' but nothing else.

If someone completes the form and clicks the "Print" button, what actually happens is that the details are sent to a server using the auxgen.biz domain.

auxgen.biz was registered through Melbourne IT, purportedly by Martha Collard of Private Registration US, using an email contact address at myprivateregistration.com.

myprivateregistration.com is purportedly registered by "Merlbourne IT Ltd", with contact details corresponding to Melbourne IT. However, the Californian phone number given for Private Registration US does not correspond to that of Melbourne IT's office in Mountain View.

Melbourne IT does not mention a private registration service (as offered by various registrars) in its price list.

Tax Commissioner Michael D'Ascenzo said anyone who receives the email should delete it immediately.

"The Tax Office never sends emails asking people to provide personal information including credit card details," he said.

"People should always be wary of unsolicited emails claiming to be from the Tax Office."