News

Have you received something like this? It wouldn’t be the first time that a scam posed as a government body.

Our first impulse may be – it’s a scam and we immediately delete it, but is it?

For anyone my age (50+) and older, we were quite used to dealing with the ATO and other government departments by paper forms and mail via Australia Post. Things took time. But like the rest of the world, the ATO has been evolving in the electronic world.

A few years ago, the ATO introduced the Business Portal. Access was provided via the ‘Auskey’. It was a utility installed on our computers. Once settled in, it was stable enough and we were used to it. But just over a year ago, it was declared at ‘end of life’. So in conjunction with the introduction of Single Touch Payroll (STP) – the Relationship Authorisation Manager (RAM) was introduced.

What is RAM?

RAM is an authorisation service that allows you to set up and manage who can access ATO online services for your business. It is also where you set their permissions levels when they act on your behalf. To identify individuals, it utilises ‘myGovID’.

What is myGovID?

The myGovID service is the Australian Government's digital identity service provider and is built and maintained by the ATO. The myGovID app is the way for you to obtain and use a Digital Identity - when dealing with participating government online services; predominantly, the ATO Business Portal.

It is designed makes it easier to prove whom you are online – it's like the 100-point ID check but on your smart device. And in the day-to-day it provides two-way authentication as you log in to participating government online services.

Despite the similar name – it is not myGov. myGov is for individuals – on behalf of themselves – and is the front door to a range of government online services, including Medicare, myTax and Centrelink, in the one place using a single login and password.

Who needs myGovID?

A myGovID is required for anyone who acts on behalf of businesses, either as their employee or agent (e.g. accountants) and deals with the ATO.

How do you get a myGovID?

Start by downloading the app from your phone provider’s app store. Launch it and follow the prompts.

What will I use it for?

myGovID will authorise your entry into RAM and the ATO Business Portal. When logging into these services, a code will be sent to your phone. Start up the myGovID app and accept the code. This acceptance will be sent back to the Service and you will be granted access.

Lets return to that scary email. It’s scary because RAM and myGovID is still very new. When dealing with anything unfamiliar, a layer of tension is added. It doesn’t help to have a world full of scammers - wanting our money and identity – more tension.

Is it a scam? Looking at the email with the ‘naked eye’, no it does not appear so.

It is a reasonable request of RAM. To help protect our identity and our businesses, they don’t want ‘link-ups’ to be open ended. So they have time-limited it to 12 months.

Within the email – there are no big buttons saying ‘click here’. And there are no attachments. It tells you to not reply to this message.

Going deeper – if you are more technical minded – your email software should allow special viewing options (try the ‘View’ menu) for ‘All Headers’ and ‘Raw Source’. It will give you a rating as to its interpretation of whether it is spam. It will also show you expanded versions of the email addresses. If it were a scammer, in this case, the return address would no longer be a government email address. And the links would show a redirection to somewhere else than where you expect.

There are two shortcuts – in the body and footer – to info.authorisationmanager.gov.au/renewlink

When in doubt – ignore any buttons, shortcuts or links. Go to your preferred browser and go to that service in the way you usually do.

This is what I did. From my browser, I used my trusted shortcut already set up. It directed me to: https://authorisationmanager.gov.au/, I logged into RAM in the normal way, using myGovID to provide authentication.

When it opened to its Home Screen, I saw the following at the top of the page:

Following the instructions and using the links there, I extended my authorisation.

Another method to check if an email is a scam or not is to search (with your search engine of choice) the purported sender of the email (text, phone call etc.) and scam – “ATO scam”. Either, the email that you just received will be among the top returns, or a list of current known scams being run under the guise of who you searched for will come up.

Currently, there is a scam going around where scammers are phoning people and posing as the Australian Tax Office (ATO). They claim that they’re suspending your Tax File Number (TFN) - telling the receiver to pay a fine to ‘unlock’ their TFN. This is something that the ATO will never do.