Five parties may ask for your TFN: your employer once you have started, your bank, your super fund, your tax agent, and government agencies administering payments you are entitled to. Nobody else has any right to it.
Why is a TFN worth stealing?
Because it is permanent and it unlocks money in your name. Someone holding your TFN plus basic identity details can lodge a return as you and direct the refund to their own account, attempt to access your superannuation, or create ABN registrations linked to you.
The number cannot be cancelled like a card. A fraudulent return usually surfaces only when your genuine return is rejected as a duplicate, months later, with the refund frozen while it is investigated.
Why are working holiday makers targeted specifically?
Because they are new to the system, unsure what normal looks like, and moving through environments built on informal trust. Hostels, backpacker Facebook groups and WhatsApp communities are where someone unfamiliar with Australian tax looks for help, and the people offering it are not screened.
The pattern is consistent. An offer to lodge your return or claim your super for a small fee, a request for a photo of your passport and visa grant, your TFN, date of birth and address, and sometimes bank details. Then the return is lodged with the refund pointed elsewhere and the account disappears.
What are the warning signs?
The first settles most cases: no verifiable registration on the government's public register of tax practitioners. Registration is public, checkable in under a minute, and anyone unwilling to give you a number has answered the question.
- Payment requested in cash, cryptocurrency or gift cards
- No business address, operating only through a messaging app
- A large refund promised before anyone has looked at your circumstances
- A request for your account passwords, or to share your screen
- Pressure to act immediately, usually invoking a deadline
The password request deserves emphasis. A registered agent reaches your records through their own agent channel and never needs your myGov credentials. Anyone asking for them is not operating as an agent whatever they call themselves.
How did the leak usually happen?
Rarely through anything sophisticated. The recurring causes are job scam onboarding forms asking for full identity documents before any work exists, documents photographed or left on shared hostel computers, and TFNs sent over WhatsApp to someone described as payroll.
The common thread is a request that seems administratively normal arriving when you have no basis for comparison. Knowing the list of five converts a judgement call into a fact check.
What do you do if it has already happened?
Act the day you suspect it. Contact the ATO's client identity support line and tell them you have a compromised TFN. They can place a marker on your record requiring additional verification before anything is processed in your name, and in some circumstances issue a new number.
Then secure everything attached to it. Change your myGov credentials and enable the strongest sign in available, notify your superannuation fund because balances are a target in their own right, and check whether a return has already been lodged in your name this year. The marker costs nothing and remains protective for years.
What if a fraudulent return was already lodged?
The genuine return still gets lodged and the refund is still yours, but it moves onto a slower path while the duplicate is investigated. That is a delay of months rather than a loss, resolved through the ATO rather than the police in most cases.
Report it, keep every piece of correspondence, and expect additional identity verification on everything that follows. Being outside Australia makes this materially harder.
How exposed are you right now?
The protective rules are the same for everyone. Your exposure is not, and remediation from overseas is slower.
- Whether you have ever sent identity documents to someone you could not verify.
- Whether your myGov account uses a phone number that still works, since a dead Australian SIM locks you out of your own record.
- Whether super fund contact details are current, because funds are a separate target.
- Whether you have already left Australia.
- Whether a return has been lodged in your name this year that you did not lodge.
- Whether any ABN is registered against your details that you did not register.
Returns lodged as part of the working holiday tax return go through a verifiable professional channel rather than an anonymous account, and you can estimate your tax refund yourself before dealing with anyone at all.