How to protect your TFN from fraud and identity theft in Australia

Your TFN should be treated with the same care as a bank account number. Once it is compromised, the damage can take years to unwind.

Who can legitimately ask for your TFN?

The ATO publishes a strict list of who can ask for your TFN. The list is short:

• Your employer (after you have started work, on a Tax File Number Declaration form)
• Your bank or financial institution (to apply the correct tax rate on interest)
• Your superannuation fund (to manage your retirement savings)
• Your registered tax agent (to lodge your tax return or manage ATO matters)
• Centrelink or government agencies administering payments you are entitled to

No one else has a legal right to ask for your TFN. Not a landlord, not a friend, not a recruitment agency, and certainly not someone in a Facebook group offering to "help with your tax".

How TFN fraud actually works

The most common scam targeting working holiday makers follows the same pattern. A scammer posts in a backpacker Facebook group, WhatsApp community, or hostel noticeboard, offering to "lodge your tax return" or "claim your super" for a small fee. They ask for:

• A photo of your passport
• A photo of your visa grant
• Your TFN
• Your date of birth and Australian address
• Sometimes your bank account details

With these details, the scammer lodges a tax return in your name through the ATO portal, lists their own bank account as the refund destination, and disappears with the money. When the legitimate return is later lodged, the ATO flags it as a duplicate and the genuine refund is delayed by months while the fraud is investigated.

Warning signs of a TFN scam

If the person offering to handle your tax cannot show you a TAN (Tax Agent Number) on the Tax Practitioners Board register, they are not a registered tax agent. Other red flags include:

• Asking for payment in cash, cryptocurrency, or gift cards
• Operating only through messaging apps with no business address
• Promising unusually large refunds with no review of your actual situation
• Asking for your account passwords or for you to share your screen
• Pressure to "act fast" or "before the deadline"

Legitimate tax agents have a registered business, a TAN number, a professional indemnity insurance policy, and never need your account passwords to lodge a return on your behalf.

What to do if your TFN has been compromised

If you suspect your TFN has been shared with the wrong person or your details have been stolen, contact the ATO immediately on the official identity theft line and report it. The ATO can put a security marker on your account that requires additional verification before any return is processed. Get in touch with our team and we will help you report the breach, secure your account, and check whether any fraudulent returns or ABN registrations have been lodged in your name.

How do we keep your TFN secure?

When you lodge through our service, your TFN and identity documents are handled through a registered tax agent channel covered by professional indemnity insurance and bound by the Tax Practitioners Board code of conduct. We never operate through anonymous messaging apps, and our TAN number is publicly verifiable on the Tax Practitioners Board register.