Six groups may lawfully ask for your Tax File Number: your employer once you are hired, the ATO, your superannuation fund, your bank, a registered tax agent acting for you, and Services Australia if you are claiming a payment.
Why is the list this short?
Because a TFN plus a passport is a workable identity kit, and Australian privacy law treats it accordingly. Collection is restricted to organisations with a genuine tax reason to hold it, and each of them has to explain why it needs the number, store it securely and use it only for that purpose.
The short list means you never have to judge whether a request is reasonable. If the asker is not on the list, the answer is no, and no explanation is required.
When is your employer entitled to ask?
After you have been hired, not before. The legitimate request comes as a Tax File Number Declaration during onboarding, which is a standard ATO form, and the employer uses the number to apply the correct 15% working holiday maker rate and to report your income.
A request before you have accepted a job is the warning sign, and the most common way backpackers get caught. A recruitment agency does not need your TFN to put you forward for work, and if you have not accepted an offer there is nothing to complete a declaration for.
Who is not entitled to it?
Anyone whose reason for wanting it is not tax. The requests working holiday makers actually receive come from a predictable set.
- Landlords and real estate agents, including on rental applications
- Hostels, for any purpose
- Phone, internet and utility providers
- Recruitment agencies, before you have been hired
- Other travellers, friends, or anyone in a group chat
- Anyone offering tax help who cannot produce a current registration
Refusing any of these is not a criminal matter and cannot lawfully be used to deny you a tenancy, a service or a job.
What do the scams actually look like?
They are not sophisticated and do not need to be, because they target people in their first weeks in a new country.
The fake job. An offer that arrives unprompted, asks for your TFN and a photo of your passport before any interview, and never proceeds to actual work. The output is an identity kit, not a job.
The social media refund agent. An account offering to lodge your return, asking for your TFN and your government account login, and frequently promising a figure before seeing any of your income. Returns are lodged to bank accounts the victim does not control.
The hostel noticeboard payroll form. A paper form collecting TFNs for cash work that never materialises, left where a hundred people will fill it in.
The consistent tell is a promise of a specific refund amount before anyone has seen your income statements. Nobody can know that number in advance, and anyone claiming to is not doing tax work.
How do you check someone before handing anything over?
Every tax agent operating in Australia is on the government's searchable public register of tax practitioners. The check takes a minute, and a legitimate practice will expect you to do it.
Two things a genuine agent will never need are your government account password and your bank login. Access to your ATO records is obtained through a professional channel, not by logging in as you, and any request for those credentials is a fraud. Returns prepared for you here are reviewed and signed off by a registered tax agent before lodgement, and that registration is checkable on the same public register.
What if you have already given it to the wrong person?
Nothing catastrophic happens automatically, and a TFN alone is not enough to empty a bank account. The risk is a fraudulent tax return lodged in your name, or an account opened using your identity, and both are detectable.
The ATO can place a flag on your record after an identity compromise, which is worth doing rather than waiting to see. Contact it on 13 28 61 and say plainly what was disclosed and to whom. If you also handed over a government account login, change it before you do anything else.
Is the request in front of you legitimate?
The list of who may lawfully ask is fixed, but whether a particular request is legitimate turns on context.
- Whether you have accepted the job yet. This is the whole test for an employer request.
- Whether the person asking is a registered practitioner, which is checkable in a minute on the public register.
- Whether anyone has your government account credentials as well as your TFN, which is a materially worse situation than the TFN alone.
- Whether you are claiming a Services Australia payment, which is the one government context outside the ATO where the request is legitimate.
- Whether you gave it to a super fund. That one is not a risk, it is necessary, and a fund without your TFN taxes contributions at a higher rate and struggles to match the account to you when you claim your superannuation after leaving Australia.