Fake ATO Crypto Asset Disclosure Email

Scam Description

I'm in Australia. On 7 October an email arrived that looked like it was from the Australian Taxation Office. The subject was "Legal Requirement: Mandatory Crypto Asset Reporting". The sender name was the Australian Taxation Office. Inside, it called itself an official notice of requirement. The notice ID was ATO-2026-CRYPTO-4831692. It cited Taxation Ruling TD 2014/26 and TR 2014/7. The email said Australian residents have to disclose crypto. That included holdings on trading platforms, holdings in self-managed wallets, and income from staking, lending and mining. It gave 14 days to complete a mandatory crypto asset disclosure form. A second email the same day used the same story. It warned of fines up to $10,000 and prosecution under the Taxation Administration Act 1953 if the form was not completed. I did not open the form. I did not enter wallet balances, passwords or ID. The links were not on ato.gov.au, and they were not a message in myGov. The first link was a file on Amazon S3. The host was secure-connection-envelope-fbim8tayaz.s3.ap-southeast-1.amazonaws.com. The second email used a Backblaze address, secure-member-method-3davr2twvr.s3.us-east-005.backblazeb2.com. The ATO does not send a crypto disclosure form as a file on cloud storage. I do not use the myGov app. A real ATO message still turns up in the myGov inbox, or it comes in the post. It does not arrive as an email with a button that opens a disclosure form. If this email lands with you, do not click the link and do not reply. Forward it to ReportScams@ato.gov.au and report it to Scamwatch. If you already opened the link, or typed in holdings, sign-in details or ID, call the ATO on the number published at ato.gov.au. Do not use a number printed in the email. Call your bank on the number printed on your card.