New phishing scam alerts myGov users that they have a “refund in process”

With 4 out of 5 Australians actively using their myGov accounts, it’s no wonder that the service is frequently the target of impersonation in phishing emails. Each year, MailGuard continues to intercept and block different versions of “myGov” scams, with several others reported on earlier this year. If you’ve received a suspicious email that claims to be from myGov but it doesn’t match what’s shown below, you may like to check out these previous ones from October, or from June.  

The latest email to do the rounds is one that has the subject line “Refund in proccess (1).” and the sender’s name reads “myGov”. The email address for the example below displays “support(at)web(dot)com”, but is actually being sent from a number of different addresses in an attempt to evade email filtering.  

The envelope addresses (where the email is actually originating from) that our team have blocked include: 

• Infallible-elgamal_u54ecer5jlh(at)infallible-elgamal(dot)70-39-251-127(dot)plesk(dot)page 
• support(at)register(dot)com 
• info5(at)zeoiazezai(dot)com 

• info6(at)zeoiazezai(dot)com 
• info7(at)zeoiazezai(dot)com 
• info8(at)zeoiazezai(dot)com 

The email begins with a generic “Dear customer” and then explains that “after the last annual calculation” that the recipient is eligible to receive a refund of $198.92. They are then instructed to click on a button that says “myGov” in order to fill out a form to receive the refund. Although the email has a somewhat professional finish, there is no myGov branding used, and it’s littered with spelling mistakes (e.g. ‘proccess’, ‘eliqible’, and ‘from’ instead of ‘form’) and grammatical errors.

Here’s an example of the email:  

When the user clicks the myGov button, they’re taken to a phishing page which asks them to sign into their account. Although myGov is mentioned a few times, it’s a relatively generic login page, without any official branding and does not look similar to the genuine myGov portal.  

After “signing in”, the user’s email address and password will be stolen. Fortunately, myGov accounts have multi-factor authentication enabled, which should hopefully prevent unauthorised access, but the scam doesn’t stop there.

On the next page, the victim is asked to enter their: 

• Full name 
• Card number 
• Expiration date 
• CCV 

And then instructed to click “confirm”.

Finally, they’re shown a one-time password (OTP) confirmation page, which looks genuine and includes the myGov and Australian Government logos. The victim is instructed to enter the OTP, and their card will presumably be charged by the scammer.  

Services Australia offers the following myGov advice:  

• myGov will never ask you to open a link in an email or SMS. It will never ask you to sign in through a link in an email. 
• You’ll only get links from myGov in a myGov inbox message. You can only see these messages after you’ve securely signed in to your myGov account.  
• myGov will also never email you asking for your personal or credit card details. 

If you believe you may have already fallen for this scam, we recommend you change your myGov password as soon as possible and contact your bank to put a hold on your credit card. You can also learn where to report the scam here.  

MailGuard advises all recipients of this email to delete it immediately without clicking on any links. Providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its’ financial well-being.    

MailGuard urges users not to click links or open attachments within emails that:       

• Are not addressed to you by name.       
• Appear to be from a legitimate company but use poor English or omits personal details that a legitimate sender would include.       
• Are from businesses that you were not expecting to hear from, and/or       
• Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.      

Many businesses turn to MailGuard after an incident or a near miss, often as a result of an email similar to the one shown above. If unwanted emails are a problem for your business, don’t wait until it’s too late.  

Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.

One email is all that it takes     

All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.     

For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's inboxes.  

Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.