Fake myGov 'Secure Message' Email Harvests Licences

TL;DR: On 18 September 2026 email security firm MailGuard published an analysis of a fake myGov email titled 'You have (1) New Message'. The scam walks victims through seven stages, collecting login details, three SMS codes, security answers, a name and date of birth, and photos of a driver's licence, then redirects to the real myGov site.

👉 Check my digital footprint — free 30-second check →

What MailGuard found

In an analysis published on 18 September 2026, MailGuard described a phishing email impersonating a myGov secure message notification, with the subject line 'You have (1) New Message'. It was sent from workspace@sasinm.com, not from government infrastructure.

The fake flow has seven stages: a myGov login, an SMS verification code, security question answers, full name and date of birth, a second SMS code, driver's licence images (front and back), and a third SMS code. MailGuard said it works because it asks for everything in one visit, the mundane pretext avoids suspicion and the staged steps feel like a real government portal.

Why victims do not notice

At the end, victims are redirected to the genuine myGov site. MailGuard noted that this creates false confidence that a normal transaction was completed, so the victim may not realise anything was taken. The details gathered are enough for identity theft and account takeover. MailGuard is a commercial security vendor, so treat the technical detail as its own analysis.

Protection steps

Delete the email without clicking links.
Open myGov through the official app or by typing the address yourself.
Never enter SMS codes after following a link in an email.
Be suspicious of any unsolicited email asking for personal data.

If you did enter details, change your myGov password, contact your bank and ask about replacing your licence. Our guides on ATO and myGov scam texts and emails, Services Australia scams and how to report identity theft in Australia cover the next steps.

What a stolen licence image can be used for

A driver's licence image, combined with a name and date of birth, can help someone pass identity checks elsewhere, so the harm can extend beyond the myGov account itself. Three SMS codes mean the scammers were likely logging in to real services while the victim was still typing.

Treat any prompt for a code as a live attack. A code you receive when you did not start a login is a sign that someone else is trying to get in, and you should never pass it on. If you are unsure whether you have a genuine myGov message, open the official app yourself instead of using any link, and check the inbox inside it.

Where to report

Report the email to Scamwatch. If your details were entered, IDCARE offers support on 1800 595 160. Our guide on how to report a scam to Scamwatch explains what to include.

Frequently Asked Questions

What does the fake myGov email say?

MailGuard reported the subject line 'You have (1) New Message', styled as a myGov secure message notification.

What does the scam collect?

Login credentials, three SMS codes, security question answers, full name and date of birth, and images of a driver's licence, front and back.

Why does it end on the real myGov site?

MailGuard said the redirect gives victims false confidence that a normal transaction took place.

What if I already entered my details?

Change your passwords, contact your bank, report to Scamwatch and consider contacting IDCARE on 1800 595 160.

A Fake myGov 'New Message' Email Asks for Everything in One Visit