TL;DR: If your myGov account may be compromised, act quickly: call the Services Australia Scams and Identity Theft Helpdesk, set up passkeys or Digital ID and turn off your password, check your account history, complete the Security review, remove unknown devices and passkeys, then contact linked services (ATO, Medicare, Centrelink) and your bank. Locked out? Recover with Digital ID or call the myGov helpdesk.

👉 Check my digital footprint — free 30-second check →

Why myGov is a target

One login connects your ATO, Medicare and Centrelink records. A scammer inside can change bank details for refunds or payments, and read personal data. The NDIA said in July 2026 that criminals used myGov to get into some NDIS accounts.

Step-by-step

From myGov’s what to do if you’ve been scammed:

  1. Act quickly.
  2. Call the Services Australia Scams and Identity Theft Helpdesk (number on the Services Australia contact page).
  3. Set up multi-factor authentication using Digital ID or passkeys, then turn off your password.
  4. Change your myGov password if you’re keeping one.
  5. Check your account history for sign-ins or activity you don’t recognise.
  6. Complete the Security review tasks after signing in.
  7. Remove devices or passkeys you don’t recognise.
  8. Contact linked services (ATO, Medicare, Centrelink) if the scammer could have accessed them, and your bank if you shared bank or card details.

The safest fix: close it and start again

myGov’s separate page on suspicious activity goes further. If you see activity you don’t recognise, it calls closing your myGov account the safest step, then:

  1. Create a new myGov account.
  2. Relink your services (ATO, Medicare, Centrelink and so on).
  3. Set a new passphrase you don’t use anywhere else.
  4. Complete the security review, then turn off password sign-in and use Digital ID or a passkey.

Before you close it, note what you saw. myGov says to look for:

WhereWhat to check
Account historyChanged name, email or mobile; unknown devices or passkeys; odd sign-in times
Linked servicesServices you didn’t link; changes to existing ones; changed bank details

If a linked service shows changes, contact that service directly. A changed bank account on your Centrelink or ATO record is the one to chase first, because that’s where the money goes.

It feels drastic. But a fresh account with a passkey is the only state you can be sure the scammer isn’t in.

Locked out?

Gave away ID details?

If you shared your driver’s licence, Medicare number or TFN, contact IDCARE (1800 595 160). For your TFN, also call the ATO: see TFN stolen.

Why passkeys beat passwords here

A passkey can’t be typed into a fake myGov page, because there’s nothing to type. It only works on the real site with your device. For an account this important, that’s the upgrade worth ten minutes. Read more about Digital ID and myID and setting up passkeys.

How people get caught

Don’t sign in through a link in an email or text. Type my.gov.au yourself.

Also worth support: myGov points people to Moneysmart for financial counselling and to mental health services. Getting scammed is stressful; you don’t have to sort it alone.

A free exposure check shows if your email is in breach data.

Frequently Asked Questions

What should I do if my myGov account is hacked?

Act quickly: call the Services Australia Scams and Identity Theft Helpdesk, set up passkeys or Digital ID, check account history, remove unknown devices and contact linked services.

Should I close my myGov account if it was hacked?

myGov says closing the account is the safest step if you see activity you don’t recognise. Then create a new one, relink services and use a passkey or Digital ID.

How do I recover a locked myGov account?

Use Digital ID to recover it or contact the myGov helpdesk.

Should I use passkeys on myGov?

myGov recommends setting up MFA with Digital ID or passkeys and turning off your password.

What if I gave my TFN or Medicare number to a scammer?

Contact IDCARE on 1800 595 160, and the ATO for your TFN.

Sources

Related Reading