Scam Texts in Australia: The Senior's Guide to myGov, AusPost and ATO Texts — and the New 'Unverified' Label

Here is the sentence that protects you from almost every scam text in Australia: if a text about money contains a link, it is not from myGov — myGov never sends links in text messages. That is not our opinion; it is Services Australia's own published rule, and it holds for the tax office too. Keep that one sentence and you are already ahead of most of the traps being sent to Australian phones this week.

Scam texts work because they arrive at the worst moments. The parcel text lands while you really are waiting for a delivery. The myGov text lands when you really are worried about your pension. The ATO text lands at tax time, when a refund honestly might be coming. The scammers are not guessing wildly — they send millions of these messages because the timing feels personal even when it is pure luck. And since July 2026, a new word has started appearing at the top of text threads all over Australia — 'Unverified' — and it has left a lot of sensible people asking a very fair question: is this text real, or is it a trap?

This guide answers that question properly. You will learn the 30-second check that comes first, what the 'Unverified' label actually means (and what it does not mean), how to spot the three impersonations Australians meet most — myGov, Australia Post and the ATO — exactly what to do in the first 10 minutes if you have already tapped a link, and how to forward a scam text to 7726 and block the number on both iPhone and Android. Every reporting number you could need is gathered in one table near the end, and there is a one-page checklist to print and keep on the fridge.

The 30-Second Check, Explained: Why It Never Fails

The check works because it refuses to play the scammer's game on the scammer's field. A scam text controls everything inside itself: the name at the top, the wording, the link, the phone number, even the thread it appears in. What it cannot control is the real myGov app on your phone, the real Australia Post app, or the number printed on the back of your bank card. So the entire defence is one habit: leave the message, and check the claim somewhere the message cannot reach.

Notice what this habit does not require. You do not need to spot spelling mistakes — modern scam texts are well written. You do not need to judge whether a web address "looks right" — fake addresses are designed to look right at a glance. You do not need to decide whether you trust the sender's name — since July 2026, as you will see below, even the name at the top of a thread is not proof of anything. You simply step outside the message. If your pension had genuinely been stopped, that fact would exist inside your real myGov account. If a parcel genuinely needed attention, it would exist inside the real Aus Post app. Scammers can imitate a text. They cannot reach inside your real accounts and plant the problem there.

One more reassurance, because worry is the scammer's favourite tool: checking late costs you nothing. A genuine payment issue, a genuine parcel, a genuine tax matter — all of them will still be there tomorrow, and next week, with proper letters and official channels behind them. Nothing genuine evaporates because you took a day to verify it. The only thing that evaporates is the scammer's chance.

The New 'Unverified' Label: What It Means, in Plain Words

Since 1 July 2026, texts sent under a business name follow a new Australian rule. Businesses that text you under a name — 'AusPost', 'myGov', 'Med-Appt', your bank — must now have that name on the SMS Sender ID Register, run by the ACMA, the government body that oversees phone and internet communications. If the name is registered, your texts keep arriving under the name, as before. If the name is not registered, your phone company must replace it with the word 'Unverified' — and all such texts, from every unregistered sender, are grouped together into one shared thread on your phone.

Why the change? Because the old system had a hole in it you could drive a truck through. Scammers discovered they could send texts using the name 'myGov' or 'AusPost', and their fake message would land inside the same thread as your genuine messages — same name at the top, same conversation on the screen. It looked completely real, because in every way your phone could show you, it was indistinguishable from real. The register closes that hole: a scammer cannot register the name myGov, so a fake 'myGov' text can no longer wear the name. It arrives labelled 'Unverified', grouped with every other unregistered sender, visibly separate from the genuine thread.

Now the part that confuses people — and it is important: 'Unverified' does not automatically mean 'scam'. Plenty of honest small organisations were slow to register: a local clinic, a school, a small online shop, a community service. Their genuine reminders now also arrive labelled 'Unverified', in the same shared thread as actual junk. So the label cannot tell you "this is fake". What it honestly tells you is narrower and still very useful: "the name on this text has not been checked — do not trust it on sight."

So if you see 'Unverified' at the top of a thread, here is exactly what to do — three taps and no worry. First: read the text, but touch nothing in it — no links, no reply, no number. Second: ask the 30-second question — what is this text actually claiming, and where can I check that claim safely? Third: check it there — the official app, the address you type yourself, or a number you already trust. If the claim checks out, all is well, and you have lost two minutes. If it does not, forward the text to 7726 (the steps are below), block the sender, and get on with your day. That is the whole routine. And if the 'Unverified' text turns out to be your genuine clinic or dentist, you can gently let them know at your next visit that their name is showing as Unverified — you will be doing them a favour.

What the register cannot do matters just as much. Scammers can still send texts from ordinary mobile numbers — a string of digits has no name to register or lose. They can still copy wording, logos and layouts. And a registered name is about who may send under that name; it is not a promise that every message under it is wise to obey — a text under a real name asking for gift cards or a password is still a scam, because no genuine organisation asks for those things. Treat the label as a good warning sign, keep the 30-second check as your real shield, and you have the measure of it.

myGov Scam Texts: The One Rule That Exposes Every Fake

The most dangerous scam texts in Australia wear the myGov name, because myGov is where the important things live: your pension, Centrelink, Medicare, your tax. A text that says your payment has stopped is not really after the click — it is after the panic. So begin with the rule that cuts through all of it, stated plainly by Services Australia itself: myGov and Services Australia never send a text message or email containing a link for you to sign in, confirm your identity, or claim money. Every genuine message they send asks you to go to your account the normal way. Which means the rule for you is beautifully simple: a 'myGov' text with a link is a scam. Every time. No exceptions to weigh up.

Here is what these fakes usually say. These are examples we have written ourselves to show the pattern — real scam texts use the same shapes:

If a text claims your pension or Centrelink payment has stopped, here is the calm sequence. Close the text. Open the myGov app yourself, or type my.gov.au into your browser — letter by letter, not from any link. Sign in the way you always do. If a payment had genuinely stopped, there would be a message in your real inbox explaining it, because that is how Services Australia actually communicates. No message there means the text was fake, and nothing is wrong with your payment. If you are still uneasy — and it is completely reasonable to be — call the Scams and Identity Theft Helpdesk on 1800 941 126 (Monday to Friday, 8am to 5pm AEST). That is Services Australia's own team for exactly this worry; they can check your record and set your mind at rest.

What if the worry is about Medicare or a myGov-linked service instead — a text saying your Medicare details need updating, or your digital ID must be "re-verified"? The same rule covers all of it: no link in a genuine text, ever. And if you have spotted a myGov scam — even one you did not fall for — you can send it to the team that hunts them: forward it, or send a screenshot, to [email protected], then delete it and block the number. Your two minutes genuinely protects the next pensioner who gets the same text. For the wider family of phone tricks — including the ones that arrive as calls rather than texts — our guide to checking an unknown caller safely walks through the same defence for phone calls.

Australia Post Parcel Texts: The Redelivery-Fee Trick

If there is one scam text nearly every Australian has received, it is the parcel one. It arrives while you genuinely are waiting for something — a birthday gift for a grandchild, a parcel from the kids, an online order — and it says the delivery failed, or the address was incomplete, or a small fee is owed before the parcel can come to you. It asks you to tap a link and fix it. Here is the fact that defeats it, straight from Australia Post's own guidance: Australia Post never asks you to pay a redelivery fee or enter payment details through a text message. A text asking for money for a parcel is a scam — even if the fee is tiny. In fact, the tiny fee is the trick: nobody questions fifty cents, and the scammers are not really after the fifty cents. They are after the card number you type to pay it.

The fakes follow a few well-worn scripts. Again, these are our own examples, written to match the pattern:

Checking a real parcel takes one safe minute, and never starts from the text. Open the official Aus Post app — the one already on your phone — or type auspost.com.au into your browser yourself. Enter the tracking number from the email receipt the shop sent when you ordered, or from the seller's dispatch message. If a genuine delivery problem exists, it will be there, inside the real system, with real options. If nothing shows up, there is no parcel problem — there never was. The text invented one.

Two situations deserve a direct word, because they catch careful people. First: you really are expecting a parcel today. That changes nothing — the scammers know delivery texts work precisely because so many of us are waiting for something at any given moment. It is coincidence wearing a costume. Check in the app, exactly as above. Second: the text came in the same thread as real AusPost messages. That used to be the scammers' best trick, and it is exactly what the new 'Unverified' register was built to break up — but older threads on your phone may still mix old fakes among genuine messages. The thread is not evidence. The app is.

When you have confirmed a fake, forward it to Australia Post's scam team at [email protected], forward it to 7726 as well if you like, then delete it and block the number. And a seasonal warning worth pinning to the fridge: parcel scams surge hardest in the November–December delivery flood around the big sales. Our Black Friday phone deals guide lists the seasonal versions doing the rounds, and our dedicated guide to recognising a fake delivery text gives you five more signs to check before you tap anything.

ATO Scam Texts: Refunds, Debts and Tax-Time Traps

The tax office version of the scam runs on a calendar. It blooms at tax time, when millions of Australians honestly are owed refunds, and again whenever a news story mentions tax debts. The two baits are mirror images: "You are owed money — tap to claim it" and "You owe money — pay now or face penalties." Both end at the same place: a fake page asking for your myGov sign-in, your tax file number, or your card.

The ATO's own rule is the same shape as myGov's, and just as absolute: the ATO never sends a text or email with a link to a sign-in page. The ATO and myGov both send some genuine messages — a reminder that a notice is waiting, for instance — but you are always expected to reach your account by opening the app or typing the address yourself. So a text that says "ATO: Your refund of $612 is ready — claim here" with a link has identified itself. It is a scam. It does not matter that the amount sounds plausible; scammers pick amounts that sound like everybody's refund.

Our pattern examples, so you can recognise the family:

The safe check for anything tax-flavoured takes one phone call you make yourself: the ATO's scam line is 1800 008 540 — call it and describe the message, and they will tell you plainly whether it was theirs. You can also sign in to myGov the normal way and look in your real inbox; a genuine tax debt or refund issue lives there, with proper explanations and proper timeframes, not a 24-hour countdown. And if you received an ATO impersonation, forwarding it to [email protected] helps the ATO's team track the campaign. One more timing note: these texts also spike around the end of the financial year in June and July, so if you are reading this at tax time, be doubly unsurprised to receive one — and doubly calm about deleting it.

Bank and Telco Texts: Never Call the Number in the Message

Banks and phone companies complete the family. The bank text usually says your account is locked, a suspicious payment needs approving, or a new device has signed in — and it helpfully provides a number to call. The telco text says your bill is overdue, your service will be cut off, or your points are expiring. Both are built on the same engine: frighten you, then hand you a phone number — their phone number — where a polite, professional-sounding criminal answers as "the fraud department" and patiently talks you into moving your money "to a safe account". There is no safe account. That transfer is the theft.

The defence costs nothing and never changes: never call a number that arrived inside a text. Turn your bank card over and call the number printed on the back. Open your bank's official app from your home screen. For Telstra or Optus, open their official app or find the number on a paper bill you already have. A real bank's fraud team will confirm in a minute whether anything is wrong — and real banks actively praise customers who hang up and call back this way. It is what they train people to do.

Two refinements for this family. First, the codes: your bank will sometimes genuinely text you a one-time code when you are signing in — that is normal. What never happens is a bank calling or texting to ask you to read a code out. A code you read to someone else is a key handed over. Second, the family version: a text or call claiming a grandchild is in trouble and needs money travels by phone too, and voices can now be copied. Our family safe-word guide shows you the five-minute fix — one secret word a scammer can never guess. And before you ever ring an unknown number back, the five checks in our who called me guide will keep you safe there as well.

Already Tapped the Link? Your First 10 Minutes

Take a breath first. These texts reach millions of phones and are written by people who do this as a profession; tapping one does not make you careless — it makes you normal. What protects you now is order and speed. Work through this list top to bottom:

1. If you entered bank or card details: call your bank now. Use the number on the back of your card. Tell them exactly what happened and what you typed. They can freeze the card, watch the account, and stop payments — this call matters more than everything below it combined.
2. If you entered your myGov password: change it and call the helpdesk. Sign in through the official app or by typing my.gov.au yourself, change the password, then call the Scams and Identity Theft Helpdesk on 1800 941 126. They deal with this daily and will tell you what else to lock down.
3. If you gave personal details — date of birth, Medicare number, driver's licence, tax file number: call IDCARE on 1800 595 160. IDCARE is Australia and New Zealand's free national identity support service. A real person will build you a recovery plan.
4. If you paid money: report it at ReportCyber (cyber.gov.au) and to Scamwatch. Banks do sometimes recover funds reported within hours — which is why "later" is the only wrong time to do this.
5. Forward the text to 7726, block the number, and delete it. The steps for both are in the next section — two minutes, and that number's road gets harder.
6. Tell a family member today. Not as a confession — as a warning. Scammers often try the same household twice, and a family that talks about these attempts is remarkably hard to catch twice.

If all you did was tap the link and then close the page without typing anything, the risk is much lower — but still do steps 5 and 6, and run your phone's built-in security scan if it offers one. And if your phone starts behaving strangely afterwards — battery draining oddly, apps you do not recognise — have it looked at before you use it for banking again.

Forward It to 7726, Then Block the Number (Step by Step)

Reporting a scam text to 7726 — which spells SPAM on your keypad — costs nothing and takes under a minute. Your phone company receives it and uses it to block the campaign for everyone. Here is how, on both kinds of phone.

Forwarding a text on iPhone

1. Open the conversation in Messages — but do not tap anything inside the message itself.
2. Press and hold the message bubble until a small menu appears.
3. Tap More…, then tap the curved forward arrow at the bottom right.
4. In the "To" field, type 7726 and tap send. You may get a reply asking for the number the text came from — just type that number and send it too.

Forwarding a text on Android (Samsung and most others)

1. Open the conversation in Messages.
2. Press and hold the scam message until it is selected.
3. Tap the three dots (or the share icon) and choose Forward.
4. Send it to 7726. Menu names vary slightly between brands — if you see "Share" instead of "Forward", that works too. On many Android phones you can also tap Report spam directly in the conversation's menu, which forwards and blocks in one motion.

Blocking the number afterwards

On iPhone: open the conversation, tap the number or name at the very top, tap Info, then scroll down and tap Block this Caller. On Android: open the conversation, tap the three dots, choose Details (or "Block & report spam" if shown), then Block. Blocked numbers change — scammers rotate through them — so blocking is a good habit rather than a permanent wall. Think of it as closing a window: each one you close makes the house quieter, and combined with your phone's spam filter (see our guides to blocking spam texts on Android and stopping spam texts on iPhone), the noise drops to almost nothing.

Every Reporting Number in One Place

Bookmark this page, or print this section and keep it with the checklist. Every contact below was checked against the official source on the date at the top of this guide.

One warning about finding numbers: always take phone numbers from this table, from an official website you reached by typing its address yourself, or from your own paperwork. Never take a "help" number from inside a suspicious message, and never from a random page that pops up on your screen — scammers run fake helplines too. Our official safety resources directory keeps the trusted starting points in one list.

The Fridge Checklist: Stop. Forward. Block.

Print this page (your browser's print button keeps this section on one sheet) and keep it by the phone or on the fridge. Six lines are all most scam texts ever meet:

For a fuller wall-chart version — twelve checks covering texts, calls, emails and money requests — keep our senior scam checklist beside this one; together they cover every doorway a scammer uses.

For Family Members: Helping Mum or Dad From Another City

If you are the daughter in Brisbane with a mum in Cairns, the son in Perth whose dad forwards him every suspicious text "just to check" — this section is yours. You cannot stand between your parent and every message, but you can set up three things on one visit that do most of the guarding for you. First, the settings: turn on the phone's spam filtering and "filter unknown senders" so the worst of it never rings or lands in the main inbox — the two guides linked above walk through it brand by brand. Second, the apps: put the genuine myGov app and the Aus Post app on their home screen, side by side, and show them the only route they will ever need — "if a text worries you, close it and open the app with your own finger". A route practised twice, together, sticks.

Third, the agreement: make it a family rule that no money question is ever settled by a text — not a "locked account", not a "grandchild in trouble", nothing. Any of those means a phone call to a number the family already knows, or a call to you first. Say it as a game you are all playing against the scammers, never as a lecture about being careful; parents who feel trusted keep telling you what arrived, and that flow of "look what I got today" messages is the best alarm system a family can own. When one does arrive, use it as the friendly drill: forward to 7726 together, block together, and admire how the 30-second check caught it. That is how a parent becomes the person warning their friends at bowls — which, in the end, is how these campaigns die.

The 10-second version: a text about money with a link in it is not from myGov or the ATO — full stop. 'Unverified' means the name cannot be trusted, not that you should panic. Leave the message; check inside the real app.

The 3-minute routine: forward the text to 7726, block the number, delete it, and tell someone in the family.

The golden rule: never do what a text tells you. Do what you decide, through doors you open — the official app, the address you type, the number on your card.