Compromised TFN: Protect Your Client’s Tax Records

If your client reports a compromised TFN, contain the exposure and contact the ATO’s Client Identity Support Centre on 1800 467 033. Check for unauthorised changes before the next lodgment. An exposed number needs attention even when you have found no misuse.

Separate Exposure From Confirmed Misuse

Establish what happened before describing the incident as fraud. Record when the exposure occurred, when your practice learned about it and how the client discovered it. Confirm the report through a contact method you already trust, especially if it arrives from a changed email address.

An exposed document and an unknown tax return need different evidence. Keep these distinctions in the incident record.

What you observe	What to establish	Immediate response
A document containing a TFN reached the wrong recipient	Which document, recipient and other personal details were involved	Restrict further access and preserve delivery evidence
A return appears that the client does not recognise	Whether your practice or a previously authorised agent lodged it	Preserve the return details and report suspected misuse
Bank or contact details have changed	Whether the client authorised the change through a verified channel	Record the discrepancy and raise it with the ATO
The client cannot access their ATO account	Whether an ATO safeguard or another access problem explains the restriction	Ask the ATO for the authorised access route

Possession of a TFN alone does not prove that someone lodged a fraudulent return. It also gives staff no authority to cancel or replace the number. The ATO assesses the exposure and the response needed.

A successful TFN format check cannot establish who owns the number or whether someone has misused it. If the client has also lost their copy, finding an issued TFN is a separate task. It does not resolve the exposure. Use the TFN handling guide for the wider collection and record-handling rules.

Contain the Practice’s Copy and Access

Restrict access to the affected document or account while preserving the evidence needed to assess the incident. Stop forwarding the TFN in ordinary email. Keep the original message, delivery details and relevant access records in a restricted evidence folder.

Assign a practice incident owner to establish whether the exposure involves client-held information, practice-held records or both. The registered agent handles enquiries within the client’s authority. Staff who receive the report can preserve evidence and escalate it without accessing accounts beyond their permissions.

For a shared document, withdraw the exposed sharing link and record who could access it. If an account is compromised, involve the practice’s IT support to secure access and preserve logs. Avoid deleting the only copy of evidence while trying to contain the incident.

The TPB’s TFN communication guidance recommends secure transmission and identity checks before disclosing a TFN by phone. Ask the client to use your secure document channel for supporting records.

Tax Genie keeps TFNs masked until an authorised staff member reveals one and records every reveal. TFNs stay out of its emails, exports and generated documents. Tax Genie removes every TFN before AI review. These safeguards reduce unnecessary TFN handling. The ATO’s protection response addresses suspected identity misuse and the affected tax account.

Use the Authorised ATO Protection Route

Report suspected TFN theft or misuse promptly through the ATO’s identity-theft assistance route. The Client Identity Support Centre number is 1800 467 033, available Monday to Friday, 8 am to 6 pm AEST.

1. Arrange the client’s report. The client explains the suspected exposure or misuse and completes the personal identity checks the ATO requires. They keep their myGov password and security codes private.
2. Establish the agent’s authority. Use your own authorised agent access and explain your role when contacting the ATO. An agent can report a practice-held data breach and request guidance on protecting affected client accounts.
3. Describe the evidence. Explain what was exposed and any suspicious lodgment or account change. Ask the ATO which identification documents it needs and how to supply them securely.
4. Record the instructions. Keep the case reference, required evidence, responsible person and next action. Confirm any access restrictions or extra checks that affect the client’s next lodgment.

The ATO’s guidance for tax professionals distinguishes additional identity checks from wider account restrictions. An additional identity alert for the client does not prevent the authorised agent from dealing with the ATO. Other safeguards can restrict online access or delay processing.

The ATO can apply additional monitoring and security measures according to the incident. Ask which measures apply to this client. Do not promise an automatic replacement TFN or assume that a new identifier ends the investigation.

Check Tax Records for Unauthorised Changes

Compare the client’s ATO records with records they authorised before changing disputed information. Use your authorised agent access, or have the client inspect their own account where access remains available.

Check contact details and refund destination accounts against verified client instructions. Compare lodged returns and amendments with your lodgment records. Review relevant notices and account transactions for amounts or activity the client does not recognise.

For an unknown return, retain its income year and lodgment details with the client’s account of why it is disputed. Ask the ATO to investigate the suspected unauthorised lodgment. Do not lodge an amendment merely to remove a return the client says they never authorised.

For a changed bank account, preserve the displayed details and the prior authorised instructions securely. Report the suspected fraudulent change to the ATO before treating it as an ordinary client update. Confirm the correct account through a trusted channel.

If access is unavailable, record the error and ask the ATO whether a protective restriction applies. Follow its instructions for legitimate access and lodgment. Repeated sign-in attempts or the client’s shared credentials are not an authorised workaround.

Resume Client Work With Recorded Safeguards

Resume affected account work when the ATO has provided the next action and you can carry it out through authorised access. Every unresolved suspicious return or transaction needs a named owner and follow-up time. Successful sign-in alone does not establish that all disputed records have been corrected.

Keep an incident summary without reproducing the TFN. Record the case reference and evidence location, the ATO’s instructions, who reviews the account and when the client receives an update. Confirm any further identity or lodgment checks before submitting the next return.

If practice-held information caused the exposure, activate your practice data breach response plan. The TPB’s NDB guidance confirms that TFN recipients are covered to the extent TFN information is involved. A small practice cannot assume it is exempt solely because of turnover.

Under the OAIC’s breach assessment guidance, a suspected eligible breach needs prompt assessment. Take all reasonable steps to complete it within 30 calendar days. An eligible breach involves unauthorised access, disclosure or loss likely to cause serious harm, where remedial action has not prevented that risk. Notify the OAIC and individuals at risk as soon as practicable unless an exception applies.

The TPB’s confidentiality duty also applies. Separately assess whether you have reasonable grounds to believe there is a significant breach of the Code of Professional Conduct. Where the TPB’s breach reporting obligation applies, report within 30 days of first having, or being expected to have, those grounds. Keep this decision separate from the OAIC assessment.

Before closing the client incident, confirm the assigned staff member has completed the ATO’s instructions. Leave any remaining dispute open with its owner and next follow-up recorded.