Fraudulent myGov Account Registration Impersonating Centrelink
Scammers use stolen identity details to register a myGov account in a victim's name before the victim does, granting access to Centrelink services and enabling benefit claims or payment redirections in the victim's name.
Part of: New Account Takeover
Last reviewed: 8 June 2026
Australia's myGov platform links to Centrelink, Medicare, and the ATO under a single login. For Australians who have never created a myGov account — including those who have recently become eligible for benefits — there is a window of vulnerability: an attacker who has enough personal details can register the myGov account first.
Once a fraudulent myGov account is created in the victim's name, the attacker can link Centrelink services, update banking details, and submit claims. The real owner of that identity may receive benefit payment notices for claims they never made, or find that their genuine claim is rejected because an account already exists.
The data needed to register a fraudulent myGov account — full name, date of birth, address, and Medicare number — is available from data breaches and can be supplemented by social engineering. Services Australia encourages all eligible Australians to create their myGov account proactively to prevent this pre-emptive fraud.
How this scam works on the Centrelink brand
The attack chain typically begins with a phishing campaign branded as Centrelink — a message about a payment increase, a new support scheme, or an account verification requirement. The phishing page harvests Medicare number, date of birth, and address, which are then used to register a myGov account.
Alternatively, breach data purchased from dark-web sources provides enough details to attempt registration directly. The attacker also requests a new Medicare card if the existing number is not sufficient to complete registration.
Victims discover the fraud in one of three ways: they attempt to register their own myGov account and find one already exists, they receive ATO or Centrelink correspondence about activity they did not initiate, or a family member notices unexplained government payment credits or debits.
Common red flags
- You attempt to create a myGov account and receive an error indicating one already exists under your details
- You receive a myGov notification email for a registration you did not make
- Centrelink or ATO sends correspondence about a claim, change of address, or payment you did not request
- A Medicare card or healthcare notice arrives at your address with a different account name
- Your Medicare number, date of birth, or address was requested by a page that appeared to be Centrelink but linked from an SMS
- You receive a tax file number confirmation for an application you did not submit
How to protect yourself
- Create your myGov account at my.gov.au now if you have not already, to prevent fraudulent pre-registration
- Enable myGov multi-factor authentication using the myGov Code Generator app
- Link your ATO, Centrelink, and Medicare services to your myGov account to centralise monitoring
- Report any unauthorised myGov account to Services Australia immediately at 1800 941 998
- Contact the ACSC if you believe your identity has been compromised
- Check your credit file with Equifax, Illion, and Experian Australia for unexplained applications
- Alert your GP if Medicare details may have been used
How to report it
- Report to Services Australia's identity fraud team on 1800 941 998
- Report to Scamwatch at scamwatch.gov.au
- Contact the ACSC at cyber.gov.au/acsc/report
- Report the phishing message to the original platform and forward SMS to 7726
- File a police report and request an event number for further identity-theft remediation
Frequently asked questions
How do I check if someone has already registered a myGov account in my name?
Go to my.gov.au and attempt to register. If the system indicates that an account already exists for your details but you did not create one, contact Services Australia's identity fraud team on 1800 941 998 immediately.
What can a fraudster do with a myGov account in my name?
They can link Centrelink and claim payments in your name, change ATO bank details to redirect tax refunds, access Medicare records, and apply for a Tax File Number. Each linked service adds a layer of potential financial and identity fraud.
Is creating a myGov account just to prevent fraud really necessary?
Yes, it is a recommended precaution. Just as the SSA in the US advises Americans to create their online account proactively, Services Australia recommends Australians register their myGov account before they need it, to prevent a fraudster registering first.