ATO took down 600 websites pretending to be ATO in the last year

AFR

The Australian Taxation Office has taken down about 600 websites impersonating the tax body to defraud taxpayers in the past year and is urging businesses to use specialist software instead of emails and PDFs when invoicing, to reduce the risk of criminals hacking in and tricking employees into paying money into false accounts.

ATO assistant commissioner and director of e-invoicing Mark Stockwell said hackers were constantly trying to breach the government agency for its data.

“It’s no question that we’re popular, not only because it is tax time, but I can’t tell you the millions of attempts [that] have tried to hit our firewall on a daily basis,” Mr Stockwell told a briefing held by the Australian Cyber Security Centre, the government’s lead agency for online security.

“It’s quite incredible how popular we are … but since they can’t get in, they try and impersonate us, setting up very sophisticated fake arrangements,” Mr Stockwell said. “It is getting more and more sophisticated every day, and just in the last 12 months we’ve taken down about 600 websites.”

The ACSC briefing centred around “business email compromise” (BEC), a form of cyberattack where scammers target employees of businesses, often impersonating someone senior in the company. Scammers often request information or action, such as paying an invoice that looks legitimate, but the account numbers have been changed to that of the criminal’s.

BEC can also involve the infiltration of a company’s email systems and send emails directly from a company account to appear more legitimate.

Mr Stockwell said an additional layer of security when dealing with government agencies was Gov ID, while nearly 2.3 million people had signed up with facial recognition security.

When dealing generally with invoices, however, Mr Stockwell said there was still a large risk for businesses. He said e-invoicing was one way the ATO was trying to take email out of the equation for business transactions and dealing with the government.

Opportunity for fraudsters

“There’s about $1.2 billion in invoices per year transacted through the Australian economy – there’s a lot of opportunity out there for fraudsters,” he said. “Ninety per cent of that goes through an email and a PDF attached to it, so it’s a very risky proposition.

“What e-invoicing is about is switching out so that you are dealing with software-to-software. You use your existing software that you use as a business today, the invoicing will be enabled within there, and you use that to actually transmit the data across to your trading partner and their software, so you’re in a secure environment when doing that.”

There were four layers to the security of e-invoicing: the network is managed by the ATO; the information is fully encrypted; there are no emails; and, if fraud does occur, the ability to recover the data is easier.

Australian Federal Police cybercrime operations commander Chris Goldsmith said about one-third of the 67,500 cyberattacks reported to the Australian Competition and Consumer Commission in the past financial year related to fraud and BEC, including invoicing fraud and employee impersonation.

The ACCC estimates only 13 per cent of attacks are reported. A Business Email Compromise taskforce, known within the AFP as Operation Dolos, was established in 2020, teaming up with law enforcement agencies in Europe, the UK and US.

“In July 2021, we saw an Australian financial firm fall victim [to BEC]. They received a falsified invoice for over $600,000. The finance area paid that invoice thinking they were paying a legitimate invoice that they received from a business that they normally deal with,” Mr Goldsmith said.

“That $600,000 has been sent into accounts controlled by criminals. The criminals then very quickly laundered those funds, converting it into gold bullion, cryptocurrency, cash withdrawals and other payment mechanisms.”

The AFP partnered with NSW Police and Victoria Police to investigate the fraud, and in April this year identified and arrested a person who was laundering the money, recovering $140,000.

“That case study really highlights how quickly and easily companies can fall victim to this type of scam,” Mr Goldsmith said.

Scams