BAS Agents Beware:

A scammer may approach a BAS Agent using the name, ABN or publicly available information of a legitimate business they do not own, control or have authority to represent.

Their intention may be to:

• Gain access to the entity’s ATO records
• Lodge false information
• Change registration or contact details
• Redirect refunds
• Obtain confidential financial information
• Use the BAS Agent as a legitimate-looking link in a larger fraud

They may specifically target a 🥕 Registered BAS Agent providing BAS lodgment services because an agent can access information and systems that the scammer cannot access themselves.

The scammer does not necessarily need to sound nervous, confused or suspicious.

Artificial intelligence can now produce voices and conversations that sound remarkably human. An AI-generated caller may speak naturally, remain calm and predict what a genuine person in those circumstances would be expected to say next.

They may sound friendly.

They may understand bookkeeping and BAS terminology.

They may have an answer ready before you have finished asking the question.

A convincing conversation is not proof of identity.

An ABN is public information. Anyone can find an entity’s ABN, registered name and other business information through ABN Lookup.

A person repeating publicly available information has not proven that they own, control or are authorised to act for the entity.

An ABN alone will not pass our verification process.

Before accepting an engagement, we require the prospective client to provide the entity’s Tax File Number, where applicable, together with the other information required to verify both the person and the entity.

The TFN must be collected, used and stored securely in accordance with the Privacy (Tax File Number) Rule 2015. It should not be entered into an unsecured public form or sent casually through an unprotected communication channel.

Even possession of the TFN is not automatic proof that the person is genuine. TFNs can be obtained through identity theft, compromised email accounts or data breaches.

The TFN is an important part of the verification process, but it must be checked together with other identifying information and evidence of authority.

Before providing any BAS Agent service, there are three separate matters to verify:

1. The identity of the person approaching you.
2. The identity of the entity they want you to act for.
3. The person’s legal authority to engage you for that entity.

Client-to-agent linking does not replace these checks. It does not, by itself, prove the identity of the individual who contacted your practice.

Before accepting the engagement, obtain and independently verify:

• The entity’s full legal name
• The entity’s TFN, where applicable
• The entity’s ABN and ACN, where applicable
• The individual’s full legal name
• The individual’s date of birth
• The individual’s residential address
• Primary photographic identification
• The person’s position within the entity
• ASIC company and officeholder information
• Trust deeds, partnership documents or other governing documents
• Board authority or written authorisation, where relevant
• Evidence of the person’s authority to appoint a BAS Agent
• Business telephone numbers and email addresses
• Bank account evidence, where relevant to the work
• Contact details that can be checked through an independent source

The more legitimate and independently verifiable information you request, the harder it becomes for an impersonator to maintain a false story.

Do not rely only on documents supplied by the caller. Identification documents, business records, email chains, voices and even video can potentially be altered or artificially generated.

The ATO publishes specific 🥕 client verification methods for tax and BAS agents.

Stop and investigate if the enquiry involves:

• An urgent BAS lodgment or amendment
• An entity you cannot independently connect to the caller
• Pressure to begin before identity checks are completed
• A request for immediate access to ATO information
• A person who refuses to provide the entity’s TFN
• Contact details that do not match the entity’s existing records
• A new or unrelated email address
• Identification that cannot be independently verified
• A caller who avoids a video meeting
• Requests to change bank account, contact or refund details
• Resistance to providing evidence of authority
• Explanations that sound convincing but cannot be supported by evidence

Urgency does not override verification.

If something does not feel right, independently locate the business’s established contact details and contact the entity directly.

Do not automatically use the telephone number, email address or website provided by the person who contacted you. Find an independent source wherever possible.

Ask whether the person is authorised to represent the entity and whether the business has requested BAS Agent services.

Do not reveal any private information during that conversation. Your purpose is to verify the person’s identity and authority—not to confirm information held by the ATO or disclose anything found in the entity’s records.

A genuine business owner should understand why a professional 🥕 bookkeeping and BAS Agent practice must complete these checks.

If you suspect that the enquiry may be fraudulent, preserve as much information as possible, including:

• The caller’s claimed name and position
• Telephone numbers
• Email addresses
• Email headers
• Dates and times of contact
• The entity name, TFN and ABN supplied
• Documents provided
• Bank account details supplied
• Screenshots
• Voicemails
• Recordings lawfully obtained
• A written file note of what was said
• Details of any attempted client-to-agent nomination

Do not delete potential evidence until it has been preserved and you have received appropriate guidance.

If the suspicious activity involves someone impersonating the ATO, the ATO scam-reporting email address is:

ReportScams@ato.gov.au

If you receive a suspicious email claiming to be from the ATO, forward the entire email to that address.

You can also use the ATO’s 🥕 Verify or report an ATO scam service or telephone the ATO’s scam line on 1800 008 540.

Please note: this email address is specifically for ATO-related scams. Suspected identity misuse, tax fraud or fraudulent activity involving an entity may also need to be reported through another appropriate ATO, police or government reporting channel.

If the person sounds human but something about the conversation feels unusually controlled, polished or predictive, stop and ask:

• Who am I really speaking to?
• Can I independently prove their identity?
• Can I verify the TFN and the entity details?
• Can I prove their legal connection to the entity?
• Do they genuinely have authority to appoint me?
• Why do they want me to access or act for this business?
• What could they gain if I accept their story without checking it?

You do not need to accuse anyone of being a scammer.

You simply refuse to proceed until every identity, entity and authority check has been completed.

Do not mistake confidence for legitimacy.

Do not mistake a natural voice for a human caller.

Do not mistake detailed knowledge for authority.

Do not accept an engagement merely because the person knows the entity’s ABN, director’s name or registered address. That information may be publicly available.

Even possession of a TFN must be supported by proper proof of identity and evidence of authority.

Verify the person. Verify the TFN. Verify the entity. Verify their authority.

If the pieces do not fit, stop.

Protect your practice, your BAS Agent registration and the legitimate business whose identity may be under attack.

My Great Bookkeeper is a Registered BAS Agent practice providing 🥕 professional BAS lodgment services and 🥕 bookkeeping services for Australian businesses.