Some of your most sensitive information is stored in your myGov account. We trust those details are secure.
The reality is somewhat different.
Thousands of myGov accounts are being suspended monthly and losses from scams in Australia this year have passed $3 billion, according to reports. As a result, the government is set to introduce passkeys, such as face or fingerprint recognition instead of usernames and passwords, to thwart scammers.
Government services minister Bill Shorten says there have been 4500 individual confirmed myGov scams this year. myGov hosts Centrelink, Australian Tax Office and Medicare data.
An overwhelming number of those attacks come via what is called ‘scam-in-a-box kits’.
What is a ‘scam-in-a-box kit’?
The kits are bought and sold on the dark web and used to create fake websites to launch phishing attacks on myGov accounts.
Mr Shorten explains: “These fake sites trick our citizens into giving criminals their user ID and passwords.”
Scammers send a text to victims – purportedly from myGov – telling them they are eligible to apply for an ‘economic support payment’ or a ‘tax refund’. It then instructs the victim to provide their banking details before the payment expires and shares a link for a form. The form takes the victim to a fake website that extracts sensitive login or crucial ID information.
Scammers are increasingly attracted to Australia because many reuse passwords, thus reducing the effort needed to gain access to several accounts.
Mr Shorten said: “Statistics show that people reuse passwords at least 50 per cent of the time, making it possible for scammers and hackers to use the stolen password to access other online services.”
The sophistication of ‘scam-in-a-box’ kits is alarming, with some criminals able to quickly close scams to avoid detection and run multiple scams at once.
The Guardian reports that some scammers can identify when they’re dealing with more IT-savvy users and, in those instances, direct them to the official myGov website.
What is the government doing?
Increasing amounts of stolen identifying details are ending up on the dark web, Mr Shorten said, while stressing that the government was working around the clock to counter scammers and hackers.
“The Albanese government is determined to disrupt malicious actors by bolstering online defences,” he said.
“I am also working closely with my ministerial colleague, Senator Katy Gallagher, to establish a digital ID that will be a key line of defence against cybercrime when established.”
Next year, the government will introduce passkeys to make it much harder for scammers to gain access.
“Passkeys will be introduced to bring myGov further into the 21st century, allowing Australians the ability to use biometric options such as facial recognition to access the site,” Mr Shorten said.
“These important sign-in alternatives are familiar to many Australians, and are a key safeguard against scammers who use phishing tactics to harvest personal information like people’s date of birth to fraudulently access accounts.”
Digital ID verification is being added into myGov and a draft bill would put limits on the storage of customer IDs for businesses and set new regulations for data breach reporting.
It would be initially regulated by the Australian Competition and Consumer Commission (ACCC) and the Australian Information Commissioner.
Mr Shorten also said a new advisory group would be formed to ensure myGov put customers first. The group had been recommended by a user audit of the service and will be led by former NSW minister for customer service and digital government Victor Dominello.
Scamwatch warns users of myGov that the official website will never ask them to click on links to sign in to their accounts and enter their bank details or submit any ID docs. It advises users to use the secure myGov app to check their accounts.
Have you created a myGov ID yet? Do you have faith in the new security measures set to be introduced? Share your thoughts in the comments section below.
Also read: Platforms must step up on scam ads, says consumer advocate
What will happen if one does not have a computer that can do finger print or facial recognition
I changed my password last week and also have digital recognition as it is safer plus I sometimes forget my passwords…
So now that people have been scammed the government is going to make MyGov safe? Why didn’t they make it bulletproof before? I suppose it will be the same with a digital ID????
My phone doesn’t recognise my face and my IPad doesn’t recognise my finger print. Go figure….
Ditto, Lizzie. I would like to know how you would get a fingerprint opn your computer to be recognized