Australian Taxation Office faces cyber threats and credit card payment ban

The Australian Taxation Office (ATO) is facing two distinct operational challenges involving cybersecurity and payment processing.

In August 2026, the ATO confirmed that criminals are targeting the systems of tax professionals rather than the agency's own infrastructure. Attackers have utilized phishing emails, malicious links, and infected attachments to access client records and interact with agent portals. The Tax Practitioners Board has warned that these cyber incidents can lead to both first-party losses and the compromise of sensitive client data, such as tax file numbers and superannuation records.

Separately, ATO Commissioner Rob Heferen has announced that the agency will stop accepting credit card payments after November 30, 2026. This decision follows a national ban on payment card surcharges. Heferen stated that the agency can no longer absorb the merchant fees associated with credit card transactions, noting that these costs are currently borne by taxpayers. The move has drawn criticism from politicians Allegra Spender and Pauline Hanson, who argue that removing credit card options could negatively impact cash flow for small businesses.