The Most Expensive Breach in Australian Small Business Isn't a Hacker. It's a Handshake.

A stranger lodged her tax return. The refund went somewhere else. The responsibility stayed exactly where it was.

---

Sometime this winter, in a suburb you would recognise, a tax return was lodged for an Australian small business.

It was complete. It was on time. It went through without a murmur, because the person who lodged it was registered, credentialled, and authorised to act. The system did exactly what it was built to do.

The return was wrong in only two details. The owner had never seen it. And the refund was already travelling to a bank account she wouldn't have recognised.

I heard about her from an accountant I trust. She'd come to him as a new client, looking for advice, after her old agent stopped answering the phone and things started arriving in the mail that didn't make sense. He told me the story the way accountants tell these stories, quietly, with his coffee going cold. It took him an afternoon to piece together what had happened. By the time she was sitting across his desk, the agent was gone, the money was gone, and the one thing that hadn't gone anywhere was the responsibility.

I write about hackers for a living. Ransomware, phishing, the whole travelling circus of people who come in through the wires. This story doesn't have a hacker in it. Nobody broke anything. Every door was opened from the inside, politely, with paperwork.

That's what makes it worth your ten minutes.

What a tax agent actually holds

Think about it for a moment. Your tax file number. Your ABN. Your dealings with the ATO. A clear view of your income, your accounts, your family, your super. And the authority to lodge documents in your name that carry legal weight the moment they land.

A hacker would sweat for half of that. An agent is handed the lot at the first meeting, along with a coffee and a handshake.

And most of us hand it over the way we bought our domain name. Once, years ago, on a recommendation from someone at the club. And we never look again.

Most people read the terms on a parking app more carefully than the return lodged in their name.

I'd love to tell you her story was rare

Here's what the public record says.

The Tax Practitioners Board is the body that registers tax agents, and it publishes anonymised summaries of its enforcement decisions. Names removed, patterns intact. In one case, an agent lodged returns that were different from the ones his clients had signed, and over a few years redirected more than $650,000 of their refunds into his own accounts. In another, an agent put his own bank account on his clients' returns, collected the refunds, and kept them. The Board noticed he seemed to prefer older Australians. In a third, the refunds went into an account the agent controlled, and simply stayed there.

Decided cases. On the record. The regulator's own website.

The details change. The mechanism hardly bothers to. The keys were handed over, and nobody looked at what they were opening.

I know what you're thinking

Because it's what I'd be thinking. My accountant is honest.

And you're almost certainly right. The overwhelming majority of registered agents are careful, decent people, and some of the best allies a small business will ever have sit behind an accountant's desk. The man who told me this story is one of them.

But notice something. The honest ones want you to look. A good agent has nothing to hide in a lodgement, and knows it. The only person who benefits from a client who never reads anything is the person counting on it.

So the question was never whether your accountant is honest. The question is whether you've ever looked.

Trust that's never been checked isn't trust. It's habit.

The sentence the ATO wrote years ago

Here's the part that moves this from her problem to yours.

The ATO has a practice statement that's been sitting in its rulebook for years, and it says, in substance, that appointing a tax agent doesn't hand off your responsibility. You're still expected to ask questions about what's being reported in your name. The return is yours, whoever presses the button.

Almost nobody who signs an engagement letter has ever read that sentence. It reads differently once you have.

The return is yours. It always was. The only question is whether you've ever seen it.

Now, there is a protection in the law, and it's worth knowing exactly what it covers, because it's narrower than its reputation. It's called the safe harbour. If you gave your agent everything they needed and the agent failed to take reasonable care, you can be shielded from certain administrative penalties. Fair, and genuinely useful.

But it was written for the careless agent, not the crooked one. Where the trouble comes from an agent's recklessness or intentional disregard of the tax law, the protection doesn't apply. And either way, the tax itself, plus interest, stays payable. By you.

Read that again slowly. The one protection most owners have half heard of switches off in exactly the story I've just told you.

The law protects you from a careless accountant. It makes no such promise about a reckless or deliberate one.

How far can it go? Here is where her story stands today, and it's the reason my accountant friend told it at all. The returns were false. The refunds went to someone else. And the debt the whole mess left behind stands in her name, because that's what the rulebook says, and she can't pay it. So the business she built is now in the hands of liquidators, being wound up over money she never saw.

When a tax debt stands unanswered, the ATO's collection machinery is patient, formal and impersonal. Nobody publishes a statistic connecting agent fraud to businesses closing, so I won't give you one. I've just told you about one.

Her story reaches you the way it reached me: over a coffee, de-identified, on trust. That's precisely why the Board's published cases matter. They're the part of the pattern you can check.

Fifteen minutes a year

None of this asks you to distrust your accountant. It asks for three habits, none of which costs a dollar.

Check the register. The Tax Practitioners Board keeps a public register at tpb.gov.au. Is the person actually registered, and registered as what? Two minutes, no login, and you'll know more than the clients in every case above ever knew.

See it before you sign it. Never authorise a lodgement you haven't read. That declaration you sign exists for exactly this reason. And while the return is in front of you, glance at one line: the bank account the refund is going to. It's meant to be yours. In the redirection cases the Board has published, that one line sat at the centre of the crime.

Own the link. Since November 2023, a business with an ABN taking on a new agent, or changing what an existing agent can do, generally completes an agent nomination itself in the ATO's Online services for business. The agent can't do that step for you, and that's the whole point. The ATO brought it in after criminals were caught quietly re-pointing businesses' tax affairs to agents the owners had never heard of. You hold that key. While you're in there, switch on the notifications your ATO online services offer, so a lodgement in your name arrives as a ping on your phone rather than a surprise in the mail.

One honest note for the smallest operators, because you're a big part of the reason I wrote this. Sole traders are excluded from the mandatory nomination process. If that's you, the ATO doesn't currently ask you to approve a new agent link the way a company owner must. The register, the read and the refund account are your three strongest habits. Fifteen minutes a year. Worth every one.

The keys you haven't counted

This column usually worries about the people who come in through the wires. And all along, the same failure has been walking through front doors in a nice shirt: someone trusted, holding your keys, acting while nobody watched.

You can do everything in this Dispatch yourself, and I'd encourage you to. The register, the read, the refund account, the nomination. Fifteen minutes a year, no dollar required.

But here's what the woman in the accountant's office would tell you, if you asked her. The agent was never her only keyholder. There's the bookkeeper. The web person. The email account that resets every password she owns. The software her invoices live in. Each one was handed a key at some point, usually years ago, usually with a handshake, and counting them from the inside is genuinely hard, because from the inside they all just look like people you trust.

That counting is the whole reason the Ransomware Readiness Check exists. Ransomware is simply the loudest thing a stolen key can do; the check itself counts every key, loud or quiet. We sit down for thirty minutes, walk through who holds which of your keys and which doors they open, check whether the accounts that matter are properly locked and whether your backups would hold, then hand you a short plain-English list of what deserves your fifteen minutes first. It's a readiness check, not tax advice. It's also ours, so I'm hardly a neutral party; it costs $149 and you leave knowing. Understand your exposure. Know what matters most.

And a WISECLICK membership is the standing version of the same idea: the doors watched all year, and backups locked the moment they're written, so that one compromised key, whoever held it, is something you recover from rather than something that ends the story.

If the surprise has already arrived

If you suspect something has been lodged in your name that you never saw, here's the calm version of the next hour.

1. Log in to the ATO's online services yourself and pull your own lodgement history. Not through the agent. Yourself.
2. Check the bank account nominated for refunds on anything recent.
3. Review the agent's authorisation, and remove it if it shouldn't be there. You control that link.
4. Report it to the Tax Practitioners Board and the ATO. Both have channels for exactly this.
5. Ask a second registered agent to look over what was lodged. The honest majority of the profession is your best resource here.
6. If money has moved, call your bank early and get legal advice early. Early matters more than perfect.

Every step on that list can be done with a cup of tea beside you.

The handshake is still how good business gets done in this country. It always was. So shake your agent's hand this tax time. Then read what's going in under your name, glance at the account the refund lands in, and sign.

The handshake was never the problem. The looking away was.

---

Frequently asked questions

How do I check if a tax agent is registered?

The Tax Practitioners Board keeps a free public register at tpb.gov.au. Search the name or the company and it shows whether they're registered, in what capacity, and any conditions. Two minutes, no login. If the person preparing your return isn't on it, that's your answer.

Is it rude to ask to see my return before it's lodged?

No. It's the system working as designed. The declaration you sign says the information is true and correct, which is a strange thing to sign about a document you haven't read. Good agents expect the question, and most will happily walk you through the return if you ask. An agent who bristles at "can I read it first?" is telling you something.

What is agent nomination, and does it apply to me?

Since 13 November 2023, businesses with an ABN (other than sole traders) generally complete an agent nomination in the ATO's Online services for business whenever they engage a new tax agent or change an existing agent's authorisations. The agent can't complete it for you; the ATO built it that way deliberately. The agent then has 28 days to action your nomination.

I'm a sole trader. Does the nomination rule cover me?

No. Sole traders are currently excluded from the mandatory nomination process, which is exactly why the habits in this Dispatch matter more if that's you. Your strongest habits are the register check, reading before you sign, checking the refund account, and having ATO and myGov notifications switched on so nothing happens in your name silently.

If my agent lodges something dodgy, am I responsible?

The ATO's position, in its own practice statement, is that appointing an agent doesn't hand off your responsibility. You're still expected to ask questions about what's reported in your name, and the tax and interest on any shortfall remain payable by you. There is penalty relief in some circumstances, which is the next question.

What is the safe harbour, and when does it apply?

If you gave your agent all the relevant information and the agent failed to take reasonable care, you can be protected from certain administrative penalties. It doesn't apply where the problem comes from the agent's recklessness or intentional disregard of the law, and it never removes the underlying tax or interest. It's a shield against a careless agent's mistakes, not a dishonest agent's choices.

What do I do right now if something feels off?

Pull your own lodgement history from the ATO's online services, check the refund bank account on recent lodgements, review or remove the agent link, and report to both the Tax Practitioners Board and the ATO. Then have a second registered agent look over what was lodged. The full step by step is in the Dispatch above, and none of it needs to be done in a panic. And if a real debt has landed, the ATO runs payment plans and hardship support; a debt being real doesn't mean it's due in full tomorrow.

Does this mean I shouldn't use a tax agent?

The opposite. A registered agent is the right way to do your tax, and the honest majority of the profession are among the best allies a small business has. The point is narrower than that. Registered is checkable, lodgements are readable, and the refund account is one line. Use an agent. Just be the client who looks.

---

Stay protected, my friends.

— The Most Secure Man Alive