Fake myGov sites and NDIS fraud. How to keep your plan and your details safe

Federal police say they've found $235 million in actual or potential fraud against government agencies, the NDIA included, and part of it started with a text message and a fake myGov page. Half an hour this month can keep your plan and your details out of it.

The Zoomly team · · 4 min read

On 4 November the Australian Federal Police announced that five people had been charged after months of investigations into alleged fraud against the NDIA, Services Australia, Veterans' Affairs and the Department of Education. The ABC reported raids at 26 places in four states, with more NDIS providers still under investigation.

Three of the cases matter if you're on the NDIS or help someone who is:

  • Three men in Sydney allegedly used phishing texts and a fake myGov site to collect people's sign-in details, then redirected Centrelink payments. Police say there were more than 3,000 fraudulent transactions from March 2025.
  • An NDIA employee allegedly passed the records of 78 participants to providers she knew, without authorisation.
  • A man in rural Victoria allegedly took $700,000 from the NDIS over two years, using false invoices from two businesses he set up.

Nobody in these cases has been convicted. Between them they cover the three things worth protecting: your sign-in details, your personal information, and your plan funds.

It isn't the first warning this year. In late July the NDIA said criminals had got into some NDIS accounts through myGov, by phishing and by talking people into handing over their sign-in details.

What the scam messages look like

Services Australia says fake texts and emails often claim that:

  • an NDIS notification is waiting in your myGov inbox
  • your payments will stop unless you update your details
  • there's a problem linking the NDIS to your myGov account
  • a new plan or a payment is waiting in your portal.

The link opens a page that looks like myGov and asks for your username, password, codes, ID or bank details. Services Australia won't send you a link to sign in to myGov, and the NDIA says it will never ask for your personal details by SMS.

One rule covers all of these: never sign in from a link. Open the myGov app, or type my.gov.au into your browser yourself. If the message was real, whatever it mentioned will be waiting there too.

Lock down your myGov account

myGov describes passkeys as a more secure alternative to passwords. A passkey uses your phone or computer's face, fingerprint or screen lock to sign you in, so you don't type a password that a fake site could collect. You can set one up under Account settings in myGov, on a device you own and don't share. Once it works, myGov suggests turning off your password as a sign-in option.

myGov also advises:

  • Don't share your username, password or sign-in codes with anyone, family included.
  • Use a long passphrase that you don't use anywhere else.
  • Check your account history for anything you don't recognise.

Check what's being claimed on your plan

The NDIA's advice is to check your NDIS account regularly for unusual activity, and to look for payments for services you didn't ask for or didn't get. Keep an eye on your bank account too.

If the NDIA manages your funding, record the providers you use regularly as "my providers". When a provider who isn't recorded makes a claim, the NDIA checks with you by SMS before it pays. For plan managers and support coordinators, a claim from a provider who isn't recorded is rejected outright. If you're plan managed or self-managed, read every statement and compare it with what you agreed in your service agreement.

The 90 day claiming limit starts on 1 December, so claims should land much closer to the day of the support. That makes an odd one easier to spot while you still remember the week.

If you work in disability support

Support workers, support coordinators and plan managers see a lot of personal information. The NDIS Code of Conduct applies to registered and unregistered providers and their workers, and it includes respecting the privacy of people with disability. Names, addresses and NDIS numbers stay with the people who need them.

You're also often the first person a participant shows a strange text to. Help them check it the safe way: open the myGov or my NDIS app together, and leave the link alone.

If something looks wrong

  • You clicked a link or shared details. Change your myGov password, or set up a passkey, straight away. IDCARE gives free help on 1800 595 160, Monday to Friday, 7am to 7pm AEST.
  • You got a scam message or see a claim you don't recognise. Call the NDIS Fraud Reporting and Scams Helpline on 1800 650 717, Monday to Friday, 9am to 5pm AEST, or use the NDIA's online tip-off form. You can report anonymously, and a family member, friend or nominee can report for you.
  • A scam email pretends to be myGov or Services Australia. Forward it to reportascam@servicesaustralia.gov.au.
  • You're worried about the quality or safety of a support. Contact the NDIS Quality and Safeguards Commission. In an emergency, call 000.

International Fraud Awareness Week runs from 15 to 21 November. Set up the passkey, read last month's statement, and save 1800 650 717 in your phone.

Where this comes from

Need a lift, a Support Partner, or both?

Zoomly books accessible transport and Support Partners across Penrith and the suburbs around it, often on the same day. Tell us what you need and a person comes back to you.

Tell us what you need How Zoomly works

More from News

All articles

Accessibility