There is a certain kind of dread when you wake up to a government account lockout. It’s not catastrophic, but it’s extremely unsettling, especially in the morning, and falls somewhere between a parking fine and an ATO phone call. Thousands of Australians experienced the same emotion this week when they received emails and texts from Services Australia alerting them that their myGov accounts had been “temporarily locked” because of questionable sign-in activity.
For many, the first thought was that something had gone horribly wrong. Maybe a hack. a leak of data. Perhaps con artists had already gained access. Given the amount of information hidden behind a myGov login, including Medicare records, tax returns, Centrelink payments, and superannuation details, it’s a legitimate concern. It’s not a small annoyance to lose access to that, or worse, for someone else to obtain it.
Services Australia took swift action to provide clarification. Hank Jongen, general manager, affirmed that myGov had not been compromised. He stated that the platform is still safe. What actually occurred is a more subdued and enduring issue that may be more illuminating about how we all handle our digital lives, but it doesn’t make for dramatic headlines. Credential stuffing attacks, which involve feeding stolen username and password combinations—obtained from unrelated data breaches elsewhere—into myGov’s login page to see what sticks, were being carried out by criminals.
More often than most people would like to acknowledge, it works. According to one survey, about 81% of users reuse their passwords on different websites. Therefore, when credentials from a streaming service or retail loyalty program are compromised and leaked onto the dark web, criminals don’t stop there. They attempt the same combinations on government services, banking portals, and any other location where there may be a greater payout. Considering what it contains, myGov is a clear target.
Therefore, the lockout was precisely what the system was intended to do. An automatic block was set off after too many unsuccessful login attempts. As an extra precaution, mobile numbers and email addresses were not allowed to be used for sign-in. It’s a sensible answer. However, a security system that protects you by abruptly cutting off your own access is a little unsettling.
This is where things really get complicated, and it’s worth pondering for a while. The structure and tone of the genuine lockout notification that Services Australia sent are strikingly similar to the phishing messages that con artists have been sending for years. Even spoofing the sender ID allows fraudulent SMS variants to enter the same message thread as authentic texts from Services Australia. You receive a legitimate lockout notice that appears to be a scam at the same time that con artists are sending phony copies of the same notice. Navigating this area can be challenging, especially for older Australians or those who are not as familiar with how these attacks typically operate.
Authorities have made it clear that you should not click on any login links that are sent to you via SMS. Users won’t be prompted to sign in via a link in authentic myGov communications. The official myGov app or manually entering my.gov.au into a browser are the safe ways to get back in. It’s straightforward advice, but when you’re under pressure, like when your account is locked or you’re not sure if you’ve been targeted, it’s simple to click on the link that’s already in your message thread.
Here, there seems to be a more general pattern that merits recognition. This type of attack has long been a predictable hunting season in Australia during tax season. Around July and August, when millions of Australians are actively using myGov to file returns or make check payments, attempts to stuff credentials tend to increase. It’s not arbitrary. Because they know that login activity will be high and that an unexpected lockout message will seem more plausible and urgent, criminals purposefully time these campaigns.
The lockout mechanism seems to have worked properly this time, so the logical conclusion is not to mistrust the system. Password reuse is still a real and mostly self-inflicted vulnerability. Most of these attempts would have been pointless from the beginning if myGov had a unique password in addition to the myGov app or a passkey. No one in particular is being criticized by that. The actual exposure simply tends to reside there.
