MyGov – Avoid your identity getting hacked on the government app and your phone
Some of you may scratch your heads and ask ‘what on earth is the My Gov app’?
It’s an app that gives customers a simple, secure and convenient way to connect with government, predominantly with services like Medicare and the ATO. Essentially it verifies your identity and then gives you access to these 2 very important government departments.
Many people actually do not like doing this and find it invasive to their personal privacy, however it seems that if you do not register your identity with this app then you are opening yourself up to identity theft! We will explain why and what we have seen happen to clients as an accounting firm.
Recently we have had clients who have had illegal tax refunds submitted to the ATO because a tax refund was requested via the MyGov app. In these instances the clients had never set themselves up on the MyGov app, this means that the hacker had been able to set the app up by supplying the correct identity checks required.
Unfortunately, the identity verification documents of many Australians have been compromised. The Optus hack of last year left the identities of 300,000 Australians compromised. And Optus has not been the only institution that has been hacked for this information. Other institutions including Medibank, Motor Car Rentals and a number of universities are included in the hacks on this website:
https://www.webberinsurance.com.au/data-breaches-list
Many of these places include all documents that are required for your identity checks such as:
- Medicare cards
- Drivers licenses
- Passports
So whilst it’s easy to assume that a tax refund fraud comes from a breach directly at the ATO, its actually more likely that it has occurred due to the fact that the documents commonly used to verify your identity have been stolen from somewhere else. And when looking at the vast number of breaches in the last 2 years alone, it would be prudent to work under the assumption that your proof of identity documents are compromised.
So lets come back to the MyGov app – something that understandably not everyone wants to have on their phone! The problem here is that by NOT having it, any hacker that has accessed your documents can create an account on your behalf. On the other hand if you have already downloaded it and confirmed your own identity, then a hacker cannot create a duplicate account for the same person. In this way, the government has sadly and inadvertently found a way to force us to use the app. So our advice to you now is that you need to register yourselves with MyGov and go through the identity checks so that your legitimate account blocks a hacker from doing it on your behalf.
Further to this, the account with MyGov requires additional security with the options of using an authenticator app, a text message or security questions. Once these are set up, the only way a hacker can get into your account is if they get their hands on your mobile phone (with exception of the security questions). We strongly advise that you do NOT use the option of security questions as the answers to these may also be available to hackers or they may be easy to guess.
But can a hacker get their hands on your phone? Yes this has happened as far as we know with mobile phone repair shops or where mobile phones get stolen or left behind on restaurant tables. Never hand your phone over to anyone! In spite of all these measures we have had clients lives turned completely upside down when they have left their mobiles at a phone repair shop. Somehow, access to their phones either intentionally or unintentionally by the phone repair shop compromised everything that was secured in their personal and business lives. Not only did they have illegal tax refunds lodged, but access was also granted to bank accounts, emails and anything else that had a password and 2 factor authentication. Our current suggestion is that if your mobile phone breaks, do not have it repaired – it contains the keys to your kingdom, so just pay the extra dollars and buy a new one.
What about if you lose or drop your mobile phone? There is a lot you can do about this by simply setting the screen to lock reasonably quicky if the phone is not in use. Once locked the phone cannot easily be opened by anyone in a hurry. Also have a “find my phone” app running on your phone which allows you to find its location and also completely erase all info on the phone remotely thus allowing you to render it useless if you can’t find it. Most phones have this app readily available.
Lastly, do not allow notifications to show up on a locked phone screen! This is a setting that allows people to view a summary of incoming text messages on a locked phone and is done for convenience. However, it also allows the viewing of SMS authentication codes on a locked phone, thus allowing a thief to view some of your 2 factor passwords. On most phones you can turn this feature off and suffer a small inconvenience in the interest of security.
