Securing Your MyGov Account from Takeover

The Risk of a MyGov Account Takeover

A MyGov account takeover occurs when an unauthorised person gains access to your account. This can lead to a range of severe problems, including identity theft, fraudulent claims, and redirection of payments. Once inside, criminals can change your contact details, access your personal documents, or apply for benefits in your name. The impact can take months, or even years, to fully resolve and can cause significant financial and emotional distress.

Scammers often use sophisticated phishing techniques, fake websites, or malware to trick you into revealing your MyGov login credentials. They might impersonate government agencies, banks, or even KNOMI, trying to convince you to share your username, password, or multifactor authentication (MFA) codes. Always be vigilant about unsolicited communications asking for personal details.

Strong Passwords and Usernames are Just the Start

The foundation of any strong cyber defence is a robust password. For your MyGov account, this means a unique, complex password that you don't use for any other service. It should be long, combine upper and lowercase letters, numbers, and symbols. Avoid easily guessed information like birth dates or pet names. Consider using a reputable password manager to generate and securely store these complex passwords.

While a strong password is essential, it's rarely enough on its own. Cyber criminals are adept at bypassing single-factor authentication. Always be suspicious of requests to confirm or change your password outside of the official MyGov website or app. If you ever suspect your password has been compromised, change it immediately and review your account activity for any suspicious logins.

Mandatory Multi-Factor Authentication (MFA) for MyGov

MyGov has mandatory Multi-Factor Authentication (MFA) to protect your account, which is a fantastic security measure. This means that even if a criminal gets hold of your password, they'll still need a second piece of evidence – like a code from your phone – to log in. MyGov offers several MFA options, and it's essential to set up one that works well for you.

The MyGov Code Generator app, available on Android and iOS, is generally considered the most secure and convenient option because it generates codes directly on your device, even without an internet connection. SMS codes are also offered, but are slightly less secure due to risks like SIM-swap fraud. Make sure your nominated phone number for SMS codes is current and secure. Always double-check any SMS codes you receive are for an action you are actually performing.

Recommended MyGov MFA Options:

• MyGov Code Generator App: Best for security and convenience.
• SMS Codes: A viable option, but ensure your phone number is secure.
• Security Questions: A fallback, but choose unguessable answers.

Keeping Your Recovery Options Secure

Beyond MFA, MyGov provides recovery options in case you lose access. These often include security questions or a recovery contact method. Treat your security answers with the same secrecy as your password. Avoid using easily guessable information, and if a question is too common (e.g., 'What is your mother's maiden name?'), consider inputting a deliberately incorrect but memorable answer.

Regularly review and update your contact details and recovery options within your MyGov account. If your phone number or email address changes, update it promptly on MyGov. This ensures that any legitimate recovery processes will reach you and not fall into the wrong hands. Neglecting these details can make it much harder to regain access if you are locked out, or worse, allow a criminal to use them against you.

What to Do If You Suspect a MyGov Takeover

If you notice any unusual activity on your MyGov account – suspicious logins, changed details, or unexpected communications – act immediately. First, try to log in and change your password. If you can't access your account, contact Services Australia's MyGov helpdesk straight away. They can help you regain control and investigate the breach.

Beyond MyGov support, it's crucial to consider the broader impact. If your MyGov was compromised, other accounts could be at risk too. This is where KNOMI comes in. As your cyber first-responder, we can help you understand the extent of the breach, secure other online accounts, and guide you through reporting the incident to relevant authorities like ReportCyber, IDCARE, and your financial institutions. Calling KNOMI means you don't have to navigate a complex cyber incident alone.

After addressing the immediate security concerns, continue to monitor your financial statements, credit reports, and other online accounts for any signs of fraudulent activity. A MyGov compromise can be a gateway to broader identity theft, so ongoing vigilance is key.

Frequently asked questions