NDIS and myGov Scams: How to Protect Your Plan and Personal Information
NDIS and myGov Scams: How to Protect Your Plan and Personal Information
- October 14, 2026
A message about your NDIS plan can feel urgent, especially if it claims that funding or account access is at risk. Scammers exploit that concern by pretending to represent organisations you recognise.
In July 2026, the NDIA warned that criminals had accessed some NDIS accounts through myGov phishing and by persuading people to provide sign-in details.
Knowing what to check can help you respond confidently. This guide explains common warning signs, practical protection steps and where to get assistance if something goes wrong.
What is a phishing scam?
Phishing is an attempt to trick you into providing information or taking an action that benefits a scammer. A message may lead to a fake website designed to capture your login details.
Services Australia warns that criminals impersonate myGov and other government services through messages linking to convincing imitation websites. Entering your details can allow someone else to access your real account.
A useful habit is to pause before responding to any unexpected request involving your account. You do not need to solve the issue through the message that first alerted you.
Warning signs to look for
Treat an unexpected communication cautiously when it asks you to:
- Verify your account immediately.
- Provide a password or authentication code.
- Follow a link to prevent funding being stopped.
- Download software so someone can “help”.
- Keep the conversation secret.
- Act before you have time to check the request.
These are prompts to verify the situation independently. A message may contain familiar names or details and still need checking.
For example, imagine receiving a text claiming your NDIS payment is on hold. Instead of using its link, open your usual official account access route and check whether there is a corresponding notification.
Check the request independently
Close the message and use a contact method you already know is genuine. Open the official app or type the official website address yourself.
If you need to call, obtain the number from the organisation’s official website or your existing verified records. Avoid relying on the number included in the suspicious message.
Explain what you received and ask whether any action is required. You can also ask a trusted person to sit with you while you check, without giving them your password.
The aim is to create a pause between receiving a request and acting on it. myGov recommends checking that communication is genuine before opening links or responding.
Keep your passwords and codes private
Do not share your myGov or NDIS account password or authentication codes. Assistance with services should not require handing over your personal login.
The NDIA specifically states that providers do not need your myGov login or NDIS app and portal details to process claims or service agreements.
If someone says they need your login to fix an invoice, stop and verify the request through another contact.
Where someone is authorised to assist you, ask about the proper representative or consent arrangements. Keep help with decision-making separate from access to your private security information.
Check your NDIS statements and records
Make time to review the services charged to your plan. Compare invoices with your own calendar, support records or appointment notes.
Look for unfamiliar providers, incorrect dates, duplicated entries or hours that do not match what you received.
An unfamiliar charge may be an administrative mistake, so ask for an explanation. Keep a record of your question and the response. The NDIA recommends retaining service records and checking them against invoices and claims.
You could establish a regular review with someone you choose. Agree beforehand what they will help check and how your information will remain private.
What should you do if you clicked a suspicious link?
Stop interacting with the page. Do not enter further information or follow additional instructions.
Services Australia advises contacting its Scams and Identity Theft Helpdesk if you opened a suspicious link, provided personal information or downloaded a fake app. The number is 1800 941 126.
Explain what happened as accurately as possible: whether you only opened the page, entered a password, shared a code or installed anything. Those details help determine the appropriate response.
You do not need to prove that fraud occurred before asking for help.
What if you shared a password or installed software?
Use the genuine service’s recovery process promptly. Change a compromised password through the official website or app, and change it elsewhere if you reused it.
If you installed unfamiliar software or allowed remote access, stop using that device for sensitive accounts until you have obtained appropriate technical assistance. Use another trusted device to contact the relevant services.
The Australian Government’s cyber security guidance provides recovery steps for scams and account compromise.
Write down what you remember while it is fresh, but do not delay protective action to collect perfect evidence.
What if money or identity information is involved?
Contact your bank immediately if you transferred money or exposed banking details. Explain that you suspect a scam and ask what protective action is available.
IDCARE can provide free assistance with an identity recovery plan. Scamwatch also warns about follow-up scams offering to recover money, sometimes in exchange for another payment.
Be cautious about anyone approaching you unexpectedly after the incident. Verify offers of assistance independently, even when the person appears to know what happened.
Where can you report the problem?
For concerns about your NDIS account or plan activity, contact the NDIA on 1800 800 110.
Services Australia accepts reports of impersonation scams at reportascam@servicesaustralia.gov.au. General scam reports can also be made through Scamwatch, and cybercrime can be reported through ReportCyber.
Keep screenshots, message dates and relevant transaction details where possible. Reporting helps document what happened, but should accompany immediate steps to protect affected accounts.
Support without blame
Scams can happen to anyone. If someone tells you they have shared information, focus first on helping them take the next step.
Avoid criticism or a long interrogation. Ask what happened, identify the affected account and help them reach the appropriate official service.
For participants who prefer accessible information, create a short reminder together: pause, use the official contact, and keep passwords private. Practise with a harmless example so the process feels familiar before an urgent-looking message arrives.
Staying informed with Concept Care
Concept Care encourages participants and families to raise concerns about unfamiliar service communications or charges.
If a message claims to come from our team and seems unusual, contact us using your existing verified details before responding. We can discuss questions about our services and direct account-security concerns to the appropriate organisation.
Protecting your information starts with giving yourself time to check. You should feel comfortable asking questions whenever a request does not make sense.