NDIS scams: how to protect your myGov and NDIS account

Scammers are targeting NDIS participants. Some try to get your myGov or NDIS login details. Others pretend to be the NDIS and ask you to update your bank details. This Easy Read guide explains what to look out for, how to keep your account safe and what to do if something goes wrong.

What is happening?

In July 2026, the NDIA (the agency that runs the NDIS) said cyber criminals had used myGov to get into some NDIS accounts. They did this through “phishing” and by persuading people to hand over their login details.

Phishing means a fake email, text or website that looks real. It tries to trick you into typing in your password or personal details.

The NDIA says it is adding extra security and working with Services Australia, which runs myGov. It says it will tell you if it finds evidence your myGov account has been compromised.

Fake messages about bank details

The NDIA has also warned about fake emails made to look like a provider newsletter. They asked participants to sign in to the NDIS portal to update their bank details. The link went to a fake website that asked for login details.

The NDIS says it will never ask you to click a link to update bank details through email, text message or a direct message on social media. It also says it will never ask for your personal details by SMS.

Changes to how bank details are updated

To reduce fraud, the NDIA is limiting who can see and change participants’ bank details. It has added extra security checks for things like updating bank and personal details.

• When you contact the NDIA to update your details, you may be sent a one-time code by email or text. They will ask you to read it back to them.
• You can also update your details yourself in the NDIS portals.
• If you don’t use the portals, you can call the National Contact Centre or visit an NDIS office.

Remember: a real one-time code is only used when you have contacted the NDIA. Never give a code to someone who contacts you out of the blue.

How to keep your account safe

The NDIA suggests you:

• check your NDIS account for unusual activity
• check your plan funds for payments for services you did not ask for or did not get
• keep an eye on your bank account
• don’t click suspicious links
• don’t share passwords, SMS codes or personal information with anyone you don’t know or trust
• change your passwords regularly
• turn on multi-factor authentication where you can (this means a second check, like a code, when you sign in).

It also helps to be suspicious of any message you didn’t expect, especially if it is urgent or asks for your details.

If you think you clicked a scam link

• Go to the NDIS participant portal through myGov or the my NDIS app (not through the link). Change your NDIS and myGov login details as soon as you can.
• Check that your bank details, phone number and email are correct. If not, contact the NDIS.
• If money or details were taken, contact your bank straight away and ask them to stop any transactions.
• IDCARE offers free support if your identity has been misused. Call 1800 595 160.

Where to report a scam

• NDIS Fraud Reporting and Scams Helpline: 1800 650 717
• NDIS National Contact Centre: 1800 800 110
• Scamwatch: report suspicious contact online
• If anyone is in immediate danger, call 000.

What you can do now

• Turn on extra sign-in security for your myGov account.
• Look at your plan spending in the portal or app this week.
• Save 1800 650 717 in your phone.
• Talk to family or support workers about how scams work.
• Ask your plan manager or support coordinator to help you check for anything unusual.

Where to read more

• NDIS: Cyber criminals and myGov accounts
• NDIS: Updating bank details
• NDIS: Scam alert about bank detail emails
• Scamwatch: Report a scam

Information correct as at 31 October 2026. This is general information, not advice about your plan.