Can you prevent a hack?

Clarke McEwan Accountants

Can you prevent a hack?

In the wake of the Optus data leak, legislation before Parliament will lift the maximum fine for serious or repeated breaches of the Privacy Act from $2.2m to up to $50m. But there are no guarantees that even the strongest safety measures will prevent an attack. So, what does that mean for business and their customers?

Legislation before Parliament will lift penalties for serious or repeated privacy breaches, provide new powers to the Australian Information Commissioner, require entities to provide detailed data to the Information Commissioner to assess public risk, and give the regulator greater information sharing powers. In a statement, Attorney General Mark Dreyfus said, “When Australians are asked to hand over their personal data they have a right to expect it will be protected.” But the question is, can any business claim that customer data will be protected from hackers?

If a customer needs to disclose their personal information to your business to work with you, at the point the data is collected, your business is the custodian of that data. A duty of care exists from the moment the data is collected to the point the information is no longer required and destroyed.

The Privacy Act requires organisations to take “reasonable steps” to protect the data collected. ‘Reasonable’ steps “requires the existence of facts which are sufficient to [persuade] a reasonable person.” That is, in the event of a data breach, the business will need to prove the steps they have taken to protect client data.

Lessons from RI Advice

Australian Competition and Consumer Commission v RI Advice Group Pty Ltd was a landmark case. While specific to the obligations of an Australian Financial Services License (AFSL), it demonstrates that ASIC are willing to pursue not just companies that breach their duty of care but the directors and officers involved.

RI advice is a financial services company that, through its AFSL, authorised representatives to provide financial services. As you would expect, as part of providing financial services, the authorised representatives received, stored and accessed confidential and sensitive personal information. Between June 2014 and May 2020, nine cybersecurity incidents occurred at practices of RI Advice’s Authorised Representatives. Enquiries following the incidents revealed:

Computer systems which did not have up-to-date antivirus software installed and operating
No filtering or quarantining of emails
No backup systems or back-ups being performed; and
Poor password practices including sharing of passwords between employees, use of default passwords, passwords and other security details being held in easily accessible places or being known by third parties.

RI Advice took steps to manage their cybersecurity introducing a cyber resilience program, controls and risk management measures for its representatives including training, incident reporting, and contractual professional standard terms, but by its own admission, it took too long to implement.

RI Advice was ordered to pay $750,000 towards ASIC's costs. Handing down the decision Justice Rofe said, “It is not possible to reduce cybersecurity risk to zero, but it is possible to materially reduce cybersecurity risk through adequate cybersecurity documentation and controls to an acceptable level.”

Scams and how to avoid them

I got a text the other day “Hi Mum, I have broken my phone and I am using this number.” The “Hi Mum” scam has exploded with more than 1,150 Australians falling victim to the ploy in the first seven months of 2022, with total reported losses of $2.6 million. Once the scammer establishes contact, they start requesting money for an urgent bill or a replacement phone etc. For those with children or dependant family members, it is not that hard to believe. According to the Australian Consumer and Competition Commission (ACCC), two-thirds of family impersonation scams were reported by women over 55 years of age.

Another common scam is the lost or unable to deliver package texts and voicemail. With Christmas just around the corner, we can expect to see another escalation of this scam where tracking links purportedly from Australia Post, Toll, or Amazon etc., are used to instal malware. Once accessed, the malware will access your contacts and spread the malware and potentially access your personal information and bank details.

In July, the Australian Taxation Office (ATO) reported a new wave of ‘Tax refund SMSF scams’. The texts purported to be from the ATO stating that the individual had a tax refund and to click on the link and complete the form. Another scam purporting to be from the ATO advised that the recipient was suspected of being involved in cryptocurrency tax evasion and requested that they connect their wallet. At which point the wallet was accessed and any assets stolen.

The ACCC’s Targeting Scams report states that in 2021, nearly $1.8bn in losses were reported but the real figure is likely to be well over $2bn.

The largest combined losses in 2021 were:

$701 million lost to investment scams with 2021 figures significantly increased by cryptocurrency scams - more scammers are seeking payment with cryptocurrency and losses to this payment method increased 216% to $84 million.
$227 million lost to payment redirection scams.
$142 million lost to romance scams.

Protecting yourself from scams

Help educate older relatives. The over 55s are the most likely to fall victim to a scam.

Always use the primary website or app of your suppliers not a link from a text or email.
Don’t click on links from emails or text messages unless you are (absolutely) certain of the source. For email, if the sending email domain is not clear or hidden, hover over the name of the sending account to check if the email is from the company domain.
For Government services, use your MyGov account. Any messages to you from the ATO or other Government services need will be published to your MyGov account. Never click on links purporting to be from a bank, ATO or Government department.

Protecting your business from scams

Payment redirection scams, where the email of the business is compromised, caused the highest reported level of loss for business in 2021 at a combined $227 million.

Payment redirection scams involve scammers impersonating a business or its employees via email and requesting an upcoming payment be redirected to a fraudulent account. In some cases, scammers hack into a legitimate email account and pose as the business, intercepting legitimate invoices and amending the bank details before releasing emails to the unsuspecting business. Other times, scammers

impersonate people using a registered email address that is very similar to one from a legitimate business.

Educate your team about threats and what to look out for, the importance of passwords and password security, and how to manage customer information. Phishing attacks, if successful, provide direct access into your systems.
Ensure staff only have access to the business systems and information they need. Assess what is required and close out access to anything not required. Also assess how customer personal information is accessed and communicated. Personal information should not be emailed. Email is not secure and it is too easy for staff to inadvertently send data to the wrong person.
No shared login details or passwords.
Complete a risk assessment of your systems and add cybersecurity to your risk management framework.
Develop and implement cyber security policies and protocols. Have policies and procedures in place for who is responsible for cybersecurity, the expectations of staff, and what to do in the event of a breach. Your policies should prevent shadow IT systems, where employees download unauthorised software.
Understand your organisation’s legal obligations. For example, beyond the Privacy Act some businesses considered critical infrastructure such as some freight and food supply operations are subject to the Security of Critical Infrastructure Act 2018. This might involve small businesses in the supply chain.
Use multifactor authentication on your systems and third-party systems.
Update software and devices regularly for patches
Back-up data and have backup protocols in place. If hackers use ransomware to lock your systems, you can revert to your backup.
If customer data is being shared with related or third parties domiciled overseas, ensure your customer is aware of where their data is domiciled and your business has taken all reasonable steps to enforce the Australian Privacy Principles. Your business is responsible for how the overseas recipient utilises your customer’s data.
Only collect the customer data you need to provide the goods and services you offer.
Ensure protocols are in place for accounts payable.
Don’t forget the hardware – laptops, computers, phones.

< Older Post

Newer Post >

Specialist Accountants for Doctors and Medical Centres

Why Doctors Who Use Specialist Accountants Often Achieve Better Financial Outcomes

By Clarke McEwan • September 11, 2026

Specialist Accountants for Doctors and Medical Centres

Discretionary trusts and the proposed 30% minimum tax

By Clarke McEwan • September 8, 2026

Discretionary trusts, often referred to as family trusts, have been a popular structure for Australian families and businesses for many decades. They are commonly used to operate family businesses, hold investments and assist with succession planning. Their flexibility, together with asset protection and estate planning benefits, has made them an attractive option for many groups. In the 2026–27 Federal Budget, the Government announced a significant proposed change. From 1 July 2028, trustees of discretionary trusts would generally be required to pay a minimum tax of 30% on the trust's taxable income. According to the Government, the proposal is intended to better align the tax paid on trust income with that paid by salary and wage earners, while reducing opportunities to split income between family members. However, the announcement has generated considerable debate. Professional bodies, business groups and tax advisers have expressed concerns that the changes could increase complexity and compliance costs for many genuine family businesses and investment structures. How the proposal is expected to work Under the proposal, the trustee would generally pay the minimum 30% tax on the trust's taxable income. Where trust income is distributed to individual beneficiaries or certain other non-corporate beneficiaries, those beneficiaries would generally receive a non-refundable tax offset recognising the tax already paid by the trustee. This is intended to reduce the risk of the same income being taxed twice, but while maintaining the impact of the 30% minimum tax rate. Importantly, the minimum tax would not apply to every trust. The Government has indicated that a number of trusts would be excluded, including fixed trusts, widely held trusts, complying superannuation funds, charitable trusts, deceased estates, special disability trusts and genuine testamentary trusts. Primary production income and certain income relating to vulnerable minors would also be excluded. The Government has also stated that more than 90% of small businesses are not expected to be affected. While that may be reassuring for some taxpayers, there are still some important issues that could affect family groups using discretionary trusts. What could this mean in practice? One area likely to receive close attention is the use of companies as beneficiaries of family trusts. Many family groups have historically distributed some trust income to a company. This can provide flexibility in managing cash flow, retaining profits within the business and funding future growth. Under the proposed rules, however, the corporate beneficiary would not receive a tax offset for the tax already paid by the trustee. In many cases this will mean that income distributed from a discretionary trust to a company would be subject to double taxation. Another practical impact of the proposed change is that some family groups may find it more difficult to fully utilise existing tax losses. While the impact will depend on each group's circumstances, the proposed minimum tax is likely to reduce some of the flexibility that currently exists when managing taxable income across a family structure within many groups. The Government has also proposed a temporary three-year rollover period, commencing from 1 July 2027, to help restructure into alternative business structures, such as companies or fixed trusts, without triggering immediate income tax or capital gains tax consequences. While this may assist some groups, restructuring is rarely straightforward. Depending on the circumstances, it might be necessary to consider things like stamp duty, loan approvals, financing arrangements, contract changes, licensing requirements and professional advice. Even relatively simple restructures can involve significant time and cost, so careful planning will be important. The rules are not yet final At this stage, the proposal remains subject to consultation. Treasury released a consultation paper in July 2026 seeking feedback on a range of design issues, including how the new rules would operate in different situations. Final legislation has not yet been introduced, meaning aspects of the proposal could still change before the rules become law. For this reason, most groups utilising discretionary trust structures should avoid making major structural decisions based solely on the announcement. Instead, it is sensible to monitor developments while considering whether existing structures are likely to remain appropriate if the proposal proceeds. What should you do now? For many families, discretionary trusts are about much more than tax. They can continue to provide valuable asset protection, succession planning and business flexibility. The proposed changes do not remove those benefits, nor do they prevent discretionary trusts from continuing to be used. However, the proposal does have the potential to change the tax outcomes for some family groups, particularly those with more complex structures or those that regularly distribute income to companies. With the proposed start date still some time away, there is an opportunity to pause and carefully understand how the changes may affect your circumstances and consider whether any planning or restructuring might be appropriate. As the legislation develops, we can help you assess the impact on your business or investment structure and determine whether any action is warranted.

New reasonable travel and overtime meal rates

By Clarke McEwan • September 8, 2026

The ATO has released its updated reasonable travel and overtime meal allowance rates for the 2026–27 income year in Taxation Determination TD 2026/4. The overtime meal allowance has increased to $40.00, while the reasonable amounts for domestic and overseas travel have also been updated based on salary levels and travel destinations. Although these figures are widely publicised each year, they are often misunderstood. A common misconception is that employees can automatically claim a tax deduction up to the ATO's published rates. In reality, the rules are much narrower, and applying them incorrectly could lead to deductions being denied as well as interest and penalties. A travel allowance is the starting point The ATO's reasonable amounts only become relevant if an employee receives a genuine travel or overtime meal allowance from their employer. Generally, an allowance should: Be paid specifically to cover work-related travel or overtime meal expenses; Relate to particular work trips or overtime worked, rather than being a general additional payment; Be shown separately from normal salary or wages; and Be intended to help cover expenses the employee is expected to incur. If an amount has simply been built into an employee's normal salary package or is not identified as a separate allowance, the ATO's reasonable rates generally do not apply. Instead, the normal substantiation rules will usually apply to any deduction claimed. The reasonable rates are not an automatic deduction One of the most common misunderstandings is that receiving a travel allowance allows an employee to automatically claim the ATO's published rate as a tax deduction. This is not how the rules operate. Employees can generally only claim the amount they actually spend on deductible work-related travel or overtime meal expenses. The ATO's reasonable amounts simply mean that, in certain circumstances, employees may not need to keep a receipt for every specific expense. Importantly, the expenses must still have been incurred and they must relate to work-related activities. Good records are still essential Even where a genuine travel allowance has been paid, employees should still keep sufficient records to demonstrate that they incurred the expenses and that their claim is reasonable. Useful records may include: A diary recording work trips and overnight travel; Details of meals and incidental expenses incurred while travelling; Bank or credit card statements showing the expenses were personally paid; A representative sample of receipts; and Where travel involves six or more consecutive nights away from home, a travel diary recording the dates, locations and purpose of the travel. While receipts may not always be required, relying solely on the ATO's published rates without any supporting evidence could expose you to unnecessary scrutiny if your return is reviewed. Practical tips for employees and employers If you receive a travel or overtime meal allowance, it is worth checking that the arrangement satisfies the ATO's requirements before claiming a deduction. Some practical steps include: Review your payslip. Check that the allowance is separately identified rather than being included in ordinary salary or wages. Keep records throughout the year. Maintaining a simple travel diary and retaining some supporting documents is much easier than trying to recreate the information months later. Only claim what you actually spend. The ATO's reasonable amounts are not a target or standard deduction. They simply provide a benchmark for when the normal receipt requirements may be relaxed. Take extra care on longer trips. If you are away from home for six or more consecutive nights, additional travel diary requirements will generally apply. A little preparation can avoid problems later The updated reasonable amounts provide a useful guide for employers and employees during the 2026–27 income year, but they should not be viewed as an automatic entitlement to a tax deduction. Understanding how the rules operate, keeping appropriate records and claiming only genuine work-related expenses can significantly reduce the risk of problems if the ATO reviews your tax return. If you or your employees receive travel or overtime meal allowances, now is a good opportunity to review your current arrangements. We can help you confirm whether the allowances meet the ATO's requirements and what records should be kept to support any future claims.

Penalty units increase from 1 July 2026

By Clarke McEwan • September 8, 2026

From 1 July 2026, the value of a Commonwealth penalty unit increased from $330 to $364. While this may sound like a minor administrative change, it has a direct impact on many ATO penalties, increasing the cost of a range of compliance failures. A penalty unit is simply the method used under Commonwealth law to calculate many fines and administrative penalties. Rather than specifying a fixed dollar amount, the legislation often refers to a certain number of penalty units. As the value of a penalty unit increases, so too do the penalties that rely on it. The new value applies to breaches that occur on or after 1 July 2026. Earlier breaches continue to be assessed using the previous rate. Where the increase is likely to be felt Many of the ATO's administrative penalties are based on penalty units, meaning the increase flows directly through to the amount payable. Failure to lodge on time One of the most common penalties applies where tax returns, activity statements or other required documents are lodged late. The base penalty is generally one penalty unit for every 28 days (or part of 28 days) that a document remains outstanding, up to a maximum of five penalty units. For a small entity, this means the maximum base penalty has increased from $1,650 to $1,820. Higher penalties may apply to medium and large entities, while significant global entities are subject to much larger penalty amounts. False or misleading statements Providing incorrect information to the ATO can also result in penalties. Where there is no tax shortfall, the law provides for base penalties of 20, 40 or 60 penalty units, depending on the circumstances and the taxpayer's level of care. At the new penalty unit value, these base penalties have increased to $7,280, $14,560 and $21,840 respectively, before taking into account any reductions or increases that may apply. Self-managed super funds Trustees of self-managed superannuation funds (SMSFs) should also be aware of the higher penalty amounts. A range of SMSF administrative penalties are calculated using penalty units. For example, some breaches that previously attracted a penalty of $19,800 (60 penalty units) now carry a penalty of $21,840. Importantly, these penalties are generally imposed on each individual trustee rather than the fund itself. This means the total cost can increase significantly where a fund has multiple individual trustees, and the penalties cannot usually be paid from the assets of the superannuation fund. Other obligations, such as certain record-keeping requirements, tax invoice obligations and some superannuation guarantee penalties, may also be affected by the higher penalty unit value. Why this matters For most taxpayers, these penalties are entirely avoidable. Late lodgements, poor record keeping and incorrect information remain some of the most common reasons businesses and individuals incur ATO penalties. While the increase in penalty units may not seem substantial on its own, the cost can add up quickly where there are multiple outstanding obligations or repeated compliance issues. It is also worth remembering that ATO penalties are generally not tax deductible, meaning they must be paid from after-tax income. The good news is that the ATO will often consider remitting penalties (in part or full) where there are genuine mitigating circumstances, reasonable care has been taken, or a voluntary disclosure is made before the issue is identified by the ATO. Addressing problems early typically results in a better outcome than waiting until formal compliance action begins. Practical steps to reduce your risk There are several simple steps that can help minimise the risk of penalties: Lodge on time. Providing information to us well before due dates gives enough time to prepare accurate returns and meet lodgement deadlines. Keep good records. Accurate and up-to-date records make it easier to prepare returns correctly and support your tax positions if questions arise. Review your compliance regularly. If you operate a business or manage an SMSF, periodic reviews can identify issues before they become costly. Seek advice early. If you think you've made a mistake or have fallen behind with your tax obligations, speaking with us as soon as possible will generally provide more options than waiting for the ATO to contact you. A timely reminder The increase in penalty units is a timely reminder that the cost of tax non-compliance continues to rise. While the higher penalties are intended to encourage timely and accurate compliance, they also reinforce the value of good record keeping and proactive tax management. If you have any concerns about outstanding lodgements, record-keeping obligations or any other tax compliance matter, please contact us. We can help you address issues early and minimise the risk of unnecessary penalties.

SMSF and property – preparing for a smooth audit

By Clarke McEwan • September 8, 2026

For many SMSF trustees, property is one of the most significant assets held by their SMSF. Unlike personally owned assets, there is a legal requirement that all SMSF assets are valued each 30 June. This can be a simple process for assets that have a ready market like listed shares, however the process for other assets like property can be more onerous. Trustees are responsible for determining the market value of fund assets. After your annual financial statements are prepared your fund auditor will need to see objective and supportable evidence that backs up how you have arrived at the market value. Trustees have the option to use a qualified independent valuer for this and should consider this where an asset represents a significant part of the fund’s value or might be difficult to value. Where trustees choose not to use an independent valuer, they will need to be able to support asset valuations with evidence from multiple sources. Typically, for property this may include: Recent comparable sales – Generally at least 3 and the properties should be genuinely comparable in terms of size and location. A real estate agent appraisal that also includes comparable sales. Net income yields for commercial property (generally not sufficient evidence on its own). The ATO includes some helpful guidance on this in their Guide to valuing SMSF assets. Where an SMSF holds property that meets the business real property (BRP) definition it is possible that this property can be leased to a business that is operated by a member or a related party of the SMSF. However, the fact that an arrangement like this is permitted does not mean the fund trustees can charge a non-market rate of rent. When a rental arrangement is entered into with a related party of the super fund, that arrangement should be on arm’s length (commercial) terms and this should be supported by a rental appraisal. An easy way to think about this is – do all the lease terms reflect an arrangement that would be agreed to if the tenant was an unrelated third party? To evidence that a related party arrangement is on arm’s length (commercial) terms an auditor should be provided with; A properly documented lease; A rent appraisal when the lease was first entered into; Evidence that the arrangement is operating based on the terms of the lease; and Evidence that where a prior lease term has expired the terms have been reset to market value – backed up by a new rent appraisal. Although your financial year 2026 SMSF audit might not be taking place for some months, the process can be much smoother where SMSF trustees are proactive and start to compile this evidence in advance, rather than waiting for the auditor’s request.

Loss carry back rules reintroduced

By Clarke McEwan • September 1, 2026

At the Federal Budget in May 2026, the Government announced that it would reintroduce a loss carry back tax offset for companies, providing a crucial buffer to any business facing difficult trading conditions.