Thousands of Australians have reported being temporarily locked out of their myGov accounts, with many receiving automated emails and texts citing suspicious sign-in attempts. The notifications indicate that accounts are locked due to excessive incorrect sign-in attempts and that email addresses or mobile numbers used as usernames have been disabled to protect the accounts.
Services Australia General Manager Hank Jongen stated that the lockout is not indicative of a security breach on the myGov platform itself. He explained that myGov, like other major digital services, is a frequent target for scammers who may attempt to access accounts using leaked credentials from data breaches on other platforms.
Automated security measures are designed to temporarily lock accounts or disable certain sign-in options when unusual activity is detected. Jongen emphasized that these security notifications serve to inform users of protective actions taken, rather than signaling a compromise of the myGov account or the platform. "This is the security measure working as intended," he said.
Australians are encouraged to enhance their account security by utilizing the security review feature within myGov. This feature guides users to implement stronger sign-in methods such as Digital ID or passkeys, and to disable the option of using a username and password. While users can re-enable email or mobile numbers as usernames, this is not recommended if those details have been compromised on other services.