The Accountant Group

Keep more of what you earn and protect what you’ve worked hard for. Tax help for business owners, investors, individuals, start-ups & cashing out. 1300 TAX 000

[The Accountant Group @AccountantGroup]

Outdated authorisations in RAM or Access Manager can leave the door open to fraud on your business tax accounts.

The ATO’s small-business tip (published 4 February 2026) explains that outdated authorisations or incorrect details in Relationship Authorisation Manager (RAM), Access Manager, or the Australian Business Register (ABR) can increase the risk of fraud or unauthorised access to business information.

Its guidance describes three checks, with a reminder to repeat them regularly.

In RAM, principal authorities and authorisation administrators can review who is authorised to act for the business. The ATO recommends matching access to each person’s role, and promptly updating or removing it when roles change or staff leave.

Access Manager controls what authorised people can do in Online services for business and the ABR. The ATO recommends regular reviews of employee permissions, particularly where secure information is involved, so sensitive actions are limited to the right people. RAM sets who can act; Access Manager sets what they can do in certain ATO services.

For the ABR, the ATO states that ABN details must be updated within 28 days of becoming aware of a change. Current associate and contact details help prevent unauthorised access and help government agencies provide timely, targeted support.

These are the ATO’s general access-security checks, rather than advice about any particular business’s authorisations.

Business owner — when did you last review who still has RAM and Access Manager access to your ABN?

https://t.co/OZ0EUISdVQ

[The Accountant Group @AccountantGroup]

One reused password can put more than one account at risk.

The UK’s National Cyber Security Centre explains why: if one account is compromised, a hacker can try the same password on other accounts. Its guidance covers important accounts such as email, banking, shopping and social media — without depending on any country’s business laws.

In its guidance updated on 21 May 2026, the NCSC describes password managers as tools that store passwords safely, allowing a different password for each service without having to remember them all. They may already be built into a browser, or come from a third-party provider.

Features often include generating strong, unique passwords; synchronising them across devices; and warning when a password has been breached or leaked. Autofill can also help protect against phishing because it only fills the password on the correct website.

The guidance does not treat a saved password as the whole answer. It identifies two-step verification as an important layer if a password is phished or otherwise compromised, and recommends it for the password manager account too.

There is also a shared-device distinction: the NCSC says passwords should never be saved in a browser on a public computer. Browser-stored passwords are only as secure as the devices and accounts protecting them.

Its current first choice, where available, is a passkey. For accounts without passkeys, it recommends a strong, unique password and two-step verification.

At The Accountant Group, we help Australian business owners think through everyday business risks. This is general cyber-safety information, not a recommendation of a particular product.

Business owners and investors — what is the biggest obstacle to moving away from reused passwords: habit, convenience or choosing a tool?

https://t.co/JoIPBojGAU

[The Accountant Group @AccountantGroup]

Your company’s unpaid PAYG withholding or GST can become your personal bill.

The ATO can recover certain unpaid company liabilities from current or former directors personally as director penalties. These include PAYG withholding and goods and services tax (GST). Recovery can start 21 days after a director penalty notice (DPN) is issued.

For current directors, a DPN generally goes to the address registered with ASIC. The 21-day period starts when the ATO posts it or leaves it at that address, rather than when a director reads it.

For PAYG withholding and GST, remission depends on when the amount was reported:

Amounts reported within 3 months of the due date: the penalty can be remitted within 21 days of the DPN by full payment, appointment of an administrator or small business restructuring practitioner, or beginning to wind up the company. For new directors, the reporting window runs from appointment.

Amounts reported more than 3 months late, or still unreported after 3 months: generally only full payment of the corresponding company liability remits the penalty. Estimated amounts are treated as never reported.

New directors can become personally liable for amounts due before appointment unless, within 30 days, the company pays in full, appoints an administrator or small business restructuring practitioner, or winds up. Resigning within that window does not necessarily remove liability.

Former directors can remain liable for debts due before resignation, or certain debts due later that relate to their time as director. Liability can continue after deregistration. The ATO also sets out possible defences; this is general information, not advice on a particular DPN.

Director — which part of the DPN timing rules was least familiar to you?

https://t.co/06ts8gcuy8

[The Accountant Group @AccountantGroup]

“Guaranteed” high returns and a deadline to pay? Those are investment-fraud warning signs, not reassurance.

The US Securities and Exchange Commission’s https://t.co/KxCGFbSGnD guidance describes persuasion tactics that can work on financially knowledgeable people too. The warning signs are useful wherever an investor lives; recognising them does not require knowing US law.

One is the promise of extraordinary gains with almost no risk. The SEC explains that every investment carries some degree of risk, and high returns involve high risks, potentially including a total loss. Fraudsters may spend a lot of time presenting extremely high returns as “guaranteed” or something that “can’t miss”.

Another is the “halo” effect: someone seeming likeable or trustworthy can blind investors to a con. The guidance says credibility can be faked. Being impressed by a person is not the same as independently checking their qualifications.

Then there is social pressure. A pitch built around “everyone is investing” is a red flag in the SEC’s guidance. So is a once-in-a-lifetime offer that supposedly disappears tomorrow, pushing the investor to send money immediately.

Free investment seminars feature too. The SEC describes how a small favour, such as lunch, can be used to create a sense of obligation to invest.

Its guidance favours independent research rather than relying only on unsolicited emails, message-board posts or company news releases. Asking the promoter for more information or references is not a substitute for independent investigation.

At The Accountant Group, we help Australian business owners think through business questions. This is general fraud-awareness information, not personal investment advice.

Owners and investors — which pitch would make you most sceptical: guaranteed gains, “everyone’s buying”, or pressure to pay today?

https://t.co/MoCbqasHOD

[The Accountant Group @AccountantGroup]

Cashflow crunch and thinking liquidation is the only door left? There’s another path for many small companies.

ASIC’s small business restructuring process lets eligible companies keep directors in control of the business while they work with a registered liquidator (as restructuring practitioner) on a plan with creditors.

Eligibility on the day you appoint the practitioner includes: total liabilities of $1 million or less; you (and recent directors) haven’t used restructuring or simplified liquidation for another company in the last seven years (with limited related-company exemptions); and this company hasn’t used those processes in the last seven years.

Before a plan can go to creditors, employee entitlements that are due and payable must be paid (or substantially complied with), and tax returns/notices required by taxation laws must be given — tax debts don’t all have to be paid first, but lodgements do.

Eligibility is tested on the day the practitioner is appointed, so options open when warning signs first appear may not stay open. Directors should get advice for their own company’s circumstances.

Company director facing debt pressure — could your company still meet the $1 million liabilities test for small business restructuring?

https://t.co/EZVtznjE0J

[The Accountant Group @AccountantGroup]

Supplied goods on credit and only have a retention-of-title clause? That written line may not be enough if your customer goes under.

Australia’s Personal Property Securities Register (PPSR) is the national online database where you record a security interest in personal property — basically anything that isn’t land or fixtures. Think stock, machinery, vehicles, scaffolding, consignment goods, even some IP you license under contract.

If you hand over goods, stock or building supplies before you’re paid in full, PPSR says you need a security agreement in writing and a registration of your interest. That puts you in a far better position to reclaim the goods — or stand near the front of the queue — if the other party becomes insolvent. A contract alone often isn’t enough; unregistered interests can lose to other creditors.

Same story if you hire out equipment for longer periods, sell on consignment, or ship goods in transit: PPSR guidance points to registering early, ideally before the customer takes possession. Timing rules can matter, so get advice on your own agreements. Buying second-hand plant for your own business? A serial-number or organisation search (from about $2) can flag finance still owing — without it, a lender may repossess even after you paid the seller.

PPSR doesn’t cover unpaid labour or services on their own. It protects interests in goods and other personal property you’ve secured.

Owner or investor supplying stock on credit — is your interest actually registered on the PPSR?

https://t.co/nDIipuzzu1

[The Accountant Group @AccountantGroup]

“No refunds” on the wall won’t save you when a product fails a consumer guarantee.

Under the Australian Consumer Law, if what you sold doesn’t meet the consumer guarantees, you must offer a remedy. It’s illegal to rely on store policies or terms that deny refund or replacement rights for faulty products — including “no refunds” or “no refunds or exchanges on sale items”.

For a major product problem (unsafe, very different from description/sample, serious enough that a reasonable person wouldn’t have bought it, or can’t be used for its normal/stated purpose and can’t easily be fixed in a reasonable time), the consumer chooses a full refund or a same-type replacement. You can’t shave the refund for “use already had”. Same form of payment unless you both agree otherwise.

For a minor problem, you must at least repair or fix it free. If you can’t or won’t within a reasonable time, the consumer can get it fixed elsewhere at your reasonable cost, or seek refund/replacement / drop-in-value compensation.

You’re responsible for problems with products you sold — sending the customer to the manufacturer doesn’t shift that responsibility. (Where it’s the manufacturer’s fault, you may later recover remedy costs from them.)

Change-of-mind is different: no ACL refund duty if they simply changed their mind — but if you advertise a change-of-mind policy, you must follow it.

Business owner — does any sign, T&C or staff script still say ‘no refunds’ on faulty goods?

https://t.co/1iT9kuRffm

[The Accountant Group @AccountantGroup]

Your regular supplier emails to say their bank details have changed. Pay that invoice without checking and the money could be gone.

The Australian Signals Directorate's https://t.co/BSE1j3ZdUF guidance calls this business email compromise. Scammers use email to trick organisations into sending money or goods, posing as a trusted employee, supplier or business partner via hacked or look-alike email addresses, company names or logos.

Invoice fraud: a vendor's email is compromised and genuine invoices are re-sent with new bank details, so customers pay the scammer. Employee impersonation: a hacked work account poses as the CEO or CFO to get a false invoice raised, or to divert a worker's salary. Company impersonation: a look-alike domain orders goods in a trusted organisation's name.

Warning signs: an unexpected change of bank details, an urgent payment request or threats, unusual payment requests from someone senior, and an email domain that doesn't quite match.

ASD's key actions: multi-factor authentication and strong passwords on email, a clear process to verify payment and account-change requests, email authentication controls such as SPF and DMARC, and staff training. Verify using contact details you have checked separately, not those in the email.

Already paid? Contact your bank immediately and report it to ASD.

Business owner: if a supplier emailed new bank details tomorrow, who in your business would verify them, and how?

https://t.co/aMqbXXgVxV

[The Accountant Group @AccountantGroup]

Registered your business name with ASIC and think the brand is now yours? Check again: it isn't.

IP Australia is blunt about it. A business name registered with ASIC is your trading name, so customers know who owns the business. It does not give you exclusive rights to that name. Other people can still register a similar (though not identical or nearly identical) business name, or trade under a similar name, and business name registration does not provide intellectual property protection.

A company name is no different. Registering a company creates a separate legal entity under the Corporations Act 2001 (Cth), but it does not create brand-ownership or exclusive rights, or give you trade mark rights.

Only a registered trade mark can give you exclusive control over your brand across Australia. It can be words, logos, slogans or shapes, registered with IP Australia. It grants exclusive nationwide rights to use the mark for the goods and services it is registered for, lets you take legal action against suspected infringement, and can deter copycats.

The catch: the registers do not cross-check. A business name available on ASIC may conflict with an existing trade mark on IP Australia's register, and vice versa.

Trade marks carry application and renewal fees; business names are comparatively inexpensive. But only a trade mark gives you enforceable, nationwide rights.

Owner or investor: is the brand you're building protected by a registered trade mark, or only by a business name?

https://t.co/ZUZTAK6wjb

[The Accountant Group @AccountantGroup]

Advertising $99 then stacking booking fees at checkout? That’s how drip-pricing complaints start.

ACCC price-display rules say businesses must communicate clear, accurate prices before consumers book, order or buy — and must not mislead. Where you state a price, you generally must show the minimum total cost as a single figure: taxes, duties, and all unavoidable or pre-selected extra fees included. If you also show a partial price, the total must be at least as prominent.

Optional extras only need to sit inside that total when you pre-select them (customer has to opt out). Purely optional add-ons the customer chooses themselves usually don’t. Fees you can’t quantify yet have limited carve-outs — but once you can calculate them in the booking flow, you must show the full total.

Drip pricing — teasing a low headline price then dripping booking/service fees through the funnel — is called out specifically. Be upfront at the start about which fees apply and when.

Two prices showing for the same item (even by mistake)? Sell at the lower one or stop selling until fixed. Same idea if checkout doesn’t match the shelf/ad price.

Hospitality note: weekend/public-holiday menu surcharges have a special disclosure rule (prominent wording on the menu). But a surcharge that applies every day is part of the minimum total and belongs in the displayed price.

If a customer screenshots your advertised price, does it match the minimum total they’ll actually pay?

https://t.co/2xZggugxax

[The Accountant Group @AccountantGroup]

Paying the ATO by credit card? That stops after 30 June 2027.

Payment plan on a credit card? You must switch to another payment method. Credit card payments after 30 June 2027 will fail, and your plan may fall into arrears or default.

https://t.co/6jQOtH1dWr

[The Accountant Group @AccountantGroup]

Sacking someone? Be ready to prove you followed the Code.

Under 15 staff? A dismissal isn't unfair if it follows the Small Business Fair Dismissal Code.

Not serious misconduct? Valid reason, warning, chance to respond, reasonable chance to improve.

https://t.co/m5x5cmINuM

[The Accountant Group @AccountantGroup]

Seafood on your menu? It now needs an origin label.

Since 1 July 2026, restaurants, cafés, pubs, clubs, takeaways and food trucks must say if seafood in dishes marketed as containing it is Australian, imported or mixed (A, I, M with a key, or words).

https://t.co/euyhpHocH0

[The Accountant Group @AccountantGroup]

Reasonably suspect an eligible data breach? Your 30-day clock is running.

Covered (usually turnover over $3m, plus some smaller ones)? Take reasonable steps to assess it within 30 days.

Eligible breach? Notify affected people and the OAIC promptly.

https://t.co/EuKcLmAKnh

[The Accountant Group @AccountantGroup]

Sold a product that seriously hurt someone? Tell the ACCC.

If a consumer good you supply caused or may have caused a death, serious injury or illness, report it within 2 days of becoming aware.

Thermomix: $108,500 of its fine was for 14 late reports.

https://t.co/bvQJB4i2tx

[The Accountant Group @AccountantGroup]

Not covered by the Privacy Act? You could still be sued for a serious invasion of privacy.

A statutory tort for serious invasions of privacy started on 10 June 2025. It's broader than the Privacy Act, reaching individuals and other entities, and covers intentionally or recklessly intruding on someone's seclusion or misusing their information. A court can award damages, an injunction or an order to apologise.

Next step: make sure no one in your business looks up, shares or records customer or staff information they shouldn't.
https://t.co/LjrKoOnodq

[The Accountant Group @AccountantGroup]

Small supermarket or servo under $10 million turnover? You might still have to take cash.

Under the Cash Acceptance Industry Codes, covered supermarket and fuel retailers must give customers a reasonable opportunity to pay cash for in-person payments of $500 or less, between 7 am and 9 pm. Small businesses under $10 million turnover are generally excluded, but not if they use a registered trademark also used by a larger retailer. The ACCC may seek civil penalties for breaches from 1 July 2026.

Don't freeze: check whether your store trades under a bigger retailer's trademark, and keep a cash float ready.
https://t.co/e7d2dN4BBX

[The Accountant Group @AccountantGroup]

Texting staff after hours? Your small business team can now refuse to reply, unless that's unreasonable.

Since 26 August 2025, the right to disconnect applies to employees of small business employers. Outside their working hours, employees can refuse to monitor, read or respond to contact from their employer, or work-related contact from others such as clients. It doesn't apply to independent contractors.

Don't freeze: agree after-hours contact rules with your team.
https://t.co/lGme1akrSp

[The Accountant Group @AccountantGroup]

Paid hackers a ransom? The clock is 72 hours.

Under the Cyber Security Act 2024, businesses with annual turnover over $3 million in the previous financial year, and critical infrastructure entities of any size, must report a ransomware or cyber extortion payment within 72 hours of paying, or of learning that someone paid on their behalf. The education-first period ended 31 December 2025. Failing to report can attract a civil penalty of up to 60 penalty units ($21,840), or up to $109,200 for a company.

Don't freeze: put this step in your cyber incident plan now.
https://t.co/oMNJSZ1lWe

[The Accountant Group @AccountantGroup]

Side income through an app? The platform is likely reporting it to the ATO.

Under the Sharing Economy Reporting Regime, digital platforms must report income earned by suppliers through their platform, twice a year. Short-term accommodation and ride-sourcing have been reported since 1 July 2023. From 1 July 2024, all other reportable transactions were added.

Earning through a platform from services, rentals or digital content, not just short stays or rideshare? Make sure your tax return includes that income and matches your platform statements.
https://t.co/GsdAASSPw3