ATO Crypto Tax Warning Emails Hit Thousands of Aussie Inboxes

The Australian Taxation Office has emailed thousands of crypto holders this tax season, warning them their records show they “bought or disposed of crypto” since 1 July 2025 and that profits or losses need to land on this year’s return. Recipients are being told that “disposals include selling, gifting, swapping and other similar transactions,” and that income from crypto trading, mining, exchange businesses or selling NFTs as a business also has to be declared. Anyone whose return comes back incomplete can expect “penalties or interest” on top of the tax owed.

Tax Invest Accounting director Belinda Raso told Yahoo Finance the emails were a “new tactic” from the ATO, and many of her clients first thought the message was a scam. Raso told recipients to treat the ATO’s note as a firm expectation that the income will appear on the return, even where deductions lower the eventual bill. The crypto email is one strand of an ATO letter run that is also reaching taxpayers who run side hustles through platforms including Airbnb, Uber, eBay and Square.

The Email Landing in Crypto Holders’ Inboxes

The ATO’s pre-lodgment letters started arriving ahead of the new financial year, with the body of the email resting on data the agency has held for months. Recipients were given no instructions to call back, click a link or share details; the email is a one-way notice that the ATO already has the records. That is what makes the message easy to mistake for a phishing attempt, Raso said, and worth checking through myGov before deleting.

The wider point sits in the letter itself: the ATO has signalled it will not be guessing at this year’s tax time. Any return that omits income the ATO has matched against third-party data goes straight to the start of an audit queue. Anyone whose crypto history crosses the 1 July 2025 boundary, whether through a single sale or a long stream of swaps, is now in the agency’s active dataset. The ATO has separately listed “omitted income” as a focus area for 2026 tax time alongside work-related deductions and expenses.

What the ATO Counts as a Disposal

The ATO’s definition of a disposal is wider than most crypto holders realise. On the agency’s CGT guide, the word covers any event where an investor gives up an asset, including sales in fiat and several events where no cash is involved.

Five events listed on the ATO’s CGT guide for crypto assets page all qualify, even when no fiat changes hands. Investors who swap a token for another coin, buy a coffee with crypto or hand tokens to a family member each trigger a capital gains tax event under Australian rules. Staking rewards, airdrops and DeFi yield sit outside this list and are taxed as ordinary income at receipt. None of the five requires an Australian dollar conversion to count.

1. Selling a crypto asset
2. Gifting a crypto asset
3. Trading, exchanging or swapping one crypto asset for another
4. Converting a crypto asset to Australian or foreign currency
5. Buying goods or services with a crypto asset

The ATO’s CGT guidance treats staking rewards, airdrops and DeFi liquidity returns as ordinary income in the year received, even before any disposal happens. Net capital losses cannot be deducted from a salary or wages bill, though they reduce future capital gains, which is why records over every transaction matter. Holders who lost access to wallets through a platform collapse can claim a capital loss only with evidence the loss is permanent.

The Data Machine Behind the Letter

The letter reaching crypto inboxes is a notification. The data-matching regime behind it has been quietly accumulating since 2019, when the ATO first asked designated crypto service providers to hand over transaction and identity records.

In 2025 the ATO confirmed it had received transaction and personal details for more than 1.2 million account holders using crypto exchanges in Australia, the biggest dataset the agency has disclosed. Crypto tax platform Koinly, which has tracked the rollout, said “it’s likely more letters will be issued in tax season” given the size of the dataset now in the agency’s hands. Crypto exchanges operating legally in Australia are bound by law to provide the records.

In April 2024 the Office of the Australian Information Commissioner issued OAIC’s 2024 data-matching exemption approval for the regime to cover financial years 2014-15 to 2025-26. The exemption runs to the end of the 2025-26 financial year and replaces an earlier exemption granted in 2019. The decision, signed by Privacy Commissioner Carly Kind, lets the ATO keep the names of the crypto exchanges it pulls data from out of the gazette notice and the protocol document, on the grounds that naming them would “compromise source entities’ willingness to participate.” Investors therefore know the regime exists but not which platforms feed it. The secrecy is intentional and ongoing.

Tax practitioners are blunt about the practical effect. Raso told Yahoo Finance the letter is “doing taxpayers a favour” by giving them a “heads up” about income the ATO was already tracking.

Let’s be honest, there’s nowhere to hide.

That line, attributed to Belinda Raso, captures what has changed. With the email, the ATO holds the data and the lodgement comes second, reversing the older audit-first model. The same matching system runs against side-hustle income reported by Square, eBay, PayPal and the rest, which is why both letters arrive in the same week. Australia’s framework sits alongside parallel crypto-tax regimes now under construction in other financial centres, with Hong Kong’s CARF crypto tax framework as one recent example.

What Data the ATO Has Already Collected

Australian exchanges collect detailed know-your-customer information when accounts are opened, and that dataset is the basis for what the ATO receives. CoinSpot, Binance Australia, CoinJar, Coinbase, Kraken, Swyftx, Crypto.com and Digital Surge are all named by industry sources as designated service providers. Australian DSPs are bound by law to provide what their exchange already holds.

• Names
• Addresses
• Phone numbers
• Bank account details
• Transaction dates
• Asset types and transaction values

Those obligations sit on top of broader anti-money-laundering rules that have applied to crypto exchanges since 2018. AUSTRAC-registered DSPs must verify customer identities, report suspicious transactions and keep records for seven years, which is why the ATO can match data this far back without rebuilding the trail. Once the data is in ATO hands, the agency gives investors a 28-day window to clarify before any compliance action. A letter that names a year an investor barely remembers is a record the ATO has already had time to verify. Treating that mail as routine is the path to an amended assessment, interest, and penalties.

The Side-Hustle Letters Run on the Same Rails

The crypto letter is one half of a wider ATO letter run this tax time. The other half is going out to people whose side hustles run through online platforms. The Sharing Economy Reporting Regime was expanded in 2024 to include all online marketplaces, extending mandatory reporting to platforms such as eBay, PayPal, Amazon and Square on top of the Airbnb, Stayz, Uber, Airtasker and DoorDash routes already captured.

One of Raso’s clients learned this the hard way, with payment platform Square reporting nearly $100,000 of his income to the ATO in the first full year of expanded reporting. Many of her other clients have been caught out in much smaller amounts, often from selling goods on eBay or renting out a parking space through a peer-to-peer platform. Raso said a lot of her clients had been caught out by the data-matching changes. The platforms report gross payments, with fees and cost of goods left out of the calculation, so a high-fee seller can find a tax bill waiting where they expected a small extra income. The ATO’s stated focus area for 2026 tax time is “omitted income,” with sharing-economy platforms now the highest-volume source of new matches.

The shared rail is the reporting obligation itself, the same obligation that runs the side-hustle letters. Crypto exchanges have been on that rail since 2018 under their AUSTRAC obligations and joined the ATO’s data-matching regime in 2019. The letter asking a crypto holder to declare trades is the same kind of nudge as the letter telling a side hustler to declare one Etsy month; both arrive after the comparison has already been made.

How CGT Shapes Your Crypto Tax Bill

Once a disposal is identified, the ATO taxes the gain under existing capital gains tax rules. Net capital gains are added to an investor’s other income and taxed at their marginal rate.

The biggest relief valve is a 50% CGT discount where the asset has been held for at least 12 months, available to individuals and trusts on assets classified as investments. Holding Bitcoin for 14 months before swapping it for Ethereum halves the gain that lands on the return, even though the swap is itself a CGT event. The discount does not apply to companies or to assets held as trading stock, and the ATO has warned that crypto “won’t be exempt from CGT as a personal use asset” for investors. Someone running a crypto trading business will pay the full marginal rate on every gain, with no discount to lean on.

On the income side, mining, staking rewards, airdrops and DeFi yield are treated as ordinary income in the year received, then taxed again on any later disposal as a separate CGT event. Net capital losses cannot be deducted from a salary or wages bill; they roll forward and can only offset future capital gains. The ATO requires records that show the date, asset, Australian dollar value at the time, fees paid and purpose of each transaction, kept in a form that survives a myGov upload. The CGT math runs through the ATO’s online calculator for capital gains, or via a registered tax agent who works on crypto files. For investors whose trading has run across multiple exchanges and wallets, the cheapest single step is reconciling those records now, before the data-matching system flags a gap.

For most individual investors, the simplest framing is this: every disposal of an investment-grade crypto asset triggers a CGT event, the 50% discount halves the gain where the asset was held longer than a year, and staking, airdrop and mining income is taxed separately as ordinary income at receipt. Records need to capture each asset, the Australian dollar value at conversion, and enough transaction detail to reconstruct the trail years later when the ATO asks. The CGT math runs through myTax’s capital gains section, or via a registered tax agent with crypto experience.

Feb 2026 Crypto Scam Versus the Real ATO Letter

In February 2026 the ATO published its February cryptocurrency scam alert after reports of fake emails impersonating the agency and demanding recipients call a phone number to declare crypto held in “non-KYC decentralised wallets.” The genuine ATO email looks similar enough to the scam that recipients often delete both as a precaution. The agency has separately reported that approximately 75% of ATO-branded email scams reported to it over the prior six months linked to a fake myGov sign-in page. With tax time now open, the inbox is the easiest place to be caught out, which is why the ATO says when in doubt to phone 1800 008 540 before clicking anything in the email.

• Real ATO communications live inside ATO online services via myGov; check there, not in your inbox.
• The ATO says it will never email demanding immediate disclosure of cryptocurrency, never threaten arrest by email, and never ask for payment via a hyperlink.
• The Feb 2026 scam emails asked recipients to call a phone number quoted inside the message; legitimate ATO phone numbers start with 1800 and are listed on ato.gov.au.
• Forward any suspicious email to ReportScams@ato.gov.au before deleting it, the ATO has advised.

For a recipient holding both a real ATO email and a worry that it might be a phishing copy, the cleanest test is to log into myGov independently and look for the message inside ATO online services. The genuine email sits there alongside any tax-time prompt the lodgement system raises about prior-year crypto activity. A pdf attachment, a phone number to call back, or a link to click all warrant caution. The crypto letter in particular asks for nothing back; it tells the recipient to put numbers on a return. That is the inverse of every ATO impersonation scam in the agency’s alert log, where the goal is to extract a click, a callback or personal details.

Frequently Asked Questions

I just got an ATO email about my crypto. Is it real or a scam?

The 2026 email advising that records show you have bought or disposed of crypto is part of the ATO’s annual letter campaign leading into tax time. Real ATO communications can be cross-checked by logging into myGov independently and looking in ATO online services; the genuine message appears there too. If the email asks you to call a quoted phone number, click a link, or hand over personal details, treat it as a phishing attempt and forward it to ReportScams@ato.gov.au without responding.

Do I have to declare crypto I never sold for Australian dollars?

Yes. Under the ATO’s CGT rules, any of the following count as a disposal and need to be reported: offloading a crypto asset, gifting it, exchanging one token for another, swapping it into Australian or foreign currency, or paying for goods or services with it. Staking, airdrops, mining and DeFi yield are captured separately, taxed as assessable income at the time of receipt even when no disposal has occurred.

Are staking rewards and airdrops taxed in Australia?

Staking rewards and airdrops received by an Australian taxpayer are treated as ordinary income at their market value on the day they land in the wallet. Any later sale or swap of those tokens triggers a separate CGT event, calculated on the difference between the new disposal price and the value already declared as income.

What records do I need to keep for crypto tax purposes?

Per the ATO’s CGT guide, records need to identify each transaction by date, the asset moved, the Australian dollar value when the transaction occurred, fees paid on either side of the trade, and the wallet or exchange address where relevant. Records should be retained for at least five years from when the relevant return was lodged, and ideally longer because data matching can reach back to the 2014-15 financial year.

Will I be audited if I didn’t declare crypto in a previous year?

An audit is one possible outcome, but the ATO’s data-matching workflow usually opens with a clarifying letter asking you to account for the gap, followed where needed by an amended assessment. Where a taxpayer voluntarily contacts the ATO before that letter arrives, penalties can drop sharply, because the agency has stated that voluntary disclosure reduces the penalty exposure. Quiet fixes through amended returns are the route the ATO itself prefers.

Does using a non-Australian exchange keep me off the ATO’s radar?

No. The ATO’s data-matching program operates against any designated service provider in scope, and offshore exchanges that serve Australian users have become increasingly reachable through international information-sharing channels. Net capital gains and crypto income remain assessable under Australian tax law regardless of where the exchange sits, and the data is matched against the taxpayer, not the platform.

Disclaimer: This article is for general information only and is not tax, legal, or financial advice. Cryptocurrency tax treatment in Australia is fact-specific and changes over time; readers should consult a registered tax agent or qualified professional before acting on any of the figures or scenarios above. Statistics, data-matching scope figures and tax rates are accurate as of publication on 10 July 2026 and may have changed since.