Every year, before you type a single number into your tax return, the ATO already knows more about your finances than most people realise. Not because of a tip-off. Not because they're targeting you specifically. Because 2.7 billion data points flow into the ATO's systems automatically — from your bank, your crypto exchange, your Airbnb listing, your insurer, and even Google and Meta — and every one of those data points gets cross-checked against your return before a human ever looks at it.
If something doesn't match, you're flagged. No warning. You won't know. Just a flag on your file.
This post explains how the ATO's data matching works, what triggers a review, and — with 30 June approaching — what you can do right now to make sure your records hold up.
What the ATO actually receives
The ATO runs formal data-matching programs with dozens of third parties. Each year, it collects records from:
- Banks and financial institutions — interest earned, electronic payments, share disposals
- Employers — wages and PAYG withholding via Single Touch Payroll (STP)
- State and territory land registries — every property sale and transfer
- Cryptocurrency exchanges — purchases, sales, and swaps
- Sharing economy platforms — Airbnb rental income, Uber earnings
- Payment platforms — Square, PayPal, Stripe transaction records
- Insurance providers — property and vehicle policies (used to assess lifestyle)
- Google and Meta — payments to content creators and advertisers
- AUSTRAC — foreign source income and international transfers
- Share registries — dividends and managed fund distributions
This is not a trial programme. It is live, it runs every year, and the ATO uses more than 60 identity-matching techniques to link all of it back to you.
How you get flagged
There are two main ways the ATO decides to look more closely at your return.
Data mismatch. If your declared income doesn't match what a third party reported — say, your bank received a $45,000 deposit the ATO doesn't see reflected in your return — the system flags it automatically. No human involved.
Occupation benchmarks. The ATO tracks deductions by occupation and income level. If you're a nurse claiming $9,000 in work-related expenses when the benchmark for nurses at your income level is $3,200, you're an outlier. The ATO's free benchmarking tool lets you check where your business sits against industry averages before you lodge. The tool is educational — it doesn't record your data or flag your account when you use it.
There's a less obvious factor too: your tax agent's profile. The ATO monitors patterns across an agent's entire client base. If your accountant consistently claims higher-than-average deductions for clients in similar occupations, your risk increases — even if every one of your deductions is legitimate.
Five cases that show what this looks like in practice
These cases illustrate how the ATO's data matching translates into real outcomes. They are representative examples based on publicly documented ATO audit patterns and enforcement outcomes — not individual case citations.
The content creator. A TikTok and YouTube creator was reporting his income as a hobby because his earnings were under $20,000 per year. The ATO pulled payment data directly from Google and Meta, cross-referenced posting frequency and earnings records, and ruled it was a business, not a hobby. It went further: the creator had been channelling income through a family trust, paying a spouse who didn't do any actual work. The ATO applied the personal services income (PSI) rules — which kick in when more than 50% of your income comes from your own effort or skill — and taxed the full amount at his top marginal rate, not the lower trust distribution rate. If you're currently in a similar arrangement, the ATO's PCG 2025/5 guidance indicates that taxpayers who move to compliant structures by 30 June 2027 are unlikely to face enforcement action — there is a window to fix this.
The Airbnb property owner. A Queensland property owner listed their beach house on Airbnb but blocked out the entire month of December for a family holiday. They then claimed 100% of the property's interest and maintenance costs as deductions, as though it were available year-round. The ATO pulled the booking data directly from Airbnb, identified every block-out date, and ruled the property wasn't genuinely available during peak season. Deductions were apportioned accordingly, and a tax bill covering three years of over-claimed expenses followed.
The yacht. A Sydney small business owner insured a $250,000 yacht but reported his business as barely breaking even. The insurance data triggered an automated lifestyle mismatch alert. The ATO audited the business and found $400,000 in diverted cash sales. The total bill: $280,000 in tax, $210,000 in penalties for intentional disregard, and $45,000 in interest. He had to sell the yacht and the family home to settle.
The takeaway shop. A food business was reporting a 20% profit margin. The industry benchmark for takeaway shops is around 35%. The ATO used default assessment powers to estimate what the business should have earned, then issued a $180,000 bill in Goods and Services Tax (GST) and penalties. Because the business couldn't explain the gap or produce records that disproved the benchmark, they had no way to contest it.
The tiling company. An employer failed to pay employee superannuation for several quarters and ignored the ATO's follow-up letters. STP data confirmed the exact super liability outstanding. The ATO issued a $1.5 million garnishment notice directly to the company's bank account. From 1 July 2026, payday super means employers must pay super each payday — not quarterly. STP will flag any missed payment the day it's due, not at the end of the quarter.
What happens if the ATO finds something
When the ATO flags a return, it doesn't jump straight to a full audit. It starts with a review — and this is where you have the most leverage.
At the review stage, you're given the opportunity to go back through your return, check your records, and amend anything that looks doubtful. If you fix errors here, there are no penalties. None.
If the review escalates to a full audit and the ATO finds under-reported income or over-claimed deductions, the picture changes considerably:
| Behaviour | Penalty |
|---|---|
| Failure to take reasonable care | 25% of tax shortfall |
| Recklessness | 50% of tax shortfall |
| Intentional disregard | 75% of tax shortfall |
On top of the penalty, the General Interest Charge (GIC) applies to the original shortfall from the date it arose — often a year or two before you even knew about it. The current GIC rate is 10.96% per annum (April to June 2026 quarter — check the current rate at ato.gov.au).
There is one more thing worth knowing: GIC incurred from 1 July 2025 onwards is no longer tax deductible — meaning interest accruing on any unpaid tax debt from that date cannot be claimed as a deduction. Previously, if you owed the ATO money and were paying interest on it, you could at least claim that interest as a deduction. From 1 July 2025, you cannot. An unpaid tax debt now costs you more than it used to — in interest you can't claim back.
What to do before 30 June
If anything in those cases made you think twice, here are five things to act on now — before you lodge, and before the end of the financial year.
1. Check your deductions against the ATO benchmark for your occupation. Use the ATO's free benchmarking tool. If your claims sit well above the range for your job type and income level, either make sure you have solid documentation for every item, or review whether the amounts are defensible.
2. Review short-term rental deductions. If you rent out a property on Airbnb or a similar platform, your deductions must be apportioned for any period the property wasn't genuinely available — including periods you used it yourself or blocked it out. Don't claim costs for periods you blocked out, regardless of whether anyone actually booked it.
3. Make sure your payroll super is current. Any super owing to employees needs to be paid and cleared before 30 June. From 1 July 2026, super must be paid each payday via Single Touch Payroll. If you're behind, catch up now while there's still a quarter-end grace period.
4. Keep documentation for every deduction. The single biggest differentiator in ATO reviews is whether you can produce a receipt or a clear calculation for each claim. "I kept rough notes" is not a defence. If you don't have records for something, don't claim it.
5. If you think there's an issue, fix it before the ATO contacts you. Voluntary disclosure before the ATO notifies you of a review can reduce penalties by up to 80%. After they make contact, that window closes fast.
When to get an accountant involved
If your situation involves a family trust, a business with below-benchmark margins, short-term rental income, or contractor earnings channelled through a company structure, it is worth a conversation with an accountant before you lodge — not after. A review of your return before it goes in costs far less than a review after the ATO has flagged it.
Bottom line
The ATO already has the data. The question is whether your return matches it. Check your deductions against the benchmarks, make sure your Airbnb and rental claims are correctly apportioned, and get your super payments up to date before 30 June. If you have outstanding tax debt, the interest on it is no longer deductible — dealing with it now is less expensive than dealing with it later.
This post is general information only and does not constitute personal tax advice. For guidance specific to your situation, speak with a registered tax agent.
