ATO data matching: what the ATO already knows

ATO data matching is the ATO comparing information it receives from third parties, such as banks, employers, government agencies, rental bond regulators, online platforms and crypto exchanges, with what you report in your tax return. Where the figures don't line up, the ATO may change a pre-filled amount, ask you to check, correct an inadvertent mistake or start a review.

The ATO says more than 600 million transactions are reported to it each year (ATO, Data matching, last updated 21 October 2025). When that data doesn't match a return, we help clients and their accountants respond, as part of our work on ATO audits, reviews and objections.

What does the ATO use data matching for?

The ATO says it uses the data to pre-fill returns, explain people's obligations, detect fraud, recover debt and measure voluntary compliance, among other things. Matching happens when you lodge and again after your assessment issues. The ATO says checking your information doesn't automatically mean it thinks you're dishonest.

Where does the ATO get its data?

Third parties that must report by law

Some organisations must report to the ATO by law, mostly under Schedule 1 to the Taxation Administration Act 1953 (TAA).

Who reports	What they report	Law
Employers	Wages and amounts withheld (Single Touch Payroll)	TAA Sch 1 s 389-5
Government entities	Grants to entities with an ABN, and payments for services	Sch 1 s 396-55, items 1–2
States and territories	Transfers of real property, including tax file numbers where quoted	Sch 1 s 396-55, item 3; s 396-60(1)(c)
ASIC, market participants, listed companies and trustees	Share and unit transactions	Sch 1 s 396-55, items 4–8
Payment system administrators	Card and other electronic payments a business receives	Sch 1 s 396-55, item 9
Businesses in cleaning, courier and road freight, security and IT	Payments to contractors for those services	Sch 1 s 396-55, items 11–14
Online platform operators	Payments to people who supply through the platform	Sch 1 s 396-55, item 15
Financial institutions	Foreign residents' accounts (Common Reporting Standard) and certain accounts of US persons (FATCA)	Sch 1 Subdivs 396-C and 396-A

The ATO also checks returns against data from banks (interest and investment income), building and construction businesses (contractor payments) and private health insurers.

Data the ATO requires for specific programs

For many programs, the ATO uses its power to require information for the administration or operation of a taxation law (TAA Sch 1 s 353-10). Its rental bond protocol calls this a coercive power: providers must hand over what is asked for, and failing to comply can be an offence (TAA s 8C).

The ATO says it follows the Australian Information Commissioner's Guidelines on Data Matching in Australian Government Administration (2014), and publishes a protocol for each program covering about 5,000 individuals or more, explaining its purpose, the data collected, who provides it and how it will be used.

Other agencies and other countries

The ATO also receives AUSTRAC data and exchanges information with other Australian Government agencies and overseas tax authorities. The ATO mostly passes the financial account reports in the table to other countries; in return, treaty partners tell it about income Australian residents earn overseas.

One program has its own Act: the Data-matching Program (Assistance and Tax) Act 1990 governs matching of the Commissioner's tax data with data held by the agencies that provide social security, veterans', family and student assistance (ss 3, 6). The ATO says it gives information from tax returns to the Data-Matching Agency within Services Australia.

What data-matching programs does the ATO run?

The ATO's list of current data-matching protocols (How we undertake data matching, last updated 21 September 2026) includes:

• Property and rent: rental bond; property management; landlord insurance; residential investment property loans; real property transactions; sharing economy accommodation.
• Assets: lifestyle assets; motor vehicle registries; novated leases; share transactions.
• Online and digital: online selling; offshore merchant; ride sourcing (2015–16 to 2022–23); crypto assets.
• Income, insurance and benefits: government payments; income protection insurance; private health insurance statements; Medicare entitlement statements; paid parental leave super contributions; military super.
• Identity, travel and financial crime: AUSTRAC transaction reports; Australian Financial Crimes Exchange; Home Affairs visas; Home Affairs passenger movements; Commonwealth electoral roll.
• Other: officeholders; child support lodgement enforcement; COVID-19 economic response support; HELP, VET Student Loans and Trade Support Loans.

For crypto, designated service providers give the ATO purchase and sale information: see our guide to crypto reviews and audits.

How does ATO data matching work for rental properties?

Rental bonds. The ATO collects data twice a year, after 30 June and 31 December, from the rental bond regulators in each state and the ACT, for bonds going back to 1985 and through to 2025–26, and expects data on about 2.2 million individuals a year. It includes landlord and tenant details, the landlord's bank account, the managing agent, the property address, lease dates, the rent and how often it is paid, and the bond and any refund (ATO, Rental bond data-matching program protocol, last updated 10 January 2025).

The protocol says the program targets landlords who don't lodge on time, leave out or misreport rent or deductions, or misreport the cost base for a capital gain or loss, as well as foreign residents not meeting foreign investment conditions and people who have sold an income-producing property. It says that in 2022–23 the program, with other data matching and compliance work, identified about 5,600 taxpayers whose property dealings had not been treated correctly.

Property management. The ATO also acquires data from property management software companies for 2018–19 to 2025–26, collecting it annually after each financial year and expecting records on about 2.3 million individuals a year. It covers residential and commercial properties and includes the owner's details and bank account, the property manager, the date the property was first available for rent, and each rent and expense transaction. The ATO says it uses the data to support correct reporting of rental income, expenses and capital gains, and that before taking action it gives taxpayers 28 days to check and respond (ATO, Property management data-matching program protocol, last updated 26 August 2024).

Other property data. The ATO's current list also includes landlord insurance (2021–22 to 2025–26) and residential investment property loans (2021–22 to 2025–26), and the states and territories report property transfers (TAA Sch 1 s 396-55, item 3).

For example, suppose bond records show a house let at $600 a week for a year, about $31,000, but the owner's return shows $15,000 of rent. That is the kind of gap these programs find. If a co-owner reported the rest, the owner will need records to show it. For other rental claims that draw ATO attention, see ATO audit red flags.

How does ATO data matching work for the sharing economy?

Under the Sharing Economy Reporting Regime, operators of electronic distribution platforms must report payments made to people who supply through their platforms (TAA Sch 1 s 396-55, item 15). Reporting began on 1 July 2023 for taxi travel (including ride-sourcing) and short-term accommodation, and extended to all other reportable transactions from 1 July 2024. Operators report twice a year: by 31 January for July to December, and by 31 July for January to June (ATO, What is the SERR?, last updated 20 January 2026).

Sales of goods, transfers of real property, financial supplies and payments already subject to withholding are excluded (s 396-55, item 15). Online sales of goods are covered by the ATO's separate online selling program instead.

Generally, income from driving, hosting or other paid services through a platform is assessable, and costs of a car or home also used privately are deductible only to the extent they relate to earning that income (Income Tax Assessment Act 1997 (ITAA 1997) ss 6-5, 8-1).

What happens if your return doesn't match the ATO's data?

The ATO's data matching pages describe the process broadly like this:

1. Matching. Records are matched to the right taxpayer using names, addresses, dates of birth and other identifiers. Analysts look for under-reported income or over-reported deductions, and refer higher-risk matches to compliance staff.
2. At lodgement. If you change a pre-filled figure, the ATO may change it back where it is highly confident in its data. It also checks whether an amount was put at the wrong label.
3. Prompts and contact. You may see a message in the ATO's online services. Where it needs to verify something, the ATO usually contacts you by phone, letter or email and gives you up to 28 days to respond before it acts.
4. Correction or review. In limited circumstances, the ATO may correct an inadvertent mistake itself. Larger gaps can become a review or audit, with formal notices requiring information (see ATO information notices and access powers).

If the gap is real, expect an amended assessment, shortfall interest charge and sometimes a penalty. The ATO can generally amend an income tax assessment within 2 years after the day it gives you the notice of assessment for most individuals and small and medium businesses, 4 years for others, and at any time if the Commissioner is of the opinion there has been fraud or evasion (Income Tax Assessment Act 1936 (ITAA 1936) s 170(1)). Those periods can be extended in some cases. See how far back the ATO can audit.

A penalty applies to a statement that is false or misleading in a material particular (TAA Sch 1 s 284-75(1)), but generally not if you and your agent took reasonable care (s 284-75(5)), or if a registered tax or BAS agent made the statement after you gave them all relevant information and the error wasn't the result of the agent's intentional disregard or recklessness (s 284-75(6)). The base penalty is 25% of the shortfall for a failure to take reasonable care, 50% for recklessness and 75% for intentional disregard, before any increase or reduction (s 284-90). Neither shortfall interest charge nor general interest charge can be deducted for income years starting on or after 1 July 2025 (ITAA 1997 s 26-5(1A)).

What should you do about an ATO data matching letter?

1. Check the contact is genuine. If unsure, contact the ATO through its official channels, not a link or number in the message.
2. Note the deadline. If you need more time, ask in writing before it passes.
3. Compare the data with your records. Is the figure yours, is it already in your return at another label, or does it belong in someone else's return, such as a co-owner's, your company's or a trust's?
4. If the data is wrong, say so with evidence. Entities reporting under s 396-55 must give the ATO a corrected report within 28 days after becoming aware of a material error (TAA Sch 1 s 396-75), so ask the provider to fix it too.
5. If your return is wrong, correct it. Amend or make a voluntary disclosure covering every year affected, not just the one the ATO asked about. See making a voluntary disclosure to the ATO.
6. If you disagree with an ATO amendment, object. Strict time limits apply. Against an amended income tax assessment you generally have until the later of 60 days after the amended notice is served and 2 or 4 years after the original notice of assessment (TAA s 14ZW). See ATO objections and objection time limits.

Timing matters for penalties. Voluntarily telling the ATO about a shortfall, in the approved form, before it tells you it is examining your affairs generally reduces the base penalty by 80%, or to nil if the shortfall is under $1,000. After that point the reduction is generally 20%, and only if your disclosure saves the ATO significant time or resources (TAA Sch 1 s 284-225).

The ATO can treat a later disclosure as made before the examination if it considers that appropriate (s 284-225(5)). Whether a data-matching letter counts as telling you about an examination depends on its terms. In its ruling on voluntary disclosures (MT 2012/3), the ATO reads "examination" broadly, to include reviews and verification checks, and says a letter saying it is "checking this information" can be enough (paras 49, 71). But where the ATO is only identifying or assessing risks, such as in a risk review, it says it will generally treat a voluntary disclosure as made before the examination, so the larger reduction can still be available (paras 133–134). It generally won't do so once it has told you of an audit that follows such a review (para 135). The same ruling says that merely agreeing with a shortfall the ATO has already identified is not a disclosure, but that disclosing other years or issues outside the scope of its enquiry generally still counts (paras 82, 92–93, 99, 133).

Knowing about a mistake and not telling the ATO within a reasonable time can also increase the base penalty by 20% (s 284-220(1)(b)).

If the gap covers several years or large amounts, or might be seen as more than a mistake, get legal advice first. Communications with a lawyer for the dominant purpose of legal advice may be privileged.

Is the ATO allowed to collect and use all this data?

Generally yes. The Commissioner's information-gathering power is broad (TAA Sch 1 s 353-10), and the ATO's protocols rely on the Privacy Act 1988 permitting use that is required or authorised by law (Sch 1, APP 6.2(b)). Tax officers who disclose protected information outside the permitted exceptions commit an offence (TAA Sch 1 s 355-25). A privacy complaint doesn't change a tax liability: a wrong assessment is fixed by amendment or objection.

How we help

We work out what the ATO has matched, reconcile it with your records alongside your accountant, and prepare any amendment, disclosure, review response or objection.

Next step

Send us the ATO letter or online message, the returns for the years it mentions, and any records you have for the same income, such as agent statements, platform earnings summaries or exchange histories, with a short note on why you think the figures differ. In a first call we'll tell you what the ATO appears to have matched, how long you have to respond and whether a correction or disclosure should go in first.