On Tuesday 11 August, millions of Australians will complete the 2026 Census. The Australian Bureau of Statistics is again taking a digital-first approach, with most households receiving a unique 16-digit Census number and a temporary nine-character password.

Some Australians will also receive a link to the online form via their myGov Inbox.

While digital government services are convenient for Australians, they can pose a significant security challenge.

The 2026 Census will test not only the capacity and resilience of a government website but also Australians’ ability to distinguish a legitimate digital service from a convincing imitation and that distinction is becoming harder to make.

Phishing sites can closely mimic government branding, language and login pages, and artificial intelligence is making fraudulent messages more polished, personalised and persuasive.

A message may know the Census date, refer to penalties for non-compliance and direct the recipient to a page that looks authentic.

This danger is not limited to information entered on the Census form, though. A fake Census message may instead be designed to steal a myGov username, password, one-time code, or personal information that can be used for broader identity fraud.

Access is not the same as identity

The Census process does not necessarily establish the legal identity of every person named on a household form. Generally, one adult completes the form on behalf of everyone staying at the address.

The Census number and temporary password demonstrate that the respondent has access to the household’s Census credentials, though they don’t cryptographically prove the identity of each person listed.

This highlights a broader issue in digital government: can grant access without proving that the person using them is the legitimate holder.

If credentials are copied, forwarded, photographed, or entered on a phishing page, an attacker may be able to impersonate the household or use the stolen information in another scam.

Australians should therefore treat the Census login process with the same care as they do for online banking, tax and health services.

Six steps to reduce the risk

1. Treat the Census number and temporary password as sensitive account credentials. Do not photograph, forward or share them outside the household. Store the letter securely until the form is completed.

2. Use a trusted route to access the Census. Enter the official Census address in the browser, or access the service directly via the myGov app or website. Do not rely on links in unexpected emails, text messages, search ads or social media posts.

3. Be alert to Census-themed urgency. Criminals exploit major government events and deadlines because people expect official communication and fear penalties for failing to act. Messages claiming a form is overdue, a fine is pending or details must be urgently verified should be treated cautiously.

4. Secure myGov with the strongest authentication available. myGov supports passkeys, including security keys. Passkeys use public-key cryptography and are tied to the legitimate online service, making them far harder to capture through a fraudulent login page than passwords or SMS codes.

5. Never provide a password or a one-time authentication code to someone over the phone. A legitimate support representative should not need the code that authorises access to an account. Users should not need to rely on one-time codes if they have set up a passkey or a YubiKey.

6. Complete the Census form on an up-to-date, trusted device. A personal computer, tablet or phone with current software is preferable to a shared or public computer. Updates reduce exposure to known vulnerabilities and a personal device provides greater confidence that browser settings, extensions and security controls have not been altered.

Digital trust must be designed in

Public awareness remains essential, but Australians cannot be expected to identify every sophisticated phishing attempt through vigilance alone.

As more government interactions move online, services must increasingly adopt authentication that is secure by design and resistant to credential theft.

The 2026 Australian Census is an opportunity to reinforce that lesson. Australians should be confident that when they enter sensitive information, they are using the genuine government service.

Trusted access routes, clear public communication and phishing-resistant authentication can help build that confidence.

A successful digital Census in Australia will not be measured solely by whether the website stays online. It will also be measured by whether Australians can participate without the risk of handing credentials or valuable personal information to an impostor.