The Hidden Danger of Emailing Tax File Numbers (TFNs)
Every small to medium enterprise (SME) in Australia goes through the process of onboarding new employees. Usually, this means collecting the holy trinity of personal data: banking details, identity documents, and most importantly, the Tax File Number (TFN). But if you are still asking employees to email their TFN, or sending them a PDF form to fill out and email back, your business is taking on an enormous legal and financial liability.
As cybersecurity threats targeting Australian businesses skyrocket, knowing how to safely collect TFN online has transitioned from an "IT best practice" to a fundamental business requirement under the Privacy Act 1988.
The Legal Repercussions of TFN Mishandling
In Australia, TFNs are heavily protected. Under the Privacy Act and the TFN Rule 2015, businesses must take "reasonable steps" to protect TFN data from misuse, interference, loss, unauthorized access, modification, or disclosure.
Regular email provides virtually none of these protections. Standard emails are sent in plain text across multiple servers and can be intercepted. More commonly, emails sit unencrypted in an inbox. If a business email gets compromised (Business Email Compromise or BEC)—a hacker instantly gains access to every single TFN, passport, and bank account your new hires ever sent you.
The True Cost of a Breach
When an employee's TFN escapes, they are immediately at risk of identity theft and financial fraud. For the business that leaked it, the penalties are catastrophic. Fines for serious invasions of privacy can reach up to $50 million for corporations. But even without the maximum fine, the reputational damage and the administrative nightmare of notifying the Office of the Australian Information Commissioner (OAIC) and affected employees can easily sink a small business.
Why Portals and Cloud Storage Fall Short
Many SMEs realized the dangers of email and switched to using generic cloud storage links (like Dropbox or Google Drive) or built-in HR portals. While better than email, these solutions still have significant vulnerabilities:
- Permanent Digital Footprints: If a document sits in an HR portal forever, you have to defend that portal indefinitely. If you don't actually need to store the TFN once you've logged it in your ATO portal or payroll software, keeping the document is just hoarding liability.
- Server-Side Vulnerability: When you upload a file to a standard cloud provider, they hold the encryption keys. If the provider gets breached, or if an attacker steals your login credentials, the TFNs are exposed.
The Gold Standard: Zero-Knowledge Encryption
To completely eliminate the liability of collecting TFNs, you shouldn't just encrypt the data—you should use an architecture where the server never knows what the data is in the first place.
This is called Zero-Knowledge Encryption. In a zero-knowledge ecosystem, the data is encrypted on the sender's device before it is ever transmitted. The server only receives a locked vault of scrambled data. The keys to unlock that vault never touch the server; they remain exclusively on the receiver's device.
This means even if a hacker breaches the database, all they get is mathematical noise. They cannot steal the TFN because the decryption key simply doesn't exist on the server.
You can read more about the technical breakdown of this architecture in our article on How We Built a Zero-Knowledge Exchange.
How to Implement Secure Collection in Your SME
We designed the TFN Safe Drop tool specifically to solve this onboarding problem for Australian SMEs without requiring expensive enterprise IT setups.
Step 1: Shift to "Safe Drops"
Instead of emailing a form, send your new hire a secure Safe-Drop link. When the employee clicks the link, their browser establishes an asymmetric encryption tunnel.
Step 2: Client-Side Encryption
The employee inputs their TFN, uploads their Passport photo, and adds their BSB and Account Number. The moment they hit "Send," their web browser encrypts the data using an AES-GCM Symmetric Key, and then locks that key with the employer's RSA Public Key. All of this happens instantly on the employee's phone or laptop, before it travels over the web.
Step 3: Reveal and Burn
You receive a notification. You open the link, and your browser uses the Private Key stored locally on your machine to decrypt the file. You copy the TFN straight into your payroll software (like Xero or MYOB) or your SBSCH portal.
Here is the most critical step: Burn the data. Once the TFN is secure in your compliant payroll system or the ATO portal, you don't need the original document anymore. SME Stack's Safe Drop automatically "Burns" (permanently deletes) the encrypted blob after you've viewed it. If you don't store it, it can't be stolen.
Integrating Security with Future Compliance
Securing your data collection process is just the first step in future-proofing your business. With the upcoming 2026 closure of the Small Business Superannuation Clearing House (SBSCH), SMEs must move their historical payroll data to new systems. If you're managing this transition, ensure you are using robust tools like our SBSCH Migrator to convert old PDF records into the SuperStream-compliant SAFF 1.3 format without compromising the TFNs embedded within them.
Conclusion: Make Security Your Competitive Advantage
Understanding how to safely collect TFN online shouldn't be an IT headache; it should be a seamless part of your onboarding experience. When new employees see that you use end-to-end encrypted tunnels for their sensitive information instead of asking for unsecure emails, it builds immediate trust.
Stop risking your business on an unencrypted email. Start utilizing zero-knowledge exchange today, adopt a "No-Storage" policy for transient onboarding data, and ensure your SME remains resilient against the rising tide of cyber threats.