Tax authority correspondence

Detects correspondence from a tax authority to an identified taxpayer: ATO notices of (amended) assessment, audit and review letters, QRO notices, IRS CP notices and HMRC letters, with taxpayer identifiers and amounts payable, penalties or response dates.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: the primary phrases also appear in policies, guidance, blank forms and news, so enforce tiers require a populated field with a non-placeholder value and 85 adds a record-specific populated detail plus independent corroboration. Person and record values are customer-defined, so the field regexes use labelled loose values with a placeholder guard. 85/75 are heuristic evidence tiers, not measured accuracy.
Detection quality: Topic false positive
Jurisdictions: au, global
Regulations: Taxation Administration Act 1953 (Cth), Taxation Administration Act 2001 (Qld), Privacy (Tax File Number) Rule 2015 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld)
Frameworks: ISO 27001, ISO 27701
Data categories: financial, pii
Scope: wide
Risk rating: 4
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:tax\s+authority\s+correspondence|notice\s+of\s+(?:amended\s+)?assessment|(?:ATO|Australian\s+Taxation\s+Office|Queensland\s+Revenue\s+Office|IRS|HMRC)\s+(?:letter|correspondence|notice|audit|review)|(?:tax|revenue)\s+(?:audit|review)\s+(?:letter|notice|commencement)|notice\s+of\s+(?:audit|review|intention\s+to\s+(?:audit|assess))|IRS\s+notice\s+CP\d{2,4}|penalty\s+notice\s+(?:for|-)\s+(?:late\s+)?lodg(?:e)?ment)\b

Corroborative evidence keywords

Commissioner of Taxation, Taxation Administration Act, income year, tax return, objection, amended, shortfall, income tax return

Proximity: 300 characters

Should match

Notice of amended assessment - individual Taxpayer name: Avery Teston Income year: 2025 Amount payable: $2,418.60 Due date: 21/10/2026 Issued by the Commissioner of Taxation. — 85: notice of amended assessment with taxpayer, amount payable, due date and Commissioner
ATO letter - commencement of review Our reference: 1-2FKQ8ZP Client name: Harbourline Trading Pty Ltd We are reviewing your 2024-25 income tax return. Respond by 15/11/2026. Shortfall penalty: $3,120.00 may apply. — 85: ATO review letter with client name, reference, response date and shortfall penalty
HMRC correspondence regarding taxpayer: Morgan Teston - scanned letter saved to the client file. — 75: HMRC correspondence naming the taxpayer, no amounts or dates
notice of assessment — 65: bare phrase only - discovery tier

Should not match

Scam alert: the ATO will never send you a link asking for your details in a notice of assessment email. This page explains how to verify contact. — Scam warning guidance - must stay at or below 65
Notice of assessment Taxpayer name: __________ Amount payable: $______ Due date: __/__/____ — Blank notice template - must stay at or below 65
The IRS notice CP2000 program sent a million letters last year, according to a news release. — News - must stay at or below 65
unrelated generic text without domain phrases — No relevant topic phrases present

Known false positives

Policies, procedures, regulator guidance, fact sheets and training material that name the record type. Mitigation: Enforce tiers require populated fields; guidance has labels without values, and policy/guidance/training/media-release framing is excluded by the NOT-group.
Blank forms, templates and system configuration screens. Mitigation: Blank lines, bracket placeholders, XXX and n/a/tbc values are rejected by the placeholder guard; template/fixture words are excluded by template-exclusion.
News, statistics and vendor marketing. Mitigation: No populated person or record fields, so these stay at 65 discovery.
Phishing emails that imitate tax authority notices. Mitigation: These may reach 75/85 if they contain populated fields; they still warrant review as security events.