You can never be paranoid enough.
Have you checked to make sure it was from the ATO?
To my knowledge they always have a contact number and reference number.
Had a few call backs from banks and I always ask them for name, contact number, reference number and to confirm last time of...