Hackers targeting ATO tax refunds using stolen identities

While victims, accountants and the tax ombudsman have all flagged issues in the myGov and ATO systems, the ATO says the incidents likely related to identity theft.

Perth woman Kate Quinn, who discovered hackers had filed a fraudulent tax return in her name. Picture: Colin Murty

You can now listen to The Australian's articles. Give us your feedback.

You can now listen to The Australian's articles.

Hackers are harvesting potentially thousands of bogus tax returns as they exploit ongoing security weaknesses in the Australian Taxation Office’s online portal and the commonwealth’s myGov system.

Unsuspecting taxpayers and their accountants are discovering that hackers have infiltrated their myGov accounts, filed fake tax returns and directed the refunds to their own bank accounts despite the ATO having taken steps to clamp down on the practice.

The incidents are the latest of several brazen massive frauds and hacking attacks around Australia, including a series of hacks targeting superannuation funds in April, and they show the ongoing ­dangers posed by hackers who are holding information stolen from prior data breaches.

While victims, accountants and the tax ombudsman have all flagged issues in the myGov and ATO systems that they say have at least contributed to the success of the frauds, the ATO said incidents of “unusual activity” in ATO ­accounts were likely related to identity theft.

“Identity information can be compromised in a variety of ways, including requests for information by malicious actors, phishing emails, large-scale data breaches, and individual device or home ­network hacking,” the ATO said.

“The ATO can confirm that its systems are secure, resilient and have not been compromised.

“The ATO continues to remain vigilant for new and emerging cyber threats.”

Questions to the ATO about the exact number of Australians caught up in the saga, the amount of money both paid out to and recouped from fraudulent returns, and whether or not any arrests have been made over the incidents, were not addressed. But victims who have been through the process of resolving the breaches believe there are likely thousands of others in the same position.

Perth woman Kate Quinn, who works in the not-for-profit sector, discovered that hackers had filed a fraudulent tax return in her name earlier this year when her husband asked their accountant to prepare their tax returns.

The accountant found that they were no longer authorised to manage her tax affairs and that an $8000 tax return had been lodged on her behalf for the last financial year. The hackers had changed ­Ms Quinn’s linked bank account details, ensuring that they received the tax refund.

Kate Quinn said she was staggered to find how easy it was for hackers to commit the frauds. Picture: Colin Murty

Ms Quinn told The Australian she was staggered to find just how easy it was for hackers to commit the frauds when armed with the necessary information.

She said ATO officers had told her that it could take hackers only seconds to execute the fraud.

“They hack in, they untick ‘notify me or notify my tax agent’ and change the bank account details. (The ATO officer) said it probably takes all of 10 to 15 seconds (to) change the bank account details and the money’s gone, and the case is closed and no one’s notified,” she said.

Ms Quinn said the changes to her myGov information were made without triggering any of the two-factor authentication processes designed to reduce the risk of hacking incidents.

She said she was shocked to discover during her interactions with the ATO just how common such incidents were.

She said she spoke to several ATO personnel who were working full-time solely on investigating and resolving such incidents, and as a result of those interactions believed there were thousands of other people in the same situation.

She was initially told the backlog of cases was so large that her matter might take at least a year to resolve, but after four months she escalated her matter to the ATO’s complaints department and had it sorted out in a matter of days.

“There are people who are really desperate to get their returns and people who would have been counting on that money. I just find it incredible,” she said.

More than 14 million taxpayers have linked their myGov account to their ATO Online accounts.

Accountant Adrian Raftery told The Australian one of his clients had an almost identical experience. Like with Ms Quinn, the fraud was discovered only when the accountant went to file the most recent tax return.

In this case, the hackers had not only filed a new tax return but had also successfully amended the prior year’s return and had tried and failed to amend another. The hackers had successfully collected more than $14,000 in fraudulent returns before their third attempt failed.

He said the ATO should have systems in place to automatically flag instances where bank account details were changed, tax agents removed and amended or unusually large returns filed.

“If there was an amendment done to a prior-year return that was lodged by a tax agent previously, but an amendment is done personally, that should be a trigger point for the ATO, combined with a change in bank account details,” he said.

The original source of the data used for the hacks was unclear, but Mr Raftery suspected much of the information may have come from historical data hacks of large super funds. He said he believed full scale of the hacking was likely to be much larger than authorities believed.

“I’m certain there’s probably been a lot of $1000, $2000 and $3000 refunds that have been ­issued to third parties without people knowing,” he said.

The claiming of fraudulent returns through myGov and the ATO’s online portal has long been an issue. The Inspector-General of Taxation and Taxation Ombudsman previously launched an investigation into the problem in late 2023 and handed down interim findings more than a year ago.

That report made more than a dozen recommendations aimed at tightening the ATO’s systems, including introducing additional security measures for instances where bank account details and contact information were changed.

The ombudsman found at the time the ATO had “limited” automated checks and controls, and its account monitoring processes likely had “limited effectiveness in mitigating the risk”.

In a statement, the ATO said it had taken a number of steps to improve its security.

“In the past year, we have introduced a range of measures to better protect client identity and accounts, including Online Access Strength, client-agent linking, and a new risk model ­targeting fraudulent links to the ATO’s Online Services for Individuals,” the ATO said.

“We continue to encourage individuals to use myID when interacting with the ATO’s online services and to set up to the highest identity strength where possible to make it harder for fraudsters to exploit their identities.”