Review: ATO’s management of compromised accounts

In April 2024, the Tax Ombudsman published a report of our examination of one aspect of tax identity fraud. That investigation and report focused on the importance of bank account integrity and the ATO’s risk management controls to prevent fraudsters from changing bank account details in legitimate taxpayer accounts. That aspect of the tax identity fraud investigation has been concluded and the ATO’s response to our recommendations has been published online.

Another key aspect of tax identity fraud is the experience of taxpayers (and their representatives) when their tax account is compromised. Feedback from the community and practitioners indicate that affected individuals face significant difficulties. These include challenges in recovering tax refunds lost to fraud and in accessing their tax accounts via myGov or the ATO app, which often requires long wait times on phone calls to unblock. Accordingly, this review will seek to investigate whether the ATO’s management of compromised tax accounts are consistent with the principles of good administration, such as ease of access, low cost of compliance and putting it right.

What will we examine?

• Whether the ATO provides timely and adequate support to taxpayers and their representatives in assisting them to secure and restore their online tax account.
• Whether the ATO’s policies and processes for supporting taxpayers who have tax debts or have lost their tax refunds due to compromised tax accounts are reasonable and proportionate to the risks.
• Whether the ATO’s current processes to prevent future occurrences of compromise are effective and sustainable.
• Opportunities for the ATO to improve its collaboration with other agencies to strengthen coordinated responses and treatment strategies for identity fraud cases, ensuring timely resolution and support for affected individuals.