ATO attackers filed $557 million in false claims

By

myGov accounts faked using breached identities.

Criminals exploiting a loophole in the government’s digital identity systems filed more than $550 million in false claims over the last two financial years, the ATO has disclosed.

ATO attackers filed $557 million in false claims

The ABC reported this morning that criminals had found they could create bogus myGov accounts, and then link them to real taxpayers’ ATO files.

An earlier December 2022 investigation found attackers were using customer identity information stolen in high-profile data breaches like Optus and Medibank as part of the fraud.

In information released under FoI [pdf], the ATO said more than 15,000 individuals were affected over the two years, with more than 37,000 business activity statements and individual tax return lodgements cancelled, to a total value of $557.8 million.

Some of the false filings were cancelled before they were paid, so it’s not possible to ascertain how much money was actually paid out to the attackers.

The ATO’s response to the FOI covers the two years to February 28, meaning the cost of the fraud could be more for the whole of the 2022-23 financial year.

The ABC reported that the ATO was also uncertain about how much of the $557.8 million was directly attributable to the myGov loophole.

ATO second commissioner Jeremy Hirschhorn told the ABC that the agency was “managing an acceptable level of risk”.

He said the myGov and ATO settings were designed to make systems easy to access for taxpayers, but hard to access for criminals.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Eagers Automotive finds unauthorised access to parts of IT systems

Eagers Automotive finds unauthorised access to parts of IT systems

Hackers hit Victoria's court recording database

Hackers hit Victoria's court recording database

St Vincent's Health Australia warns cyber attack forensics could "take some time"

St Vincent's Health Australia warns cyber attack forensics could "take some time"

Yakult Australia confirms cyber incident

Yakult Australia confirms cyber incident

Log In

  |  Forgot your password?