Latest / The Front / Have hackers stolen your tax refund?

Transcript

Have hackers stolen your tax refund? · The Front

• 0:03
  Speaker 1: From The Australian. Here's what's on the front. I'm Kristan Amiot.
• 0:06
  Speaker 1: It's Monday, May nineteen, twenty twenty five. Prime Minister Anthony
• 0:13
  Speaker 1: Alberizi met with Ukrainian President Voladimir Zelenski on the sidelines
• 0:17
  Speaker 1: of Pope Leo's inauguration mass in Rome on Sunday. The
• 0:21
  Speaker 1: pair discussed the incarceration of Australian man Oscar Jenkins, who
• 0:25
  Speaker 1: was sentenced to thirteen years in a Russian prison after
• 0:29
  Speaker 1: being caught fighting on the front lines for Ukraine. To
• 0:35
  Speaker 1: net zero or not to net zero? That's the question
• 0:38
  Speaker 1: looming over new Liberal Party leader Susan Lay. She's under
• 0:42
  Speaker 1: pressure from some MPs not to support a twenty to
• 0:45
  Speaker 1: fifty emissions policy that they say demands a blank check.
• 0:50
  Speaker 1: That exclusive story is live right now at the Australian
• 0:53
  Speaker 1: dot Com dot AU. Hackers have harvested potentially millions of
• 1:00
  Speaker 1: dollars from unsuspecting taxpayers by breaking into their ATO accounts
• 1:05
  Speaker 1: and submitting bogus tax returns. The Australian Taxation Office says
• 1:10
  Speaker 1: its systems are safe from cyber threats, but The Australian's
• 1:13
  Speaker 1: Paul Garvey believes there's evidence to suggest a breach like
• 1:17
  Speaker 1: this has been a long time coming. When Kate Quinn's
• 1:30
  Speaker 1: accountant logged in to complete her tax return at the
• 1:32
  Speaker 1: end of the last financial year, she made a shocking
• 1:35
  Speaker 1: discovery her tax account had been hacked and her tax
• 1:40
  Speaker 1: return was gone paid out to a mystery bank account.
• 1:45
  Speaker 2: So they hacked in, They unticked notify me or notify
• 1:48
  Speaker 2: my tax agent, change the bank account details. He said,
• 1:51
  Speaker 2: it probably takes all of ten to fifteen seconds, and
• 1:56
  Speaker 2: the money's gone, and the case is closed, and no
• 1:58
  Speaker 2: one's notified, and then the bank account is closed. And
• 2:02
  Speaker 2: I just thought this is unbelievable that it's so easy.
• 2:08
  Speaker 1: And the thing is, Kate's predicament isn't unique.
• 2:13
  Speaker 2: I reckon it's the chip of the eyes Berg. Well,
• 2:16
  Speaker 2: I think it's happened to thousands.
• 2:22
  Speaker 3: The picture that's emerging is that hackers have been able
• 2:26
  Speaker 3: to obtain the personal details of a whole lot of
• 2:29
  Speaker 3: Australian taxpayers and their tax file numbers and basically use
• 2:33
  Speaker 3: that data to find their way into the MyGov system
• 2:38
  Speaker 3: and then they'll submit these fraudulent tax returns.
• 2:41
  Speaker 1: Paul Garvey is a senior reporter with the Australian.
• 2:45
  Speaker 3: It seems as though about eight thousand dollars is the
• 2:47
  Speaker 3: magic number that these hackers go after, and that it's
• 2:50
  Speaker 3: large enough to make it worth their while, but not
• 2:52
  Speaker 3: so large that triggers the automatic red flags within the
• 2:55
  Speaker 3: ato's own system. The other scary thing here is that
• 2:59
  Speaker 3: the hacks, by and large seem to be found almost
• 3:03
  Speaker 3: by accident, when individuals or their accountants go to lodge
• 3:07
  Speaker 3: that year's tax return and find hang on this tax
• 3:10
  Speaker 3: returns already been lodged. So that's when the alarm bells ring.
• 3:13
  Speaker 3: And so it's really quite concerning that these things are
• 3:17
  Speaker 3: happening at this sort of scale and seemingly off the radar.
• 3:22
  Speaker 1: The ATO uses multi factor authentication to protect users online accounts.
• 3:28
  Speaker 1: That's where you plug in a unique code received via
• 3:30
  Speaker 1: email or text message before you can log in, and
• 3:34
  Speaker 1: voice prints to help identify us. When we pick up
• 3:37
  Speaker 1: the phone and call thank you.
• 3:39
  Speaker 4: For pulling the Australian Taxation Office Individual Info Line. We've
• 3:44
  Speaker 4: introduced a highly secure and faster way to access your information.
• 3:49
  Speaker 4: Your call will be recorded to improve our services and
• 3:52
  Speaker 4: to create your unique voice print, which may be used
• 3:55
  Speaker 4: to verify your identity.
• 3:58
  Speaker 1: But the multi factor authentication wasn't triggered when Kate's account
• 4:02
  Speaker 1: was compromised, and nobody seems to know how the hackers
• 4:05
  Speaker 1: are getting around it.
• 4:07
  Speaker 3: These are the processes that they're annoying when we have
• 4:10
  Speaker 3: to go through them in our day to day lives,
• 4:12
  Speaker 3: but they're there for a very good reason, and that
• 4:14
  Speaker 3: is to prevent this sort of thing happening. And it
• 4:16
  Speaker 3: seems as though that system, for whatever reason, is just
• 4:19
  Speaker 3: breaking down inside the ato's processes here, that those two
• 4:23
  Speaker 3: factor authentications aren't triggering at the right times, aren't triggering
• 4:27
  Speaker 3: for the right sort of matters, and really open the
• 4:29
  Speaker 3: door of these kind of incidents. And it's something that's
• 4:31
  Speaker 3: been identified previously in investigations into the ato's online security systems.
• 4:37
  Speaker 3: And if these cases of Kate and other people I've
• 4:40
  Speaker 3: spoken to another accounts that I've read are accurate, then
• 4:44
  Speaker 3: there seems to be a lingering issue in the way
• 4:46
  Speaker 3: these things are managed.
• 4:48
  Speaker 1: And so, Paul, what's the ATO doing to recover that
• 4:51
  Speaker 1: money that's been fraudulently paid out to the hackers.
• 4:54
  Speaker 3: It would be great to get some more information from
• 4:57
  Speaker 3: the ATO on this, because it would seem to me
• 5:00
  Speaker 3: from the outside like it should be quite straightforward, right.
• 5:04
  Speaker 3: This money's being sent to a bank account, and we
• 5:08
  Speaker 3: have all these sorts of know your customer laws in Australia,
• 5:11
  Speaker 3: all these money laundering laws in Australia where banks are
• 5:14
  Speaker 3: supposed to be able to know just who is actually
• 5:17
  Speaker 3: holding these bank accounts. Yet there's been no clear explanation
• 5:21
  Speaker 3: to me that those requirements are actually being effective here
• 5:27
  Speaker 3: identifying who is actually receiving this money and are they
• 5:30
  Speaker 3: getting it back from them. It's a big issue for
• 5:32
  Speaker 3: the at cloring this back and we would love to
• 5:34
  Speaker 3: know how successful they're being and if they're not being successful,
• 5:37
  Speaker 3: what needs to change to get that money back because
• 5:40
  Speaker 3: it belongs to all of us. It's tax payer money
• 5:42
  Speaker 3: at the end of the day, and we need to
• 5:44
  Speaker 3: get these moneies back.
• 5:49
  Speaker 1: Over a series of phone calls, Kate Quinn, who works
• 5:52
  Speaker 1: in the not for profit sector, was told she could
• 5:54
  Speaker 1: face a long wait to see the situation resolved.
• 5:58
  Speaker 2: I was told would be waiting up to a year
• 6:03
  Speaker 2: while they investigate. And I said, no, this is not right.
• 6:06
  Speaker 2: I pay my taxes, this is my money. And I said,
• 6:10
  Speaker 2: I don't see why you can't honor this, and they said, yeah,
• 6:14
  Speaker 2: it doesn't work like that. You'll be waiting quite a
• 6:17
  Speaker 2: long time. She kept on them, so I gave it
• 6:21
  Speaker 2: a few months and I called back just to annoy them,
• 6:25
  Speaker 2: and they all said it's under investigation for yours and
• 6:29
  Speaker 2: a ton of others.
• 6:32
  Speaker 1: Kate did eventually receive her tax refund, but not everyone
• 6:36
  Speaker 1: who was hacked has seen the same outcome.
• 6:39
  Speaker 3: Looking at the ato's own community page where people can
• 6:42
  Speaker 3: go up there and post questions for the ATO, you
• 6:45
  Speaker 3: can see there's multiple people all saying the same sort
• 6:48
  Speaker 3: of thing, and you can imagine the panic as well
• 6:50
  Speaker 3: for individuals when they find this out right, because a
• 6:53
  Speaker 3: lot of people are terrified that they will be obliged
• 6:57
  Speaker 3: to pay back that fraudulent return themselves. There's the uncertainty
• 7:01
  Speaker 3: that comes with that. And also for a lot of people,
• 7:04
  Speaker 3: that tax return money can be a really important piece
• 7:09
  Speaker 3: of financial relief. Right these are tough financial times, cost
• 7:12
  Speaker 3: a living crisis. That couple of grand in your pocket
• 7:15
  Speaker 3: on the back of a tax return can be the
• 7:17
  Speaker 3: thing that really keeps a lot of families afloat. And
• 7:20
  Speaker 3: so if there's fraud hanging over that account, can they
• 7:23
  Speaker 3: actually go ahead and claim their legitimate entitlement. So it's
• 7:26
  Speaker 3: a scary process and it's not a quick process to
• 7:28
  Speaker 3: resolve either, So that's a lot of sleepless nights for
• 7:31
  Speaker 3: a lot of people when wanted to get this resolved.
• 7:34
  Speaker 1: So how many people are we talking here?
• 7:36
  Speaker 3: I did ask them that direct question, and the response
• 7:38
  Speaker 3: that came back with didn't address that. I can see
• 7:41
  Speaker 3: through other reports that there's certainly many instances, at least dozens.
• 7:46
  Speaker 3: But interestingly, talking to people like Kate who have been
• 7:49
  Speaker 3: through this process, when they're talking over the phone to
• 7:52
  Speaker 3: ato people, they can start to gauge from the conversations
• 7:57
  Speaker 3: to how big an issue this is. And Kate's come
• 8:00
  Speaker 3: away convinced that this is a matter of four thousands
• 8:03
  Speaker 3: of people. And when you think of the sheer number
• 8:05
  Speaker 3: of taxpayers, you only need a tiny sliver of them
• 8:09
  Speaker 3: to be compromised to get some pretty chunky numbers pretty fast.
• 8:13
  Speaker 3: And in some cases the hackers are actually putting in
• 8:17
  Speaker 3: not just the most recent years refund but also prior
• 8:21
  Speaker 3: years as well, So going back a second and a
• 8:23
  Speaker 3: third time to make more and more claims, you're talking
• 8:26
  Speaker 3: about twenty thousand dollars plus for each of these individuals
• 8:30
  Speaker 3: and that's money that I guess belongs to each and
• 8:34
  Speaker 3: every one of us, right it's paid out by the
• 8:35
  Speaker 3: Tax Office incorrectly. We're all on the hook for that
• 8:38
  Speaker 3: at the end of the day. So it really is
• 8:41
  Speaker 3: a problem that really everyone should be concerned about.
• 8:48
  Speaker 1: Coming up. Why this storm's been brewing for a while.
• 9:08
  Speaker 1: When Kate Quinn flicked on the TV about a month ago,
• 9:11
  Speaker 1: she caught the end of a news bulletin about a major.
• 9:14
  Speaker 2: Hack and I thought, Ah, this is it. I knew
• 9:17
  Speaker 2: this would happen, but it was people super being hacked into.
• 9:24
  Speaker 5: Several Australian superannuation funds have been targeted by cyber criminals.
• 9:29
  Speaker 5: It's caused panic and frustration for thousands of members who've
• 9:33
  Speaker 5: been unable to check whether their nest egg has been impacted.
• 9:38
  Speaker 1: The question now is how has a hack of the
• 9:41
  Speaker 1: Australian Tax Office managed to fly under the radar for
• 9:45
  Speaker 1: so long. Here's Paul Garvey diving into this.
• 9:49
  Speaker 3: I can see that this has been a brewing issue
• 9:53
  Speaker 3: for the ATO for a long time now, well over
• 9:56
  Speaker 3: a decade that there's been that these weaknesses have emerged.
• 10:01
  Speaker 3: So as taxes become more and more in the online sphere,
• 10:05
  Speaker 3: moving away from those old paper tax returns, if you're
• 10:08
  Speaker 3: old enough to remember what they were like. Each step
• 10:10
  Speaker 3: of the way, there's been I guess, holes in the system,
• 10:14
  Speaker 3: holes in the Swiss Cheese that have allowed these sort
• 10:17
  Speaker 3: of things to happen at varying scale along the way.
• 10:21
  Speaker 3: It's almost become perhaps part of the furniture of tax
• 10:24
  Speaker 3: in Australia. The other thing is a lot of hacking
• 10:28
  Speaker 3: incidents we hear about. There'll be the little old lady
• 10:32
  Speaker 3: who's had a bank accounts cleaned out, the retiree who's
• 10:35
  Speaker 3: watched their super fun disappear. These direct hip pocket hits,
• 10:40
  Speaker 3: brutally cruel attacks on individuals that cripples them immediately and tangibly.
• 10:46
  Speaker 3: Where is this We're talking about tax returns that people
• 10:49
  Speaker 3: may have even forgotten to lodge themselves, didn't even know
• 10:52
  Speaker 3: where they're or that they had lodged previously, and which
• 10:54
  Speaker 3: have since been amended. The victim as such isn't being
• 10:58
  Speaker 3: the one fleeced here erectly, so it doesn't have that
• 11:02
  Speaker 3: same kind of bite in that sense if you follow
• 11:06
  Speaker 3: what I'm saying, and look, you could also probably draw
• 11:09
  Speaker 3: a line to think that maybe there's an element of
• 11:12
  Speaker 3: self preservation here from the ATO. I mean, it looks like,
• 11:15
  Speaker 3: talking to people like Kate and to accountants out there,
• 11:19
  Speaker 3: that the ATO probably hasn't covered itself in glory in
• 11:23
  Speaker 3: ensuring that its systems are as robust as we might
• 11:26
  Speaker 3: expect from an agency as well respected and well resourced
• 11:30
  Speaker 3: as the ATO. They might not be exactly ecstatic to
• 11:33
  Speaker 3: be putting up in lights that some shortcomings in the
• 11:36
  Speaker 3: system may have at best contributed to these outcomes here.
• 11:41
  Speaker 3: So there's a few reasons I think why it hasn't
• 11:44
  Speaker 3: necessarily blown up as large as it perhaps deserves to be.
• 11:49
  Speaker 1: Labor of course, went to the election promising instant tax
• 11:52
  Speaker 1: refunds of up to one thousand dollars for eligible Australians.
• 11:55
  Speaker 1: That's not due to come into effect until the middle
• 11:58
  Speaker 1: of twenty twenty seven, at the end of the twenty
• 12:00
  Speaker 1: six twenty seven financial year. But does a breach of
• 12:03
  Speaker 1: this magnitude have implications for that plan?
• 12:07
  Speaker 3: It most definitely should, because one thing that we've seen
• 12:11
  Speaker 3: consistently over the years is that for every step taken
• 12:17
  Speaker 3: in terms of security or in every initiative taken by
• 12:22
  Speaker 3: a state or federal government in trying to provide some
• 12:24
  Speaker 3: form of tax relief. There there are a whole bunch
• 12:27
  Speaker 3: of hackers who are pouncing on that and trying to
• 12:29
  Speaker 3: stay a few steps ahead of where regulators lawmakers are
• 12:34
  Speaker 3: in dealing with this sort of thing. So I would
• 12:36
  Speaker 3: have thought that this very clearly should remind the federal
• 12:41
  Speaker 3: government of what can happen, of the needs for these
• 12:45
  Speaker 3: sorts of precautions, and to be constantly thinking where are
• 12:49
  Speaker 3: the vulnerabilities, how to prevent this from being illegally exploited.
• 12:54
  Speaker 3: Like we've said, this has been going on in some
• 12:56
  Speaker 3: shape or form for many years now. That's certainly not
• 12:58
  Speaker 3: a problem that's specific to one side of government over another,
• 13:01
  Speaker 3: but it most certainly will undermine that public confidence that
• 13:05
  Speaker 3: we have in this. So that's certainly something for the
• 13:08
  Speaker 3: atl itself and also for lawmakers to firmly keep in mind.
• 13:16
  Speaker 1: Paul Garvey is a senior reporter with The Australian. The
• 13:21
  Speaker 1: Australian Tax Offics told Paul its systems are secure, resilient
• 13:25
  Speaker 1: and have not been compromised. You can read his report
• 13:28
  Speaker 1: right now at The Australian dot com dot au