Someone Filed My Tax Return Before I Did

A thread popped up online this week that’s been sitting with me since I read it. Someone’s MyGov account got locked for suspicious activity, which turned out to be legitimate, and by the time they worked out what happened, a fraudulent tax return had already been lodged through an agent they’d never heard of, with a $3.5k refund heading to a bank account that wasn’t theirs.

It gets worse. The ATO told them the fraudulent return doesn’t just get deleted. It has to be amended. And if their real return turns out to be worth less than the $3.5k the fraudster already pocketed, they might be issued a debt notice for the difference. The ATO’s framing: that’s a civil matter between you and the criminal who stole your identity.

Sit with that for a second. Someone steals your name, date of birth and tax file number, forges a return in your name through a tax agent you never engaged, has money sent to a stranger’s account, and the government’s first instinct is to potentially bill you for the shortfall. I run infrastructure for a living. If a system in my care let an unauthorised third party drain funds from an account and then told the account holder “that’s between you and them,” I’d be updating my resume, not writing an incident report.

What struck me reading through the comments was how many people had a version of this happen. Multiple failed login attempts, an SMS warning, a locked account. Some got lucky, nothing lodged. Others didn’t. One person mentioned their wife is years into a nightmare of phone calls and Centrelink office visits because her identity is now permanently flagged and every online interaction requires manual verification. That’s not an inconvenience, that’s a second unpaid job.

There’s a genuine, useful discussion in there too. A few people pointed out that banks in this country are legally required to reimburse customers for fraudulent transactions in most circumstances. The ATO, a government agency handling everyone’s most sensitive financial data, apparently isn’t held to the same bar. That’s the bit that gets me. We regulate banks harder than we regulate the tax office. I don’t know why that double standard exists, but I’d love someone to explain it to me without using the word “legacy systems.”

The practical advice in the thread is worth repeating, because it’s the kind of thing you only think about after it’s too late. Switch to MyID, push the authentication strength to Strong, turn on notifications in the ATO app, and get off SMS-based two-factor if you can, it’s the weakest link in the chain now. But here’s the uncomfortable truth someone else raised: none of that would have stopped this particular scam. This wasn’t an account compromise, it was what one commenter called an “accountant compromise.” Someone else’s fraudulent tax agent relationship, established with nothing more than a name, date of birth and TFN, information that sits in payroll systems all over the country with wildly inconsistent security. Passkeys don’t fix that. The system that lets any registered agent effectively claim a taxpayer without their consent is the actual hole.

I did the obligatory thing after reading all this and logged into my own MyGov to double check nothing was amiss. Nothing was, for now, which is its own kind of hollow relief. It’s the digital equivalent of checking under the bed. You know the exercise probably won’t turn anything up, but you do it anyway because the alternative is not knowing.

Australia loves telling itself it’s ahead of the curve on Govtech, the app is slick, the branding is friendly, MyGov ID feels modern. But a slick front door doesn’t mean much if the back door’s held together with an honesty system and hope. I don’t have a tidy fix for this. Better identity verification for tax agents seems like the obvious start, and treating identity fraud as the department’s problem to fix rather than the victim’s problem to prove seems like basic decency, not a big ask.

If you’ve had one of those “unusual activity” texts from MyGov and shrugged it off the way most of us shrug off most warnings these days, it might be worth ten minutes to actually check your tax return status. Cheaper than the three hours on hold you’ll spend later.