Speaker 1: From The Australian. Here's what's on the front. I'm Kristan Amiot.
Speaker 1: It's Monday, May nineteen, twenty twenty five. Prime Minister Anthony
Speaker 1: Alberizi met with Ukrainian President Voladimir Zelenski on the sidelines
Speaker 1: of Pope Leo's inauguration mass in Rome on Sunday. The
Speaker 1: pair discussed the incarceration of Australian man Oscar Jenkins, who
Speaker 1: was sentenced to thirteen years in a Russian prison after
Speaker 1: being caught fighting on the front lines for Ukraine. To
Speaker 1: net zero or not to net zero? That's the question
Speaker 1: looming over new Liberal Party leader Susan Lay. She's under
Speaker 1: pressure from some MPs not to support a twenty to
Speaker 1: fifty emissions policy that they say demands a blank check.
Speaker 1: That exclusive story is live right now at the Australian
Speaker 1: dot Com dot AU. Hackers have harvested potentially millions of
Speaker 1: dollars from unsuspecting taxpayers by breaking into their ATO accounts
Speaker 1: and submitting bogus tax returns. The Australian Taxation Office says
Speaker 1: its systems are safe from cyber threats, but The Australian's
Speaker 1: Paul Garvey believes there's evidence to suggest a breach like
Speaker 1: this has been a long time coming. When Kate Quinn's
Speaker 1: accountant logged in to complete her tax return at the
Speaker 1: end of the last financial year, she made a shocking
Speaker 1: discovery her tax account had been hacked and her tax
Speaker 1: return was gone paid out to a mystery bank account.
Speaker 2: So they hacked in, They unticked notify me or notify
Speaker 2: my tax agent, change the bank account details. He said,
Speaker 2: it probably takes all of ten to fifteen seconds, and
Speaker 2: the money's gone, and the case is closed, and no
Speaker 2: one's notified, and then the bank account is closed. And
Speaker 2: I just thought this is unbelievable that it's so easy.
Speaker 1: And the thing is, Kate's predicament isn't unique.
Speaker 2: I reckon it's the chip of the eyes Berg. Well,
Speaker 2: I think it's happened to thousands.
Speaker 3: The picture that's emerging is that hackers have been able
Speaker 3: to obtain the personal details of a whole lot of
Speaker 3: Australian taxpayers and their tax file numbers and basically use
Speaker 3: that data to find their way into the MyGov system
Speaker 3: and then they'll submit these fraudulent tax returns.
Speaker 1: Paul Garvey is a senior reporter with the Australian.
Speaker 3: It seems as though about eight thousand dollars is the
Speaker 3: magic number that these hackers go after, and that it's
Speaker 3: large enough to make it worth their while, but not
Speaker 3: so large that triggers the automatic red flags within the
Speaker 3: ato's own system. The other scary thing here is that
Speaker 3: the hacks, by and large seem to be found almost
Speaker 3: by accident, when individuals or their accountants go to lodge
Speaker 3: that year's tax return and find hang on this tax
Speaker 3: returns already been lodged. So that's when the alarm bells ring.
Speaker 3: And so it's really quite concerning that these things are
Speaker 3: happening at this sort of scale and seemingly off the radar.
Speaker 1: The ATO uses multi factor authentication to protect users online accounts.
Speaker 1: That's where you plug in a unique code received via
Speaker 1: email or text message before you can log in, and
Speaker 1: voice prints to help identify us. When we pick up
Speaker 1: the phone and call thank you.
Speaker 4: For pulling the Australian Taxation Office Individual Info Line. We've
Speaker 4: introduced a highly secure and faster way to access your information.
Speaker 4: Your call will be recorded to improve our services and
Speaker 4: to create your unique voice print, which may be used
Speaker 4: to verify your identity.
Speaker 1: But the multi factor authentication wasn't triggered when Kate's account
Speaker 1: was compromised, and nobody seems to know how the hackers
Speaker 1: are getting around it.
Speaker 3: These are the processes that they're annoying when we have
Speaker 3: to go through them in our day to day lives,
Speaker 3: but they're there for a very good reason, and that
Speaker 3: is to prevent this sort of thing happening. And it
Speaker 3: seems as though that system, for whatever reason, is just
Speaker 3: breaking down inside the ato's processes here, that those two
Speaker 3: factor authentications aren't triggering at the right times, aren't triggering
Speaker 3: for the right sort of matters, and really open the
Speaker 3: door of these kind of incidents. And it's something that's
Speaker 3: been identified previously in investigations into the ato's online security systems.
Speaker 3: And if these cases of Kate and other people I've
Speaker 3: spoken to another accounts that I've read are accurate, then
Speaker 3: there seems to be a lingering issue in the way
Speaker 3: these things are managed.
Speaker 1: And so, Paul, what's the ATO doing to recover that
Speaker 1: money that's been fraudulently paid out to the hackers.
Speaker 3: It would be great to get some more information from
Speaker 3: the ATO on this, because it would seem to me
Speaker 3: from the outside like it should be quite straightforward, right.
Speaker 3: This money's being sent to a bank account, and we
Speaker 3: have all these sorts of know your customer laws in Australia,
Speaker 3: all these money laundering laws in Australia where banks are
Speaker 3: supposed to be able to know just who is actually
Speaker 3: holding these bank accounts. Yet there's been no clear explanation
Speaker 3: to me that those requirements are actually being effective here
Speaker 3: identifying who is actually receiving this money and are they
Speaker 3: getting it back from them. It's a big issue for
Speaker 3: the at cloring this back and we would love to
Speaker 3: know how successful they're being and if they're not being successful,
Speaker 3: what needs to change to get that money back because
Speaker 3: it belongs to all of us. It's tax payer money
Speaker 3: at the end of the day, and we need to
Speaker 3: get these moneies back.
Speaker 1: Over a series of phone calls, Kate Quinn, who works
Speaker 1: in the not for profit sector, was told she could
Speaker 1: face a long wait to see the situation resolved.
Speaker 2: I was told would be waiting up to a year
Speaker 2: while they investigate. And I said, no, this is not right.
Speaker 2: I pay my taxes, this is my money. And I said,
Speaker 2: I don't see why you can't honor this, and they said, yeah,
Speaker 2: it doesn't work like that. You'll be waiting quite a
Speaker 2: long time. She kept on them, so I gave it
Speaker 2: a few months and I called back just to annoy them,
Speaker 2: and they all said it's under investigation for yours and
Speaker 2: a ton of others.
Speaker 1: Kate did eventually receive her tax refund, but not everyone
Speaker 1: who was hacked has seen the same outcome.
Speaker 3: Looking at the ato's own community page where people can
Speaker 3: go up there and post questions for the ATO, you
Speaker 3: can see there's multiple people all saying the same sort
Speaker 3: of thing, and you can imagine the panic as well
Speaker 3: for individuals when they find this out right, because a
Speaker 3: lot of people are terrified that they will be obliged
Speaker 3: to pay back that fraudulent return themselves. There's the uncertainty
Speaker 3: that comes with that. And also for a lot of people,
Speaker 3: that tax return money can be a really important piece
Speaker 3: of financial relief. Right these are tough financial times, cost
Speaker 3: a living crisis. That couple of grand in your pocket
Speaker 3: on the back of a tax return can be the
Speaker 3: thing that really keeps a lot of families afloat. And
Speaker 3: so if there's fraud hanging over that account, can they
Speaker 3: actually go ahead and claim their legitimate entitlement. So it's
Speaker 3: a scary process and it's not a quick process to
Speaker 3: resolve either, So that's a lot of sleepless nights for
Speaker 3: a lot of people when wanted to get this resolved.
Speaker 1: So how many people are we talking here?
Speaker 3: I did ask them that direct question, and the response
Speaker 3: that came back with didn't address that. I can see
Speaker 3: through other reports that there's certainly many instances, at least dozens.
Speaker 3: But interestingly, talking to people like Kate who have been
Speaker 3: through this process, when they're talking over the phone to
Speaker 3: ato people, they can start to gauge from the conversations
Speaker 3: to how big an issue this is. And Kate's come
Speaker 3: away convinced that this is a matter of four thousands
Speaker 3: of people. And when you think of the sheer number
Speaker 3: of taxpayers, you only need a tiny sliver of them
Speaker 3: to be compromised to get some pretty chunky numbers pretty fast.
Speaker 3: And in some cases the hackers are actually putting in
Speaker 3: not just the most recent years refund but also prior
Speaker 3: years as well, So going back a second and a
Speaker 3: third time to make more and more claims, you're talking
Speaker 3: about twenty thousand dollars plus for each of these individuals
Speaker 3: and that's money that I guess belongs to each and
Speaker 3: every one of us, right it's paid out by the
Speaker 3: Tax Office incorrectly. We're all on the hook for that
Speaker 3: at the end of the day. So it really is
Speaker 3: a problem that really everyone should be concerned about.
Speaker 1: Coming up. Why this storm's been brewing for a while.
Speaker 1: When Kate Quinn flicked on the TV about a month ago,
Speaker 1: she caught the end of a news bulletin about a major.
Speaker 2: Hack and I thought, Ah, this is it. I knew
Speaker 2: this would happen, but it was people super being hacked into.
Speaker 5: Several Australian superannuation funds have been targeted by cyber criminals.
Speaker 5: It's caused panic and frustration for thousands of members who've
Speaker 5: been unable to check whether their nest egg has been impacted.
Speaker 1: The question now is how has a hack of the
Speaker 1: Australian Tax Office managed to fly under the radar for
Speaker 1: so long. Here's Paul Garvey diving into this.
Speaker 3: I can see that this has been a brewing issue
Speaker 3: for the ATO for a long time now, well over
Speaker 3: a decade that there's been that these weaknesses have emerged.
Speaker 3: So as taxes become more and more in the online sphere,
Speaker 3: moving away from those old paper tax returns, if you're
Speaker 3: old enough to remember what they were like. Each step
Speaker 3: of the way, there's been I guess, holes in the system,
Speaker 3: holes in the Swiss Cheese that have allowed these sort
Speaker 3: of things to happen at varying scale along the way.
Speaker 3: It's almost become perhaps part of the furniture of tax
Speaker 3: in Australia. The other thing is a lot of hacking
Speaker 3: incidents we hear about. There'll be the little old lady
Speaker 3: who's had a bank accounts cleaned out, the retiree who's
Speaker 3: watched their super fun disappear. These direct hip pocket hits,
Speaker 3: brutally cruel attacks on individuals that cripples them immediately and tangibly.
Speaker 3: Where is this We're talking about tax returns that people
Speaker 3: may have even forgotten to lodge themselves, didn't even know
Speaker 3: where they're or that they had lodged previously, and which
Speaker 3: have since been amended. The victim as such isn't being
Speaker 3: the one fleeced here erectly, so it doesn't have that
Speaker 3: same kind of bite in that sense if you follow
Speaker 3: what I'm saying, and look, you could also probably draw
Speaker 3: a line to think that maybe there's an element of
Speaker 3: self preservation here from the ATO. I mean, it looks like,
Speaker 3: talking to people like Kate and to accountants out there,
Speaker 3: that the ATO probably hasn't covered itself in glory in
Speaker 3: ensuring that its systems are as robust as we might
Speaker 3: expect from an agency as well respected and well resourced
Speaker 3: as the ATO. They might not be exactly ecstatic to
Speaker 3: be putting up in lights that some shortcomings in the
Speaker 3: system may have at best contributed to these outcomes here.
Speaker 3: So there's a few reasons I think why it hasn't
Speaker 3: necessarily blown up as large as it perhaps deserves to be.
Speaker 1: Labor of course, went to the election promising instant tax
Speaker 1: refunds of up to one thousand dollars for eligible Australians.
Speaker 1: That's not due to come into effect until the middle
Speaker 1: of twenty twenty seven, at the end of the twenty
Speaker 1: six twenty seven financial year. But does a breach of
Speaker 1: this magnitude have implications for that plan?
Speaker 3: It most definitely should, because one thing that we've seen
Speaker 3: consistently over the years is that for every step taken
Speaker 3: in terms of security or in every initiative taken by
Speaker 3: a state or federal government in trying to provide some
Speaker 3: form of tax relief. There there are a whole bunch
Speaker 3: of hackers who are pouncing on that and trying to
Speaker 3: stay a few steps ahead of where regulators lawmakers are
Speaker 3: in dealing with this sort of thing. So I would
Speaker 3: have thought that this very clearly should remind the federal
Speaker 3: government of what can happen, of the needs for these
Speaker 3: sorts of precautions, and to be constantly thinking where are
Speaker 3: the vulnerabilities, how to prevent this from being illegally exploited.
Speaker 3: Like we've said, this has been going on in some
Speaker 3: shape or form for many years now. That's certainly not
Speaker 3: a problem that's specific to one side of government over another,
Speaker 3: but it most certainly will undermine that public confidence that
Speaker 3: we have in this. So that's certainly something for the
Speaker 3: atl itself and also for lawmakers to firmly keep in mind.
Speaker 1: Paul Garvey is a senior reporter with The Australian. The
Speaker 1: Australian Tax Offics told Paul its systems are secure, resilient
Speaker 1: and have not been compromised. You can read his report
Speaker 1: right now at The Australian dot com dot au