ATO to make changes to restricted access for compromised accounts

The ATO plans to make changes to restricted access for compromised taxpayer accounts which would enable agents to access to prefill information for these accounts without having to contact the office.

The upcoming change was shared on Wednesday afternoon via a ‘Tax Professionals news’ newsletter.

The decision to change the process followed a review of the process for restricting agents access to prefill information on compromised taxpayer accounts.

“This change will enable agents to have the same prefill experience for compromised taxpayers as they do with non-compromised in both Online services for agents and wholesale software environments,” the ATO said.

“Initially, agents will be able to access prefill data for financial years 2022-25.”

According to the ATO, to remove additional security measures, there had been a “steady uptake” of taxpayers with compromised accounts locking in a strong Online Access Strength.

Taxpayers were warned that if they didn’t, or were unable to, lock in a strong Online Access Strength the restrictions for accessing non-prefill information for compromised accounts would remain, and clients or their agents would need to contact the ATO for assistance.

“A reminder that once a taxpayer with a compromised account locks in a strong Online Access Strength, they’ll no longer have digital access restrictions on their account so wherever possible we encourage taxpayers to lock in a strong Online Access Strength,” the ATO said.

“We will continue to review the controls on taxpayer accounts where they have been a victim of fraud and make changes to the security protocols as required.”

The ATO added that using a strong myID was the most secure way to access its online services and help protect against further identity crime and tax fraud.

This announcement and proposed change to the system follows various media reports claiming the ATO’s systems had been hacked and that taxpayer information had been leaked.

The ATO responded to the claims, stating its systems were “secure, resilient and had not been compromised” and that the safety of taxpayers’ information was of the “utmost importance”.

If taxpayers had noted unusual activity on their account, it had been compromised, or something appeared to be wrong, they were encouraged to contact the ATO immediately.