Thank you Danielle for your reply.
I understand the need for security. I work IT in a PCI environment. I'm using a lot of security systems even at home. The TFN isn't really an identity document. If someone likes to pay my taxes, I'd be happy to give them access :)
The issue here is that this block is making it difficult for a lot of people, not just me, to access important information, for no real reason. Issue new TFNs, notify via email or SMS changes to vital account information such as email, phone or bank account. Simply removing the ability from people to check the status of returns or provide additional information is completely against the ATOs charter.
There is no risk! One can't even login to ATO with the TFN. It requires a myGov account. This hasn't been compromised, relies and multi factor authentication and provided access to more sensitive information such as Centerlink or Medicare.
Blocking the online access makes no sense.
Author: louise88(Initiate)Initiate 1 Dec 2023
Have you had any response? It's a Friday night, and I need historical ATO Notices of Assessment, as I'm finally sititng down to do some "life admin". I now have to wait until Monday morning to speak to someone to unlock my account so I can download my own documents. I agree. How does a compromised TFN warrant permanently disabling your access to your ATO account with having to speak to a human being during business hours, and NSW business hours, at that. And it only gets reactivated for two days. I had already called them earlier in the week and because I didn't get everything I needed then, I have to go through the whole thing again less than a week later. Moreover, they don't even allow you to get a new TFN. Basically, I've been told that I'm going to have to go through this for the rest of my life, which is just ludicrous for a "modern" tax service. There has to be a way to permanently fix this.
Author: louise88(Initiate)Initiate 1 Dec 2023
If they are forcing us to go through this farce, the least they can do is make the service to reinstate it 24/7. Either that or come up with a self-managed system. The driver's licence I'm using to verify my identity is electronic, on my phone. Why is there not a way for the two system to speak to each other? Or for us to input that data ourselves?
A half-official solution (for people interested)
It's been a year, but this was a year of three ATO complaints and a formal complaint to the IGTO. In communications with the ATO, I've been advised that someone accessed my ATO records and changed details like the mobile number (in phone calls obviously something which is hard to verify if that was true). I've never really gotten a single full story out of all. ATO insists that my account credentials were shared or used by someone who has access to my authenticators. The IGTO investigation pointed out an 'overlinking' cause for it and not compromised credentials. That is when someone else creates a second link from an unrelated myGov account. This is still raising a lot of flags as it requires more than just my TFN to link. In my opinion as IT administrator this is a very weak flaw and something which can quite easily be rectified without blocking entire accounts.
The IGTO advised to use Strong authentication through myGovID - something which i weirdly enough always had. I've recently implemented passkeys and removed the password login altogether. This should avoid that i get told again someone may have used my password.
Why a half-official Solution? While i have an investigation with yet another possible root cause and suggestions, none of them are implemented yet and I'm sure this will still be a long debate with the ATO. In my opinion there are several technical options available to the ATO to improve security without entirely locking someone out. Until they take the action to implement those and release my account, I'll refuse to lodge tax returns. With all the investigation details, I'm happy to argue this in court.
816 views
5 replies