It comes after Fairfax Media revealed identity fraudsters were obtaining hundreds of tax file numbers every day and had targeted the ATO more than 11,000 times in the 2014-15 financial year in an attempt to steal tax refunds.

Second Commissioner Geoff Leeper is leading an investigation team that is looking closely at five cases after several victims of refund theft contacted Fairfax Media.

He said the department will now look at whether taxpayers should have to supply additional verification, such as a passport or licence, when lodging their tax returns.

The development also comes as security experts raised concerns about the handling of IT security issues by the ATO and the Department of Human Services, which runs the overarching service portal myGov.

The victims whose cases the ATO is investigating had either had fraudulent tax returns lodged in their name, or legitimate refunds siphoned off after thieves changed their bank details and claimed thousands of taxpayer dollars.

In at least three of the cases under investigation, the taxpayers fell victim to thieves two financial years in a row after additional security checks installed on their ATO files were either bypassed, overridden or ignored.

One of the victims, Joshua Ferguson, a teacher at Mosman High School in Sydney, has been a target on multiple occasions after fraudsters first lodged a false return and set up a fake myGov account in his name last year.

The first attempt failed after it was picked up by the ATO's fraud controls, but a second attempt, in December 2014, was successful and thieves claimed more than $2500 in stolen taxpayer funds.

Mr Ferguson said when his accountant lodged his legitimate return in April this year, the ATO interpreted this as an amendment to the fraudulent return lodged in December and sent a cheque for $150, when he was actually due about $2700.

Additional security checks were put on his file after he contacted the ATO, and he was promised a reimbursement of the rest of his refund.

"I was waiting to receive it and that refund got intercepted again," Mr Ferguson said.

Mr Leeper said cases where security controls had been bypassed appeared to be the result of "administrative errors" by staff members but his team was still investigating how the mistakes occurred.

He said in one of the cases, a refund had been correctly identified as potentially fraudulent "and a staff member chose to release it".

"Now we're looking at why that decision was made because it's not a decision that should have been made," he said.

"There's no evidence of internal collusion, but there's still an issue for us to sort out as to why it would be that someone did something which was apparently against our fraud control models."

The ATO is unsure how the identity thefts occurred but is looking at links between the cases, including three of the victims having a common employer – the NSW public service.

It has found no evidence so far that any of the victims had had their computers or other devices hacked.

Actions allegedly taken by an employee of one tax practice have also been referred to the Australian Federal Police and Mr Leeper said the ATO was having broader discussions with police about onshore and offshore gangs targeting Australian taxpayers.

He said the ATO had delayed 26,000 returns that were suspected to involve identity crime, but the fact some were still slipping through the net meant it might have to consider whether taxpayers should require more rigorous ID checks.

"What we're thinking about is how we respond and what more we can do to make it harder for people to pretend that they're someone for tax purposes," he said.

"Do we put everybody through that experience to close off what might be a handful of ID theft issues? It's this whole issue of how do you make something easy and convenient to use, while providing the maximum degree of protection."

Do you know more? Have you been a victim of tax refund theft? Email lisa.cox@fairfaxmedia.com.au