The existence of the scam shows that it is not just individuals who are in the sights of the identity thieves and that small and large businesses can be used as vehicles for increasingly sophisticated fraudsters.

Fairfax revealed on Friday that a gang of identity thieves had been harvesting the tax file numbers of up to 500 individuals each day and had even managed to get into employers' payroll systems.

But the identities of Australian businesses have also been targeted, by a simple racket operated by criminals lodging a tax return under a bogus identity, telling the Tax Office they worked at the business and claiming a refund on the wages they "earned" there.

The Tax Office says its data-matching systems would ensure that a refund would not be paid out unless the information on the tax return matched that on the employer-issued group certificate.

But one business owner has told Fairfax that their company's identity was used by con artists to successfully claim refunds, triggering a full audit of the firm's affairs by the ATO, but only after the "employees" were long gone.

Has your firm been targeted? Let us know ps@canberratimes.com.au

An ATO spokeswoman said the agency was confident that any such fraud attempt would fail to get past its systems.

Meanwhile, another victim of the Melbourne payroll hack has told Fairfax Media that a fraudulent tax return had been lodged in his name but the attempted theft had been identified by the ATO before any money was paid.

The employee said the alarm was raised within the Tax Office due to the "significant" size of the refund being sought, although tax officials would not tell him the precise amount.

An official contacted the victim and his accountant to notify them of the fraud.

Steps then had to be taken to re-establish his identity and his accountant will also have to notify the Tax Office immediately after he lodges the victim's official tax return.

The victim does not know how his details were stolen, but said a notice had been circulated within his employer that the accountancy firm that manages their payroll had suffered a software breach.

Labor is stepping up its calls for a national investigation into identity fraud against the Commonwealth with the party's human affairs spokesman Doug Cameron writing to the Australian National Audit Office seeking an urgent audit of potential security breaches in Medicare and within the Department of Human Services, which runs the MyGov portal.

University of Adelaide expert Matthew Sorell echoed Senator Cameron's concern on Friday, saying robust security around the ATO's security could be undermined by its links to the "insecure" MyGov portal.

"What we fundamentally haven't got right yet is identity management," Mr Sorell said.

"The identity management content for our government services is quite insecure and what we need is a complete architectural rethink."

The ATO spokeswoman said the agency moved quickly when it became aware of the payroll software security breach, which compromised the identities of up to 1600 employees.

"The ATO was notified of the security breach from a range of sources including the company concerned," the spokeswoman said.

"We worked immediately to identify taxpayers affected, and protect their processes."