Federal Police Commissioner Reece Kershaw said a cybercrime team was investigating the fraud, which came to light on April 30.

It had been picked up by AUSTRAC, Mr Kershaw said, confirming that police were looking into the possibility that organised crime and offshore criminals were involved.

"There has been an intrusion into a third party," he said. "... It's quite sophisticated."

No government agency had been infiltrated, he said.

Tax Commissioner Chris Jordan said people should be "extraordinarily careful about keeping their personal information, including date of birth and tax file numbers, private and secure".

He suggested people were getting the information through accessing the less secure sites of "intermediaries" such as tax agents.

Explaining how the money was released, he said: "In any situation where an application is made and the information more or less stacks up with what our system says, approvals are given and super funds are paying out to the alleged member of the fund," he said.

READ MORE:

Jeremy Hirschhorn, from the tax office, said for money to be released people must first "prove you are who you are" through tax agents or the MyGov website. Extra checks are then made to identify suspicious applications.

"No system is perfect but there are layers of checking that we do. We then pass on the information to super funds and super funds are meant to do their own fraud checking," he said.

"So the tax office provides an extra layer and multiple hidden layers of protection against identity fraud.

"Of course, we are working furiously to see how we can strengthen those processes of these other checks to identify similar types of suspicious activity."

The government has allowed people to withdraw up to $10,000 of their superannuation in the coronavirus crisis, with another $10,000 available from July.

A Senate inquiry heard on Thursday that 1.1 million people had taken the option, with $9.4 billion paid out so far.

Mr Jordan said the digital age had created "a whole new balance between service and ease versus locking up layers of processes".

"There are better ways of authenticating people that as a country we've chosen not to do ... but I can, without doubt, say if we had better authentication of individuals when they enroll in our system we would see fraud of the nature that we're talking about now decrease ... Identity theft would be a lot more difficult."

There is no consensus on how much people who withdraw $20,000 will lose from their superannuation by the time they reach retirement, with superannuation funds quoting much higher figures than Treasury. The differences depend on assumptions about factors such as returns on superannuation investment and inflation.

The Australian Securities and Investments Commission estimates that a 30-year-old who withdraws $20,000 today would be $43,000 worse off when they retired at 67, but industry funds have put the loss at twice that.

The Grattan Institute says that for a 35-year-old who withdraws $20,000 today, their super balance will be $58,000 lower at retirement. But it also points out that withdrawing superannuation now means taking it out at a bad time, given the big falls in the stock market. The $20,000 withdrawn now could soon be worth $30,000 if left in superannuation, compounding the loss.

Mr Kershaw said police had established Taskforce Iris to combat fraud involving coronavirus payments.

A Western Sydney man had been arrested after allegedly assuming 11 identities and creating 53 fictitious to submit 68 claims for government benefits, totalling $70,000.

In all, police had received seven coronavirus referrals, including one relating to the Job Keeper wage subsidy, he said.