Medicare ATO

ADVISORIES RELATING TO MEDICARE CARD USE CONTAINED IN IDENTITY CRIME MANAGEMENT
AND SUPPORT SHAREPOINT
2
ce 98
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
1
2
Aitkin, Nicole
ce 98
From: Maseko, Susan
Sent: Wednesday, 5 July 2017 4:18 PM
ffi 1
To: Customer Service & Solutions; Identity Crime Management and Support; CAS Business Support Network; McBride, Rose; TPALS Procedures
Publishing
Cc: McGuire, Pauline; Setch, Natale; Torenbeek, Katie; Edward, Pam; Savrimoothoo, Anne-Lise; Itter, Craig; Ornek, Marlon; Stickland, Wade;
O ct
Norris, Peter; Otten, Brenda
Subject: RE: Tech alert [SEC=UNCLASSIFIED]
n A
Importance: High
tio OI
All,
xa r F
Confirmation has been received that use of the Medicare Card for DVS checks in respect of PORO can be resumed.
SMART scripting amendments will be effected asap.
Ta e
Regards,
n nd
lia u
Sue Maseko
ra d
Client Register Integrity and Future Design

st se
Enterprise Register and Accounts | Service Delivery

Australian Taxation Office
P 03 9215 3657
a
Au le
Click to chat
e
R
From: Maseko, Susan

Sent: Wednesday, 5 July 2017 8:35 AM
1
2
To: Customer Service & Solutions; Identity Crime Management and Support; CAS Business Support Network; McBride, Rose; TPALS Procedures Publishing
2
Cc: McGuire, Pauline; Setch, Natale; Torenbeek, Katie; Edward, Pam; Savrimoothoo, Anne-Lise; Itter, Craig; Ornek, Marlon; Stickland, Wade; Norris, Peter
ce 98
Subject: Tech alert [SEC=UNCLASSIFIED]
Hi all,
ffi 1
Below is a tech alert that needs to be shared with staff.
O ct
Removal of Medicare card from the list of DVS documents
n A
As a result of recent media coverage on Medicare card details being sold on the dark web, the Medicare card will be removed from the list of DVS documents until further
notice.
Refer to SMART scripting for correct documents to use
tio OI
xa r F
Regards,
Ta e
n nd
Sue Maseko
Client Register Integrity and Future Design
lia u
P 03 9215 3657
ra d
st se
Click to chat
a
Au le
e
R
2
3
R
e
Au le
st se a
ra d
lia u
n nd
Ta e
xa r F
tio OI
n A
O ct
ffi 1
ce 98
2
R
e
Au le
st se a
ra d
lia u
n nd
Ta e
xa r F
tio OI
n A
O ct
ffi 1
ce 98
2
2
Aitkin, Nicole
ce 98
From: McMorrow, Frances
ffi 1
To: Diment, David
Subject: FW: DVS system acceptance of Medicare card [SEC=UNCLASSIFIED]
O ct
FYI. All PORO processes now back to normal.
n A
Frances McMorrow
tio OI
Assistant Commissioner
Enterprise Register and Accounts
CAS
xa r F
P 02 6216 1179 I M s47F I F 02 6250 0742
Ta e
From: Edward, Pam
n nd
lia u
To: McMorrow, Frances
Subject: DVS system acceptance of Medicare card [SEC=UNCLASSIFIED]
ra d
Hi Frances,
st se
I confirm that I have spoken with Dani Donne and also emailed her with the request to reinstate acceptance of Medicare cards in DVS.
a
DVS will be reconfigured to accept Medicare cards in the next five or ten minutes.
Au le
Regards,
e
R
1
6
2
Pam Edward
Acting Director | Client Register Integrity and Future Design
ce 98
P 03 9215 3409 M s47F
ffi 1
O ct
n A
tio OI
xa r F
Ta e
n nd
lia u
ra d
st se a
Au le
e
R
2
7
2
Aitkin, Nicole
ce 98
Sent: Thursday, 6 July 2017 11:57 AM
ffi 1
To: Diment, David
Subject: FW: Medicare cards and PORO process [SEC=UNCLASSIFIED]
O ct
Importance: High
n A
Spoke to Annie, this is what we will advise contact centre staff.
tio OI
Frances McMorrow
xa r F
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
Ta e
n nd
lia u
From: Ferguson, Annie
ra d
To: Hannaford, Michelle

Cc: McMorrow, Frances
st se
Subject: Medicare cards and PORO process [SEC=UNCLASSIFIED]

Importance: High
a
Hi Michelle,
Au le
In relation to the halt on Medicare cards as part of PORO yesterday, were looking at scripting for staff in case they are asked about it.
Im not sure if there have been many questions raised by callers, but there has been some media coverage.
e
R
Could you please provide the following info to staff in scripting:
1
8
2
The ATO has confirmed that the use of Medicare cards as part of the identity verification process is appropriate. It was temporarily halted yesterday.
ce 98
Thanks
Annie
ffi 1
O ct
n A
Annie Ferguson
Assistant Commissioner, Operational Service Centres
tio OI
Service Delivery (Client Account Services)
P 02 6216 2548 M s47F F 02 6252 0613
xa r F
Ta e
n nd
lia u
ra d
st se a
Au le
e
R
2
9
R
e
Au le
st se a
ra d
lia u
n nd
Ta e
xa r F
tio OI
n A
O ct
ffi 1
ce 98
2
To: Jordan, Chris
2
Cc: Cawthra, Frances; Curtis, Jacqui; Goodear, Sue; Diment, David; Smith, Susie
ce 98
Subject: IMPORTANT: Medicare card issue as per the text message this morning [DLM=For-Official-Use-Only]
Importance: High
Good morning Chris
ffi 1
Medicare Card issue
O ct
On 4 July 2017 the Client Register Team in Service Delivery saw the media article regarding Medicare card fraud. Medicare cards are a legal document than enable citizens
n A
to complete their 100 point proof of identity check.
s47E
tio OI
The Client Register Team considered it advisable to temporarily remove the Medicare card from the list of Document Verification Service (DVS) items.
xa r F
This decision was made within the team and not escalated to SES for approval, which would be the usual process.
Ta e
The ATO requested the Attorney Generals Department to remove Medicare cards from the list of items that could be requested by DVS.
n nd
ATO Contact Centre staff were advised at 8am 5 July 2017 that Medicare cards should not continue to be accepted; the scripting for call centre staff was modified
simultaneously and headline alerts where issued to staff.
lia u
Yesterday afternoon at 4.20pm this advice was urgently rescinded and all call centre staff advised accordingly.
ra d
The Attorney Generals Department were requested to resume acceptance of Medicare cards at 5:15pm on 5 July 2017.
st se
DC Diment met yesterday afternoon with his counterparts in DHS and AGs to explain the error in process, apologise and confirm all advice to ATO staff has been rescinded.
Regards,
a
Frances Cawthra
Au le
A/g Chief Operating Officer

e
P 02 621 62149 M s47F

R
2
11
Burton, Aimee
From: Smith, Susie

To: Diment, David
Cc: Cawthra, Frances; Baume, Patrick; Jepsen, David
Subject: RE: For urgent response : Medicare cards enquiry [SEC=UNCLASSIFIED]
2
Thanks David.
ce 98
As discussed we will provide to journalist now, and also can provide to your DHS and AGS contacts (and we will
courtesy copy their media teams in as well).
ffi 1
Regards
Susie
O ct
n A
Susie Smith
tio OI
Assistant Commissioner, Public Affairs, ATO Corporate
P 02 621 62073 M s47F
xa F
From: Diment, David
r

Ta e
To: Smith, Susie

n nd
Subject: Re: For urgent response : Medicare cards enquiry [SEC=UNCLASSIFIED]
Yes Thanks
lia u
Just off a hook up with DHS and AGS and i apologised and explained that we have withdrawn the
instruction DD
ra d
Sent from my iPad

st ase
On 5 Jul 2017, at 4:36 pm, Smith, Susie <Susie.Smith@ato.gov.au> wrote:
Are you both comfortable with this response?

Au le
We can confirm that the use of Medicare cards as part of the identity verification process was
temporarily halted today in error. This has been rectified and Medicare cards can now be used as
e
part of the normal identity verification process

R
Please let me know ASAP
Thanks
Susie
Susie Smith
1
12
P 02 621 62073 s47F
From: Diment, David

To: Smith, Susie
Subject: Re: Medicare cards enquiry [SEC=UNCLASSIFIED]
Just spoken to Patrick DD
2
Sent from my iPad
ce 98
ffi 1
Hi Frances
Sorry I wasnt aware this had come through we have apparently negotiated for an
O ct
extension to respond until later today.
n A
I think if we are changing the advice that we will still be accepting Medicare cards,
we should say so in our media response.
tio OI
I understand David Diment is preparing a response and this will also be provided to
media unit.
xa F
Regards
Susie
r
Ta e
n nd
Susie Smith
lia u

ra d
P 02 621 62073 M s47F

st ase
From: Media Unit

To: Smith, Susie
Subject: FW: [SEC=UNCLASSIFIED]
Au le
e
From: Paul Farrell s47F

R

To: Media Unit
Subject:
Hi thanks for your time.
I understand that as a result of the sale of Medicare cards on the darknet these cards have now been
removed from the list of documents that can be used to verify Id on the DVS. I understand the
ATO has advised staff in an email of the change today, advising staff to no longer accept as part of
the PORO process.
I just want to get your response on the decision to make this change to remove Medicare ID cards
from the DVS. I also want to get some clarification from the ATO about how this will affect
2
13
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee
From: Cawthra, Frances

To: Smith, Susie; Diment, David
Cc: Baume, Patrick; Jepsen, David; Cawthra, Frances
2
All good with me
ce 98
Frances Cawthra
ffi 1
P 02 621 62149 M s47F
O ct
From: Smith, Susie
n A
To: Diment, David
tio OI
Thanks David.
xa F
As discussed we will provide to journalist now, and also can provide to your DHS and AGS contacts (and we will
r
courtesy copy their media teams in as well).

Ta e
Regards
n nd
Susie
lia u
ra d
Susie Smith
st ase

P 02 621 62073 M s47F
From: Diment, David

Au le

To: Smith, Susie
e

R
Yes Thanks
instruction DD
Sent from my iPad
1
15
Thanks
Susie
2
ce 98
Susie Smith
ffi 1
P 02 621 62073 M s47F
O ct
From: Diment, David
To: Smith, Susie
n A
tio OI
Sent from my iPad

xa F
r
Hi Frances
Ta e
n nd
lia u
ra d
st ase
media unit.
Regards
Susie
Au le
e
R
Susie Smith
P 02 621 62073 M s47F
From: Media Unit

To: Smith, Susie
2
16
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee

To: Smith, Susie
Cc: Diment, David
Subject: Media response [DLM=For-Official-Use-Only]
2
Hi Susie,
ce 98
David and I have just finished a phone hook up with DHS and AGDs re this Medicare issue. We
have promised to send them our draft response to The Guardian for review. Contacts are Malisa
ffi 1
Golightly and mark.withnell@humanservices.gov.au
Thanks, Frances.
O ct
Frances McMorrow
n A
CAS
tio OI
P 02 6216 1179 I M s47F I F 02 6250 0742
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
1
18
Burton, Aimee
From: Smith, Susie

Cc: Diment, David; Jepsen, David
Subject: RE: Media response [DLM=For-Official-Use-Only]
2
Thanks Frances
ce 98
David Jepsen from my team will provide them with our cleared final media response now when he does to
journalist.
ffi 1
Regards
Susie
O ct
n A
Susie Smith
tio OI
P 02 621 62073 M s47F
xa F
r

Ta e
To: Smith, Susie

Cc: Diment, David
n nd
Hi Susie,
lia u
ra d
st ase
Thanks, Frances.
Frances McMorrow
Au le
e
CAS
R
P 02 6216 1179 I M s47F I F 02 6250 0742
1
19
Burton, Aimee

To: Smith, Susie
2
I think they wanted to see it before it went to the journalist.
ce 98
Frances McMorrow
ffi 1
CAS
O ct
P 02 6216 1179 I M s47F I F 02 6250 0742
n A
tio OI
From: Smith, Susie
xa F
r
Ta e
Thanks Frances
n nd
journalist.
lia u
Regards
Susie
ra d
st ase
Susie Smith
Au le

P 02 621 62073 M s47F
e
R

To: Smith, Susie
Cc: Diment, David
Hi Susie,
1
20
Thanks, Frances.
Frances McMorrow
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
2
ce 98
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
2
21
Burton, Aimee
From: Smith, Susie

2
David J will manage things are changing so we will send to your contacts but not to journalist and await whole of
ce 98
govt response as DD has informed us.
ffi 1
Susie Smith
O ct
n A
P 02 621 62073 M s47F
tio OI
To: Smith, Susie
xa F
r

Ta e
Frances McMorrow
n nd
CAS
lia u

P 02 6216 1179 I M s47F I F 02 6250 0742
ra d
st ase
From: Smith, Susie

Au le

e

R
Thanks Frances
journalist.
Regards
Susie
1
22
Susie Smith
P 02 621 62073 M s47F

To: Smith, Susie
Cc: Diment, David
2
ce 98
Hi Susie,
ffi 1
O ct
Thanks, Frances.
n A
Frances McMorrow
CAS tio OI

xa F
P 02 6216 1179 I M s47F I F 02 6250 0742
r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
2
23
Burton, Aimee
From: Smith, Susie

To: s47F ; Cawthra, Frances; Diment, David
Cc: s47F ; Jepsen, David; Mossop, Kathy;
Payne, Fiona
Subject: RE: Medicare card issue [SEC=UNCLASSIFIED]
2
ce 98
Thanks s47F understood.
We have just received same advice via our SES who have been liaising with DHS and AGS.
ffi 1
So that you know in case you are asked the ATO did have a response prepared but will not use it as follows:
O ct
We can confirm that the use of Medicare cards as part of the identity verification process was temporarily halted
today in error. This has been rectified and Medicare cards can now be used as part of the normal identity verification
n A
process
Regards
Susie tio OI
xa F r
Susie Smith
Ta e

n nd
P 02 621 62073 M s47F
s22
lia u
ra d
st ase
Au le
e
R
1
24
s22
Please Note: The information contained in this e-mail message and any attached files may be
confidential information and may also be the subject of legal professional privilege. If you are not
the intended recipient, any use, disclosure or copying of this e-mail is unauthorised. If you have
2
received this e-mail by error please notify the sender immediately by reply e-mail and delete all
ce 98
copies of this transmission together with any attachments.
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
2
25
Burton, Aimee

To: s47F
Cc: Cawthra, Frances; Diment, David; Smith, Susie
Subject: re: Medicare Cards [DLM=For-Official-Use-Only]
2
Hi s47F
ce 98
Thank you for your call.
ffi 1
We have tracked down the issue and on first review it looks like a break in process.
The use of Medicare cards as part of the identity verification process was temporarily halted today in error. This has
O ct
been rectified and Medicare cards can now be used as part of the normal identity verification process.
n A
Deputy Commissioner David Diment has met with Malisa Golightly from DHS and Andrew Rice from AGs and the
instruction has been withdrawn.
tio OI
We are very sorry that this has happened and we have rectified the process so it will not happen again.
Regards
xa F r
Frances Cawthra
Ta e
n nd

P 02 621 62149 M s47F
lia u
ra d
st ase
Au le
e
R
1
26
Burton, Aimee

To: Diment, David
Subject: FW: DVS system acceptance of Medicare card [SEC=UNCLASSIFIED]
2
ce 98
Frances McMorrow
ffi 1
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
O ct
n A
tio OI
From: Edward, Pam
xa F
r
Hi Frances,
Ta e
I confirm that I have spoken with Dani Donne and also emailed her with the request to reinstate acceptance of
n nd
Medicare cards in DVS.
lia u
Regards,
ra d
st ase
Pam Edward
Au le
P 03 9215 3409 M s47F

e
R
1
27
Burton, Aimee

To: Diment, David
Cc: Cawthra, Frances
Subject: https://www.theguardian.com/australia-news/2017/jul/06/medicare-data-breach-
tax-office-suspends-cards-as-id-before-u-turn [SEC=UNCLASSIFIED]
2
ce 98
Article on Medicare cards
ffi 1
Frances Cawthra
O ct
n A
P 02 621 62149 M s47F
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
1
28
Burton, Aimee

To: Diment, David
Subject: Medicare Card and DVS urgent briefing [DLM=For-Official-Use-Only]
Importance: High
2
ce 98
Hi David,
As requested, these are the details of the matter regarding the Medicare Card.
ffi 1
Background
O ct
A news article issued on July 4 2017, regarding the potential availability for purchase of Medicare card details
through a dark net trader.
n A
We were concerned about this because the Medicare card is one of the items that can be checked though the
Document Verification Service (DVS) to obtain a linking code for myGov interaction with the ATO. This is the time of
tio OI
year when risks of identity theft and refund fraud rise exponentially. We checked with Attorney Generals
Department (who own DVS), who advised the matter had been referred to the AFP.
xa F
Action taken
r
Ta e
s47E
n nd
This decision was made within the team and was not escalated to any SES for approval.
lia u
This was done on July 4 at 3.26pm, and Attorney Generals Department was requested to remove the Medicare Card
from the list of items that could be verified through DVS.
ra d
This left the following list of items that the community could use for DVS checks:
st ase
o Australian birth certificate

o Australian passport
o Australian citizenship certificate
Au le
o Australian visa with an overseas passport

o ImmiCard
e
o Australian Marriage certificates

o Change of Name certificate
R
o Australian driver's licence or learner's permit

o A linking document (marriage certificate, birth certificate, or change of name certificate)
Attorney Generals Department did confirm, on July 4, that they could very quickly resume inclusion of the Medicare
card for DVS checks on receipt of an email from the ATO.
ATO contact centre staff were advised on July 5 (7.53am) that the Medicare card was not to be used in DVS
document checks until further notice, as a result of recent media coverage on Medicare cards.
Scripting for contact centre staff was modified simultaneously, and headline alerts were issued to these staff.
1
29
Rationale for decision
Risk: Medicare cards are one document that can be verified in DVS in order for a caller to pass Proof of Record
Ownership with the ATO. It is part of the process to get a myGov linking code to access online records for taxation
and superannuation records.
It is now peak Tax Time, and exposure of Medicare card details to unauthorised third parties, particularly card
number, Individual Reference Number (IRN) and expiry date are relevant in DVS checks: s47E
2
ce 98
Consultation
The consultation process was internal and conducted at the incorrect APS level. It should have been escalated for
ffi 1
consultation and approval internally, and should have included discussion with external stakeholders (namely DHS)
at the appropriate levels.
O ct
While we did talk to Attorney Generals Department, they did not provide advice on the matter, merely acting on our
request to block the DVS.
n A
Resolution
tio OI
The decision was rescinded yesterday, July 6 at 4.18pm. ATO staff were instructed to resume use of the Medicare
card in the list of items that could be checked through DVS and scripting was updated.
xa F
Attorney Generals Department were requested to resume acceptance of the Medicare card on July 6 at 5.15pm.
r
Ta e
Frances McMorrow
n nd

CAS
lia u
P 02 6216 1179 I M s47F I F 02 6250 0742

ra d
st ase
Au le
e
R
2
30
Burton, Aimee

To: Diment, David
Subject: RE: Medicare Card and DVS urgent briefing [DLM=For-Official-Use-Only]
We didnt speak to DHS. I thought Pam said they did, but when I clarified with her this morning,
2
she said they only spoke to AGD (who she calls AGS). Ive added a sentence to clarify.
ce 98
Is this enough?
ffi 1
Frances McMorrow
O ct
CAS
n A
P 02 6216 1179 I M s47F I F 02 6250 0742
tio OI
xa F
From: Diment, David
r

Ta e
Subject: Re: Medicare Card and DVS urgent briefing [DLM=For-Official-Use-Only]

n nd
Can you just include more detail in the consultation para Not clear from this doc whether we spoke to DHS
Sent from my iPhone

lia u
On 6 Jul 2017, at 10:44 am, McMorrow, Frances <Frances.McMorrow@ato.gov.au> wrote:

ra d
Hi David,
st ase
Background
Au le
A news article issued on July 4 2017, regarding the potential availability for purchase of Medicare
card details through a dark net trader.
e
R
We were concerned about this because the Medicare card is one of the items that can be checked
though the Document Verification Service (DVS) to obtain a linking code for myGov interaction with
the ATO. This is the time of year when risks of identity theft and refund fraud rise exponentially. We
checked with Attorney Generals Department (who own DVS), who advised the matter had been
referred to the AFP.
Action taken
s47E
1
31
s47E
This decision was made within the team
and was not escalated to any SES for approval.
This was done on July 4 at 3.26pm, and Attorney Generals Department was requested to remove
the Medicare Card from the list of items that could be verified through DVS.
Australian birth certificate
2
o
ce 98
o ImmiCard
ffi 1
O ct
o A linking document (marriage certificate, birth certificate, or change of name
certificate)
n A
Attorney Generals Department did confirm, on July 4, that they could very quickly resume inclusion
of the Medicare card for DVS checks on receipt of an email from the ATO.
tio OI
ATO contact centre staff were advised on July 5 (7.53am) that the Medicare card was not to be used
in DVS document checks until further notice, as a result of recent media coverage on Medicare
xa F
cards.
r
Scripting for contact centre staff was modified simultaneously, and headline alerts were issued to
Ta e
these staff.
n nd
Risk: Medicare cards are one document that can be verified in DVS in order for a caller to pass Proof
lia u
of Record Ownership with the ATO. It is part of the process to get a myGov linking code to access
online records for taxation and superannuation records.
ra d
It is now peak Tax Time, and exposure of Medicare card details to unauthorised third parties,
st ase
particularly card number, Individual Reference Number (IRN) and expiry date are relevant in DVS
checks: s47E
Au le
Consultation
e
The consultation process was internal and conducted at the incorrect APS level. It should have been
escalated for consultation and approval internally, and should have included discussion with
R
external stakeholders (namely DHS) at the appropriate levels.
While we did talk to Attorney Generals Department, they did not provide advice on the matter,
merely acting on our request to block the DVS.
We did not consult with Department of Human Services (DHS) at all.
Resolution
The decision was rescinded yesterday, July 6 at 4.18pm. ATO staff were instructed to resume use of
the Medicare card in the list of items that could be checked through DVS and scripting was updated.
2
32
Attorney Generals Department were requested to resume acceptance of the Medicare card on July
6 at 5.15pm.
Frances McMorrow
CAS
2
P 02 6216 1179 I M s47F I F 02 6250 0742
ce 98
<image003.jpg>
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
3
33
Burton, Aimee

To: Cawthra, Frances
Cc: Diment, David
2
Hi Frances,
ce 98
As discussed with David, below are our briefing notes on this matter.
ffi 1
Regards, Frances.
O ct
Background
n A
tio OI
xa F
r
Ta e
n nd
Action taken
s47E
lia u

ra d

st ase
Au le

e
R

o ImmiCard
certificate)
1
34
cards.
these staff.
2
ce 98
ffi 1
checks: s47E
O ct
n A
Consultation
tio OI
xa F
r
Ta e

n nd
Resolution
lia u
ra d
6 at 5.15pm. Our normal PORO processes are back in place.
st ase
Frances McMorrow
Au le

CAS
e

P 02 6216 1179 I M s47F I F 02 6250 0742
R
2
35
Burton, Aimee
From: Mossop, Kathy

To: Diment, David
Cc: Smith, Susie; Parliamentary Services
Subject: FW: PMO request l Due now l Talking points re Medicare numbers
[SEC=UNCLASSIFIED]
2
Follow Up Flag: Follow up
ce 98
Flag Status: Flagged
ffi 1
Hi David,
I urgently needs some points for the PMO re this article are you able to assist please.
O ct
I will call to discuss.
n A
Regards
Kathy
tio OI
xa F
From: Mossop, Kathy
r

Ta e
Subject: PMO request l Due now l Talking points re Medicare numbers [SEC=UNCLASSIFIED]
n nd
Hi Frances,
Due asap
lia u
The PMO has requested a few talking points responding to the following article.
ra d
http://www.dailytelegraph.com.au/technology/confusion-grows-over-medicare-dark-web-breach-as-the-tax-office-
st ase
briefly-stopped-taking-cards-as-id/news-story/2d01b34fc02d22a591c4d0d5b8f19c75

Au le
Regards
Kathy
e
R
Kathy Mossop
Senior Director, Parliamentary Services, ATO Corporate
P 02 621 61046 M s47F
1
36
Burton, Aimee
From: Mossop, Kathy

Cc: Diment, David; Smith, Susie; Parliamentary Services
Subject: FW: PMO request l Due now l Talking points re Medicare numbers
[SEC=UNCLASSIFIED]
2
ce 98
Hi Frances,
Thank you for preparing points I need urgently within 30 mins.
ffi 1
This is what media unit have provided.
O ct
The ATO has confirmed that the use of Medicare cards as part of the identity verification process was
temporarily halted today in error.
n A
They have rectified this and Medicare cards can now be used as part of the normal identity verification
process.
Regards
tio OI
xa F
Kathy
From: Mossop, Kathy

r

Ta e
To: Diment, David

n nd
Subject: FW: PMO request l Due now l Talking points re Medicare numbers [SEC=UNCLASSIFIED]
Hi David,
lia u
ra d

st ase
Regards
Kathy
Au le
From: Mossop, Kathy

e

R

Hi Frances,
Due asap
1
37
Regards
Kathy
Kathy Mossop
2
ce 98
P 02 621 61046 M s47F
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
2
38
Burton, Aimee
From: Smith, Susie

To: McMorrow, Frances; Diment, David; Cawthra, Frances
Cc: Parliamentary Services; Mossop, Kathy; Jepsen, David
Subject: For urgent clearance: PMO request l Due now l Talking points re Medicare
numbers [SEC=UNCLASSIFIED]
2
Importance: High
ce 98
HI All
ffi 1
Is it just something simple as this given likely to be required for doorstop interviews etc???
O ct
n A
A team leader issued some premature internal guidance yesterday on the back of media coverage that
suggested potential false Medicare data might be in circulation.

tio OI
The ATO promptly withdrew this guidance and Medicare cards can now be used as part of the normal
identity verification process. In addition they have reinforced the need for Senior Executive clearance before
any guidance is issued to staff on how they should treat proof of identity documentation.
xa F
If not, please prepare ASAP as we are now getting heat from office.
r
Regards
Ta e
Susie
n nd
Susie Smith
lia u

ra d
P 02 621 62073 M s47F

st ase
From: Mossop, Kathy

Au le
e
Hi Frances,
R
They have rectified this and Medicare cards can now be used as part of the normal identity verification
process.
Regards
1
39
Kathy
From: Mossop, Kathy

To: Diment, David
Hi David,
2
ce 98
Regards
ffi 1
Kathy
O ct
From: Mossop, Kathy
n A
tio OI
Hi Frances,
xa F
Due asap
r
Ta e
n nd
lia u
Regards
ra d
Kathy
st ase
Kathy Mossop
Au le

P 02 621 61046 M s47F
e
R
2
40
2
Aitkin, Nicole
ce 98
ffi 1
To: Smith, Susie; McMorrow, Frances; Diment, David
Cc: Parliamentary Services; Mossop, Kathy; Jepsen, David; Cawthra, Frances
Subject: RE: For urgent clearance: PMO request l Due now l Talking points re Medicare numbers [SEC=UNCLASSIFIED]
O ct
n A
Change one thing..
tio OI
Good to go
Frances Cawthra
xa r F
P 02 621 62149 M s47F
Ta e
n nd
From: Smith, Susie
lia u
Subject: For urgent clearance: PMO request l Due now l Talking points re Medicare numbers [SEC=UNCLASSIFIED]
Importance: High
ra d
HI All
st se
a
The ATO has confirmed that the use of Medicare cards as part of the identity verification process was temporarily halted today in error.
Au le
Some premature internal guidance yesterday on the back of media coverage that suggested potential false Medicare data might be in circulation.
The ATO promptly withdrew this guidance and Medicare cards can now be used as part of the normal identity verification process. In addition they have reinforced
e
the need for Senior Executive clearance before any guidance is issued to staff on how they should treat proof of identity documentation.
R
1
41
2
Regards
ce 98
Susie
ffi 1
Susie Smith
O ct
P 02 621 62073 M s47F
n A
From: Mossop, Kathy
tio OI
xa r F
Hi Frances,
Ta e
n nd
lia u
They have rectified this and Medicare cards can now be used as part of the normal identity verification process.
ra d
Regards
st se
Kathy
a
From: Mossop, Kathy

Au le
To: Diment, David

e
R
Hi David,
2
42
2
ce 98
Regards
ffi 1
Kathy
O ct
From: Mossop, Kathy
n A
tio OI
Hi Frances,
xa r F
Due asap
Ta e
http://www.dailytelegraph.com.au/technology/confusion-grows-over-medicare-dark-web-breach-as-the-tax-office-briefly-stopped-taking-cards-as-id/news-
n nd
story/2d01b34fc02d22a591c4d0d5b8f19c75

lia u
Regards
ra d
Kathy
st se
Kathy Mossop
a

Au le

P 02 621 61046 M s47F
e
R
3
43
2
Aitkin, Nicole
ce 98
From: Smith, Susie
ffi 1
To: Cawthra, Frances; Mossop, Kathy
Cc: Parliamentary Services; Jepsen, David; McMorrow, Frances; Diment, David
O ct
n A
Kathy
tio OI
Frances C has just cleared this version over phone to me - please use
xa r F
Regards
Ta e
Susie
n nd
lia u
Susie Smith
ra d

st se
P 02 621 62073 M s47F

a

Au le

e
Change one thing..

R
1
44
2
Good to go
ce 98
Frances Cawthra
ffi 1
P 02 621 62149 M s47F
O ct
From: Smith, Susie
n A
tio OI
Importance: High
HI All
xa r F
Ta e

n nd
lia u
ra d
Regards
Susie
st se a
Susie Smith
Au le

P 02 621 62073 M s47F
e
R
2
45
2
From: Mossop, Kathy
ce 98
ffi 1
Hi Frances,
O ct
n A
tio OI
xa r F
Regards
Kathy
Ta e
From: Mossop, Kathy
n nd
To: Diment, David
lia u
Hi David,
ra d
st se

a
Regards
Au le
Kathy
e
From: Mossop, Kathy

R

3
46
2
ce 98
Hi Frances,
ffi 1
Due asap
O ct
n A
tio OI
Regards
Kathy
xa r F
Ta e
Kathy Mossop
n nd
P 02 621 61046 M s47F
lia u
ra d
st se a
Au le
e
R
4
47
2
Aitkin, Nicole
ce 98
From: Smith, Susie
ffi 1
To: Cawthra, Frances; Mossop, Kathy
Cc: Parliamentary Services; Jepsen, David; McMorrow, Frances; Diment, David
O ct
n A
Kathy
tio OI
xa r F
Regards
Ta e
Susie
n nd
lia u
Susie Smith
ra d

st se
P 02 621 62073 M s47F

a

Au le

e
Change one thing..

R
1
48
2
Good to go
ce 98
Frances Cawthra
ffi 1
P 02 621 62149 M s47F
O ct
From: Smith, Susie
n A
tio OI
Importance: High
HI All
xa r F
Ta e

n nd
lia u
ra d
Regards
Susie
st se a
Susie Smith
Au le

P 02 621 62073 M s47F
e
R
2
49
2
From: Mossop, Kathy
ce 98
ffi 1
Hi Frances,
O ct
n A
tio OI
xa r F
Regards
Kathy
Ta e
From: Mossop, Kathy
n nd
To: Diment, David
lia u
Hi David,
ra d
st se

a
Regards
Au le
Kathy
e
From: Mossop, Kathy

R

3
50
2
ce 98
Hi Frances,
ffi 1
Due asap
O ct
n A
tio OI
Regards
Kathy
xa r F
Ta e
Kathy Mossop
n nd
P 02 621 61046 M s47F
lia u
ra d
st se a
Au le
e
R
4
51
2
Aitkin, Nicole
ce 98
ffi 1
To: Diment, David
Subject: FW: Medicare cards and PORO process [SEC=UNCLASSIFIED]
O ct
Importance: High
n A
Spoke to Annie, this is what we will advise contact centre staff.
tio OI
Frances McMorrow
xa r F
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
Ta e
n nd
lia u
ra d
To: Hannaford, Michelle

Cc: McMorrow, Frances
st se
Subject: Medicare cards and PORO process [SEC=UNCLASSIFIED]

Importance: High
a
Hi Michelle,
Au le
In relation to the halt on Medicare cards as part of PORO yesterday, were looking at scripting for staff in case they are asked about it.
Im not sure if there have been many questions raised by callers, but there has been some media coverage.
e
R
Could you please provide the following info to staff in scripting:
1
52
2
The ATO has confirmed that the use of Medicare cards as part of the identity verification process is appropriate. It was temporarily halted yesterday.
ce 98
Thanks
Annie
ffi 1
O ct
n A
Annie Ferguson
Assistant Commissioner, Operational Service Centres
tio OI
Service Delivery (Client Account Services)
P 02 6216 2548 M s47F F 02 6252 0613
xa r F
Ta e
n nd
lia u
ra d
st se a
Au le
e
R
2
53
2
Aitkin, Nicole
ce 98
Sent: Thursday, 6 July 2017 1:16 PM
ffi 1
Cc: Diment, David; Smith, Susie
O ct
n A
Apologies, I have just noticed a mistake in dates below. At the end of the briefing we say the decision was rescinded yesterday, July 6th. It
should read July 5th.
tio OI
This was fixed within the same day.
xa r F
Frances McMorrow
CAS
Ta e
n nd
P 02 6216 1179 I M s47F
lia u I F 02 6250 0742
ra d

st se

Cc: Diment, David
a
Hi Frances,
Au le
e
R
Regards, Frances.
1
54
2
Background
ce 98
A news article issued on July 4 2017, regarding the potential availability for purchase of Medicare card details through a dark net trader.
ffi 1
We were concerned about this because the Medicare card is one of the items that can be checked though the Document Verification Service (DVS) to
obtain a linking code for myGov interaction with the ATO. This is the time of year when risks of identity theft and refund fraud rise exponentially. We
checked with Attorney Generals Department (who own DVS), who advised the matter had been referred to the AFP.
O ct
n A
Action taken
s47E
tio OI
xa r F
This was done on July 4 at 3.26pm, and Attorney Generals Department was requested to remove the Medicare Card from the list of items that could be
verified through DVS.
Ta e
o
o
n nd
Australian birth certificate
Australian passport
Australian citizenship certificate
lia u
o
o ImmiCard
ra d

st se

a
Attorney Generals Department did confirm, on July 4, that they could very quickly resume inclusion of the Medicare card for DVS checks on receipt of an
Au le
email from the ATO.

e
ATO contact centre staff were advised on July 5 (7.53am) that the Medicare card was not to be used in DVS document checks until further notice, as a
result of recent media coverage on Medicare cards.
R
2
55
2
ce 98
Risk: Medicare cards are one document that can be verified in DVS in order for a caller to pass Proof of Record Ownership with the ATO. It is part of the
ffi 1
process to get a myGov linking code to access online records for taxation and superannuation records.
It is now peak Tax Time, and exposure of Medicare card details to unauthorised third parties, particularly card number, Individual Reference Number (IRN)
O ct
and expiry date are relevant in DVS checks: s47E
n A
Consultation
tio OI
The consultation process was internal and conducted at the incorrect APS level. It should have been escalated for consultation and approval internally, and
should have included discussion with external stakeholders (namely DHS) at the appropriate levels.
xa r F
While we did talk to Attorney Generals Department, they did not provide advice on the matter, merely acting on our request to block the DVS.
Ta e
n nd
Resolution
The decision was rescinded yesterday, July 6 at 4.18pm. ATO staff were instructed to resume use of the Medicare card in the list of items that could be
checked through DVS and scripting was updated.
lia u
Attorney Generals Department were requested to resume acceptance of the Medicare card on July 6 at 5.15pm. Our normal PORO processes are back in
ra d
place.
st se
Frances McMorrow
a
Au le
CAS
e
P 02 6216 1179 I M 0423 781 653 I F 02 6250 0742

R
3
56
2
Aitkin, Nicole
ce 98
ffi 1
Cc: Diment, David; Smith, Susie; Cawthra, Frances
O ct
n A
Its ok
tio OI
I corrected that before I sent to Susie
Cheers
xa r F
Frances Cawthra
Ta e
n nd
P 02 621 62149 M s47F
lia u
ra d
Cc: Diment, David; Smith, Susie

st se
Apologies, I have just noticed a mistake in dates below. At the end of the briefing we say the decision was rescinded yesterday, July 6th. It
should read July 5th.
a
Au le
This was fixed within the same day.

e
Frances McMorrow
R
1
57
2
CAS
ce 98
P 02 6216 1179 I M s47F I F 02 6250 0742
ffi 1
O ct
n A
Cc: Diment, David
tio OI
Hi Frances,
xa r F
Regards, Frances.
Ta e
n nd
Background
A news article issued on July 4 2017, regarding the potential availability for purchase of Medicare card details through a dark net trader.
lia u
We were concerned about this because the Medicare card is one of the items that can be checked though the Document Verification Service (DVS) to
ra d
obtain a linking code for myGov interaction with the ATO. This is the time of year when risks of identity theft and refund fraud rise exponentially. We
checked with Attorney Generals Department (who own DVS), who advised the matter had been referred to the AFP.
st se
Action taken
a
Au le
s47E
e
R
This was done on July 4 at 3.26pm, and Attorney Generals Department was requested to remove the Medicare Card from the list of items that could be
verified through DVS.
2
58
2
ce 98
ffi 1
O ct
o ImmiCard
n A
tio OI
Attorney Generals Department did confirm, on July 4, that they could very quickly resume inclusion of the Medicare card for DVS checks on receipt of an
email from the ATO.
xa r F
ATO contact centre staff were advised on July 5 (7.53am) that the Medicare card was not to be used in DVS document checks until further notice, as a
result of recent media coverage on Medicare cards.
Ta e
n nd
Risk: Medicare cards are one document that can be verified in DVS in order for a caller to pass Proof of Record Ownership with the ATO. It is part of the
lia u
process to get a myGov linking code to access online records for taxation and superannuation records.
ra d
It is now peak Tax Time, and exposure of Medicare card details to unauthorised third parties, particularly card number, Individual Reference Number (IRN)
and expiry date are relevant in DVS checks: s47E
st se a
Consultation
Au le
The consultation process was internal and conducted at the incorrect APS level. It should have been escalated for consultation and approval internally, and
should have included discussion with external stakeholders (namely DHS) at the appropriate levels.
e
While we did talk to Attorney Generals Department, they did not provide advice on the matter, merely acting on our request to block the DVS.
R
3
59
2
ce 98
Resolution
The decision was rescinded yesterday, July 6 at 4.18pm. ATO staff were instructed to resume use of the Medicare card in the list of items that could be
ffi 1
checked through DVS and scripting was updated.
Attorney Generals Department were requested to resume acceptance of the Medicare card on July 6 at 5.15pm. Our normal PORO processes are back in
O ct
place.
n A
Frances McMorrow
tio OI
CAS
xa r F
P 02 6216 1179 I M s47F I F 02 6250 0742
Ta e
n nd
lia u
ra d
st se a
Au le
e
R
4
60
Burton, Aimee
Subject: FW: Discuss Medicare & ATO DVS use [SEC=UNCLASSIFIED]

Location: by phone
Start: Wed 5/07/2017 4:30 PM

End: Wed 5/07/2017 5:00 PM
Show Time As: Tentative
2
Recurrence: (none)
ce 98
Meeting Status: Not yet responded
Organizer: Rice, Andrew
ffi 1
O ct
n A
-----Original Appointment-----
From: Rice, Andrew [mailto:Andrew.Rice@ag.gov.au]
tio OI
To: Rice, Andrew; mark.withnell@humanservices.gov.au; McMorrow, Frances; Hunter, Glenis
Subject: Discuss Medicare & ATO DVS use [SEC=UNCLASSIFIED]
When: Wednesday, 5 July 2017 4:30 PM-5:00 PM (UTC+10:00) Canberra, Melbourne, Sydney.
xa F
Where: by phone
r
All parties within Australia can dial-in using s47E

Ta e
n nd
If you or your participants experience any difficulties dialling-in to a teleconference, please contact the Switchboard
team on (02) 6141 6666 or ext. 6666 and they will assist you where possible.
lia u
As the Leader/Chairperson you will be asked for the following:
Passcode s47E
ra d
st ase
Your participants will be asked to enter the following passcode:
Passcode: s47E
Au le
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
e
If you have received this transmission in error please

notify us immediately by return e-mail and delete all
R
copies. If this e-mail or any attachments have been sent

to you in error, that error does not constitute waiver
of any confidentiality, privilege or copyright in respect
of information in the e-mail or attachments.
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
1
61
Burton, Aimee
From: Diment, David

To: Smith, Susie
2
ce 98
Sent from my iPad
ffi 1
Hi Frances
O ct
Sorry I wasnt aware this had come through we have apparently negotiated for an extension to
respond until later today.
n A
I think if we are changing the advice that we will still be accepting Medicare cards, we should say so
tio OI
in our media response.
I understand David Diment is preparing a response and this will also be provided to media unit.
xa F
Regards
Susie
r
Ta e
n nd
lia u
Susie Smith
ra d
P 02 621 62073 M 0437 895 708

st ase
From: Media Unit

To: Smith, Susie
Au le
e

R

To: Media Unit
Subject:
I understand that as a result of the sale of Medicare cards on the darknet these cards have now been removed from the
list of documents that can be used to verify Id on the DVS. I understand the ATO has advised staff in an email of the
change today, advising staff to no longer accept as part of the PORO process.
I just want to get your response on the decision to make this change to remove Medicare ID cards from the DVS. I
also want to get some clarification from the ATO about how this will affect Australians' dealing with the agency.
Medicare are still currently listed as secondary forms of ID on some pages, will these be amended?
1
62
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee
From: Diment, David

To: Smith, Susie
Cc: Jepsen, David
2
In a phu now with DHS and AGS
ce 98
Sent from my iPad
ffi 1
I saw him. We will need to be a little more expansive in response so David Jepsen will work on that
O ct
with Patrick.
n A
Cheers
Susie
tio OI
xa F
Susie Smith
r

Ta e
P 02 621 62073 M s47F

n nd
From: Diment, David

lia u
To: Smith, Susie

ra d

st ase
Sent from my iPad

Au le
Hi Frances
e
R
media unit.
Regards
Susie
1
64
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee
From: Diment, David

To: Smith, Susie
2
Yes Thanks
ce 98
instruction DD
ffi 1
Sent from my iPad
O ct
n A
tio OI
xa F
Thanks
r
Susie
Ta e
n nd
Susie Smith
lia u

P 02 621 62073 M s47F
ra d
st ase
From: Diment, David

To: Smith, Susie
Au le

e
Sent from my iPad

R
Hi Frances
1
66
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
transmitted with or as part of this e-mail. You should employ virus
checking software.
Guardian News & Media Limited is a member of Guardian Media Group plc.
Registered Office: PO Box 68164, Kings Place, 90 York Way, London, N1P
2AP. Registered in England Number 908396
2
ce 98
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
3
68
Burton, Aimee
From: Diment, David

Cc: Smith, Susie; Jepsen, David
Subject: Re: Media response [DLM=For-Official-Use-Only]
2
Melessa (Dep Sec DHS) came back to me and said there will be one response from Govt so we have ours on hold DD
ce 98
Sent from my iPad
ffi 1
On 5 Jul 2017, at 4:53 pm, McMorrow, Frances <Frances.McMorrow@ato.gov.au> wrote:
O ct
Frances McMorrow
n A
CAS
tio OI
P 02 6216 1179 I M s47F I F 02 6250 0742
xa F
<image002.jpg>
r
Ta e
From: Smith, Susie

n nd

lia u
Thanks Frances
ra d
David Jepsen from my team will provide them with our cleared final media response now when he
st ase
does to journalist.
Regards
Susie
Au le
e
R
Susie Smith
P 02 621 62073 M s47F

To: Smith, Susie
Cc: Diment, David
1
69
Hi Susie,
David and I have just finished a phone hook up with DHS and AGDs re this
Medicare issue. We have promised to send them our draft response to The
Guardian for review. Contacts are Malisa Golightly and
mark.withnell@humanservices.gov.au
Thanks, Frances.
2
Frances McMorrow
ce 98
CAS
ffi 1
P 02 6216 1179 I M s47F I F 02 6250 0742
O ct
<image003.jpg>
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
2
70
Burton, Aimee
From: Diment, David

Subject: Re: DVS system acceptance of Medicare card [SEC=UNCLASSIFIED]
Thank you DD
2
ce 98
Sent from my iPhone
On 5 Jul 2017, at 5:51 pm, McMorrow, Frances <Frances.McMorrow@ato.gov.au> wrote:
ffi 1
O ct
Frances McMorrow
n A
CAS
tio OI
P 02 6216 1179 I M s47F I F 02 6250 0742
xa F
<image001.jpg>
r
From: Edward, Pam

Ta e

n nd
Hi Frances,
lia u
I confirm that I have spoken with Dani Donne and also emailed her with the request to reinstate
ra d
acceptance of Medicare cards in DVS.

st ase
Regards,
Au le
e
Pam Edward
R

P 03 9215 3409 M s47F
1
71
Burton, Aimee
From: Diment, David

Subject: Fwd: https://www.theguardian.com/australia-news/2017/jul/06/medicare-data-
breach-tax-office-suspends-cards-as-id-before-u-turn [SEC=UNCLASSIFIED]
2
Fyi
ce 98
Sent from my iPad
ffi 1
Begin forwarded message:
From: "Cawthra, Frances" <Frances.Cawthra@ato.gov.au>
O ct
Date: 6 July 2017 at 8:51:10 am AEST
To: "Diment, David" <David.Diment2@ato.gov.au>
n A
Cc: "Cawthra, Frances" <Frances.Cawthra@ato.gov.au>
Subject: https://www.theguardian.com/australia-news/2017/jul/06/medicare-data-breach-tax-
office-suspends-cards-as-id-before-u-turn [SEC=UNCLASSIFIED]
tio OI
Article on Medicare cards
xa F r
Frances Cawthra
Ta e

n nd

P 02 621 62149 M s47F
lia u
ra d
st ase
Au le
e
R
1
72
Burton, Aimee
From: Diment, David

Subject: Re: Medicare Card and DVS urgent briefing [DLM=For-Official-Use-Only]
Can you just include more detail in the consultation para Not clear from this doc whether we spoke to DHS
2
ce 98
Sent from my iPhone
On 6 Jul 2017, at 10:44 am, McMorrow, Frances <Frances.McMorrow@ato.gov.au> wrote:
ffi 1
Hi David,
O ct
n A
Background
tio OI
xa F
r
Ta e

n nd
Action taken
lia u
s47E
ra d

st ase
Au le
e

R
o ImmiCard
certificate)
1
73
cards.
these staff.
2
ce 98
ffi 1
O ct
checks: s47E
n A
Consultation
tio OI
xa F
r
Ta e

n nd
Resolution
lia u
ra d
6 at 5.15pm.
st ase
Frances McMorrow
Au le

CAS
e

P 02 6216 1179 I M s47F I F 02 6250 0742
R
<image003.jpg>
2
74
Burton, Aimee
From: Diment, David

Subject: Fwd: Medicare Card and DVS urgent briefing [DLM=For-Official-Use-Only]
2
ce 98
Sent from my iPhone
ffi 1
From: "McMorrow, Frances" <Frances.McMorrow@ato.gov.au>
O ct
To: "Cawthra, Frances" <Frances.Cawthra@ato.gov.au>
Cc: "Diment, David" <David.Diment2@ato.gov.au>
n A
Hi Frances,
tio OI
xa F
Regards, Frances.
r
Ta e
Background
n nd
A news article issued on July 4 2017, regarding the potential availability for purchase
of Medicare card details through a dark net trader.
lia u
We were concerned about this because the Medicare card is one of the items that
can be checked though the Document Verification Service (DVS) to obtain a linking
ra d
code for myGov interaction with the ATO. This is the time of year when risks of
st ase
identity theft and refund fraud rise exponentially. We checked with Attorney
Generals Department (who own DVS), who advised the matter had been referred
to the AFP.
Au le
Action taken
e
s47E
R
This decision was made within the team and was not escalated to any
SES for approval.
This was done on July 4 at 3.26pm, and Attorney Generals Department was
requested to remove the Medicare Card from the list of items that could be verified
through DVS.
1
75
o ImmiCard
o A linking document (marriage certificate, birth certificate, or change
of name certificate)
2
ce 98
Attorney Generals Department did confirm, on July 4, that they could very quickly
resume inclusion of the Medicare card for DVS checks on receipt of an email from
the ATO.
ffi 1
ATO contact centre staff were advised on July 5 (7.53am) that the Medicare card
was not to be used in DVS document checks until further notice, as a result of
O ct
recent media coverage on Medicare cards.
n A
Scripting for contact centre staff was modified simultaneously, and headline alerts
were issued to these staff.
tio OI
Risk: Medicare cards are one document that can be verified in DVS in order for a
xa F
caller to pass Proof of Record Ownership with the ATO. It is part of the process to
get a myGov linking code to access online records for taxation and superannuation
r
records.
Ta e
It is now peak Tax Time, and exposure of Medicare card details to unauthorised
n nd
third parties, particularly card number, Individual Reference Number (IRN) and
expiry date are relevant in DVS checks: s47E
lia u
ra d
Consultation
st ase
The consultation process was internal and conducted at the incorrect APS level. It
should have been escalated for consultation and approval internally, and should
have included discussion with external stakeholders (namely DHS) at the
appropriate levels.
Au le
While we did talk to Attorney Generals Department, they did not provide advice on
e
the matter, merely acting on our request to block the DVS.

R
Resolution
The decision was rescinded yesterday, July 6 at 4.18pm. ATO staff were instructed
to resume use of the Medicare card in the list of items that could be checked
through DVS and scripting was updated.
Attorney Generals Department were requested to resume acceptance of the

Medicare card on July 6 at 5.15pm. Our normal PORO processes are back in place.
2
76
Frances McMorrow
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
2
ce 98
ffi 1
O ct
n A
tio OI
xa F r
Ta e
n nd
lia u
ra d
st ase
Au le
e
R
3
77
Burton, Aimee
From: Diment, David

Subject: Fwd: For urgent clearance: PMO request l Due now l Talking points re Medicare
numbers [SEC=UNCLASSIFIED]
Attachments: image001.png
2
ce 98
As per your text Pls send this to Annie for phones
Sent from my iPhone
ffi 1
O ct
From: "Smith, Susie" <Susie.Smith@ato.gov.au>
n A
To: "Cawthra, Frances" <Frances.Cawthra@ato.gov.au>, "Mossop, Kathy"
<Kathy.Mossop@ato.gov.au>
Cc: Parliamentary Services <ParliamentaryServices@ato.gov.au>, "Jepsen, David"
tio OI
<David.Jepsen@ato.gov.au>, "McMorrow, Frances" <Frances.McMorrow@ato.gov.au>, "Diment,
David" <David.Diment2@ato.gov.au>
Subject: RE: For urgent clearance: PMO request l Due now l Talking points re Medicare numbers
xa F
[SEC=UNCLASSIFIED]
r
Kathy
Ta e
n nd
The ATO has confirmed that the use of Medicare cards as part of the identity verification
process was temporarily halted today in error.
Some premature internal guidance yesterday on the back of media coverage that suggested
lia u
potential false Medicare data might be in circulation.

The ATO promptly withdrew this guidance and Medicare cards can now be used as part of
ra d
the normal identity verification process. In addition they have reinforced the need for Senior
Executive clearance before any guidance is issued to staff on how they should treat proof of
st ase
identity documentation.
Regards
Susie
Au le
e
R
Susie Smith
P 02 621 62073 M s47F

Subject: RE: For urgent clearance: PMO request l Due now l Talking points re Medicare numbers
[SEC=UNCLASSIFIED]
1
78
Change one thing..
Good to go
Frances Cawthra

P 02 621 62149 M s47F
2
ce 98
From: Smith, Susie
ffi 1
Subject: For urgent clearance: PMO request l Due now l Talking points re Medicare numbers
[SEC=UNCLASSIFIED]
O ct
Importance: High
n A
HI All
tio OI
xa F
Some premature internal guidance yesterday on the back of media coverage that suggested
potential false Medicare data might be in circulation.

r
The ATO promptly withdrew this guidance and Medicare cards can now be used as part of
Ta e
the normal identity verification process. In addition they have reinforced the need for Senior
Executive clearance before any guidance is issued to staff on how they should treat proof of
n nd
identity documentation.
lia u
Regards
ra d
Susie
st ase
Susie Smith
Au le

P 02 621 62073 M s47F
e
From: Mossop, Kathy

R

Hi Frances,
2
79
They have rectified this and Medicare cards can now be used as part of the normal identity
verification process.
Regards
Kathy
2
From: Mossop, Kathy
ce 98
To: Diment, David
ffi 1
Hi David,
O ct
n A
Regards
Kathy
tio OI
xa F
From: Mossop, Kathy
r

Ta e

n nd
Hi Frances,
lia u
Due asap
ra d
st ase
http://www.dailytelegraph.com.au/technology/confusion-grows-over-medicare-dark-web-breach-
as-the-tax-office-briefly-stopped-taking-cards-as-id/news-

Au le
Regards
e
Kathy
R
Kathy Mossop
P 02 621 61046 M s47F
m m m m V
3
80
Burton, Aimee

To: Diment, David
Subject: URGENT Heads Up: Medicare cards and the darknet [SEC=UNCLASSIFIED]
Importance: High
2
ce 98
Following the media article regarding potential theft of Medicare details, we have removed the
Medicare Cared from PORO documentation that we verify via AGDs Document Verification
Service.
ffi 1
This decision was made earlier today after Pam consulted with Lynne Socha and Information
Security. We have advised contact centre staff of alternate PORO documentation (see below).
O ct
We have now received a media enquiry asking how this will affect people dealing with the ATO.
n A
Let me know if you see any issues with this, or want to see the media response which is due by
4pm.
tio OI
Frances McMorrow
xa F
CAS
r

Ta e
P 02 6216 1179 I M s47F F 02 6250 0742

n nd
lia u
From: Edward, Pam

ra d
Sent: Wednesday, 5 July 2017 8:26 AM

st ase
Subject: UPDATE ONLY Medicare cards and the darknet [SEC=UNCLASSIFIED]

Importance: High
Hi Frances,
Au le
We have removed the Medicare card from the list of DVS-able documents for PORO pending the receipt of further
information from Attorney Generals Department regarding the extent of the impact.
e
R
This still leaves inbound callers with the following options for extensive PORO, which is used when the PORO Tool
cannot be used (eg. for a myGov linking code):

o ImmiCard
1
81
We will make a decision regarding reinstatement of the Medicare card as a DVS-able document after we have more
information from Attorney Generals Department.
We have asked Attorney Generals Department to exclude the Medicare card from DVS, and this has been done, so
even if ATO staff inadvertently try to verify a Medicare card, DVS will not allow access.
Alerts are issuing to all frontline staff today.
Regards,
2
ce 98
Pam Edward
ffi 1
P 03 9215 3409 M s47F
O ct
n A
From: Edward, Pam
Sent: Tuesday, 4 July 2017 2:47 PM
tio OI
Subject: HEADS UP: Medicare cards and the darknet [SEC=UNCLASSIFIED]
xa F
Hi Frances,
I am not sure if you have heard about this a news article came out today regarding the availability for purchase of
r
Ta e
Medicare card details through a dark net trader.

n nd
Because the Medicare card is one of the items that can be checked though DVS for PORO/POI, we have checked
with Attorney Generals Dept (who own DVS) and they have advised that they:
know as much as we do;
lia u
sent a referral to the AFP this morning that also requested more information;
will follow up on that referral, seeking specific answers regarding the expiry dates on cards (not mentioned
ra d
in the press article), and critical to determining the next steps.

st ase
DHS have confirmed that the issue is under investigation.
Attorney Generals Department have advised us that they can very quickly turn off the DVS check for Medicare cards
all that is needed is an email from us, and the shutdown will effected immediately.
Au le
I will keep you advised of developments and impacts on the PORO/POI process: Medicare card checks are part of
the process to get a myGov linking code to access online records for tax and superannuation.
e
R
Regards,
Pam Edward
P 03 9215 3409 M s47F
2
82
Burton, Aimee

To: Diment, David
Subject: FW: Media enquiry from the Guardian [SEC=UNCLASSIFIED]
Importance: High
2
ce 98
Frances McMorrow
ffi 1
CAS
O ct
P 02 6216 1179 I M s47F I F 02 6250 0742
n A
tio OI
From: Edward, Pam
xa F
Subject: RE: Media enquiry from the Guardian [SEC=UNCLASSIFIED]
r
Importance: High
Ta e
n nd
Hi Frances,
s47E
lia u
Background
ra d
Following the release of the news article yesterday regarding the availability for purchase of Medicare card details
st ase
through a dark net trader, the Medicare card has been temporarily removed from the available items of proof that
can be verified through the Document Verification Service. The details verified are the name, number and expiry
date.
DHS have advised us that this matter is still under investigation. They have confirmed that the matter has been
Au le
referred to the Australian Federal Police.

e
s47E
R
Where proof of record ownership for a client requires that documents be checked using the Document Verification
Service, this can still be confirmed using the following documents:

o ImmiCard
1
83
The Medicare card is one of the options available for use to obtain a linking code to use ATO Online, and this could
pose a risk.
s47E
2
The page referred to in the email below does not require amending, as it is not the process for DVS verification, but
ce 98
to explain the process for TFN registration, which incorporates several other documents.
Regards,
ffi 1
O ct
Pam Edward
n A
tio OI
P 03 9215 3409 M s47F
xa F r

Ta e

To: Edward, Pam
n nd

Importance: High
lia u
ra d
Frances McMorrow
st ase

CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
Au le
e
R

Importance: High
Hi Frances,
I thinks this one sits with you. Are you able to respond.
Let me know if you need any input from us.
Regards
Annie
2
84
From: Media Unit
To: Ferguson, Annie
Cc: Media Unit; O'Neill, Julia; Jepsen, David
Subject: Media enquiry from the Guardian [SEC=UNCLASSIFIED]
Hi Annie,
2
We have received an urgent media enquiry from the Guardian about use of Medicare cards as identity are we able
ce 98
to provide any response within their time frame of 3:30 today?
Enquiry
I understand that as a result of the sale of Medicare cards on the darknet these cards have now been removed from
ffi 1
the list of documents that can be used to verify Id on the DVS. I understand the ATO has advised staff in an email of
the change today, advising staff to no longer accept as part of the PORO process.
O ct
n A
tio OI
I need an ASAP response by 3:30pm.
Best regards,
xa F
Patrick
r
Ta e
Patrick Baume
n nd
Media Advisor I Media Unit

P 02 621 64187 M s47F
lia u
ra d
st ase
Au le
e
R
3
85
Burton, Aimee

To: Diment, David
Importance: High
2
ce 98
Frances McMorrow
ffi 1
CAS
O ct
P 02 6216 1179 I M s47F I F 02 6250 0742
n A
tio OI
From: Edward, Pam
xa F
r
Importance: High
Ta e
n nd
Frances, the instruction has been revoked, and SMART scripting is now being amended to reinstate the Medicare
card.
lia u
Thanks,
ra d
st ase
Pam Edward
Au le
P 03 9215 3409 M s47F

e
R
From: Edward, Pam

Subject: RE: Media enquiry from the Guardian [SEC=UNCLASSIFIED]
Importance: High
Hi Frances,
s47E
1
86
Background
Following the release of the news article yesterday regarding the availability for purchase of Medicare card details
through a dark net trader, the Medicare card has been temporarily removed from the available items of proof that
can be verified through the Document Verification Service. The details verified are the name, number and expiry
date.
DHS have advised us that this matter is still under investigation. They have confirmed that the matter has been
referred to the Australian Federal Police.
2
s47E
ce 98
ffi 1
Where proof of record ownership for a client requires that documents be checked using the Document Verification
Service, this can still be confirmed using the following documents:
O ct
n A
o ImmiCard
tio OI
o
o
o
Australian Marriage certificates
Change of Name certificate
Australian driver's licence or learner's permit
xa F
The Medicare card is one of the options available for use to obtain a linking code to use ATO Online, and this could
r
pose a risk.
Ta e
n nd
s47E
The page referred to in the email below does not require amending, as it is not the process for DVS verification, but
lia u
to explain the process for TFN registration, which incorporates several other documents.
ra d
Regards,
st ase
Pam Edward
Au le

e

P 03 9215 3409 M s47F
R

To: Edward, Pam
Importance: High
2
87
Frances McMorrow
CAS
P 02 6216 1179 I M s47F I F 02 6250 0742
2
ce 98
ffi 1
Importance: High
O ct
Hi Frances,
n A
I thinks this one sits with you. Are you able to respond.
Let me know if you need any input from us.
Regards
Annie
tio OI
xa F
From: Media Unit
To: Ferguson, Annie
r
Cc: Media Unit; O'Neill, Julia; Jepsen, David

Ta e
Subject: Media enquiry from the Guardian [SEC=UNCLASSIFIED]

n nd
Hi Annie,
We have received an urgent media enquiry from the Guardian about use of Medicare cards as identity are we able
lia u
to provide any response within their time frame of 3:30 today?

ra d
Enquiry
st ase
I understand that as a result of the sale of Medicare cards on the darknet these cards have now been removed from
the list of documents that can be used to verify Id on the DVS. I understand the ATO has advised staff in an email of
the change today, advising staff to no longer accept as part of the PORO process.
Au le
e

R
Best regards,
Patrick
Patrick Baume
Media Advisor I Media Unit
P 02 621 64187 M s47F
3
88
R
e
Au le
st ase
ra d
lia u
n nd
4
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
89
2
Burton, Aimee
From: Smith, Susie

To: Cawthra, Frances; Diment, David
Cc: Jepsen, David; O'Neill, Julia
Subject: Medicare cards enquiry [SEC=UNCLASSIFIED]
2
Hi Frances
ce 98
Sorry I wasnt aware this had come through we have apparently negotiated for an extension to respond until later
today.
ffi 1
I think if we are changing the advice that we will still be accepting Medicare cards, we should say so in our media
response.
O ct
n A
Regards
Susie
tio OI
xa F r
Susie Smith
Ta e

n nd
P 02 621 62073 M s47F
From: Media Unit

lia u

To: Smith, Susie
ra d

st ase

To: Media Unit
Au le
Subject:
e

R
I understand that as a result of the sale of Medicare cards on the darknet these cards have now been removed from the list of documents
that can be used to verify Id on the DVS. I understand the ATO has advised staff in an email of the change today, advising staff to no
longer accept as part of the PORO process.
I just want to get your response on the decision to make this change to remove Medicare ID cards from the DVS. I also want to get some
clarification from the ATO about how this will affect Australians' dealing with the agency. Medicare are still currently listed as
secondary forms of ID on some pages, will these be amended?
Thanks,
--
1
90
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee
From: Smith, Susie

To: Diment, David
Cc: Jepsen, David
Subject: RE: Medicare cards enquiry [SEC=UNCLASSIFIED]
2
I saw him. We will need to be a little more expansive in response so David Jepsen will work on that with Patrick.
ce 98
Cheers
Susie
ffi 1
O ct
Susie Smith
n A
P 02 621 62073 M s47F
tio OI
From: Diment, David
xa F
To: Smith, Susie
r
Ta e

n nd
Sent from my iPad

lia u
Hi Frances
ra d
st ase
Au le
e
Regards
R
Susie
Susie Smith
P 02 621 62073 M s47F
1
92
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2
Burton, Aimee
From: Smith, Susie

To: Diment, David; Cawthra, Frances
Cc: Baume, Patrick; Jepsen, David
Subject: For urgent response : Medicare cards enquiry [SEC=UNCLASSIFIED]
Follow Up Flag: Follow up
2
Flag Status: Flagged
ce 98
ffi 1
We can confirm that the use of Medicare cards as part of the identity verification process was temporarily halted
today in error. This has been rectified and Medicare cards can now be used as part of the normal identity verification
O ct
process
n A
Thanks
Susie tio OI
xa F
Susie Smith
r

Ta e

P 02 621 62073 M s47F
n nd
From: Diment, David

lia u
To: Smith, Susie

ra d

st ase
Sent from my iPad

Au le
Hi Frances
e
R
Regards
Susie
1
94
R
e
Au le
st ase
ra d
lia u
n nd
Ta e
xa F r
tio OI
n A
O ct
ffi 1
ce 98
2

Medicare ATO

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Medicare ATO

Caricato da

Copyright:

Formati disponibili

ADVISORIES RELATING TO MEDICARE CARD USE CONTAINED IN IDENTITY CRIME MANAGEMENT

AND SUPPORT SHAREPOINT

SMART scripting amendments will be effected asap.

Client Register Integrity and Future Design

Enterprise Register and Accounts | Service Delivery

From: Maseko, Susan

To: Hannaford, Michelle

Subject: Medicare cards and PORO process [SEC=UNCLASSIFIED]

Could you please provide the following info to staff in scripting:

Good morning Chris

A/g Chief Operating Officer

P 02 621 62149 M s47F

From: Smith, Susie

Sent: Wednesday, 5 July 2017 4:44 PM

To: Smith, Susie

Subject: Re: For urgent response : Medicare cards enquiry [SEC=UNCLASSIFIED]

Sent from my iPad

On 5 Jul 2017, at 4:36 pm, Smith, Susie <Susie.Smith@ato.gov.au> wrote:

Are you both comfortable with this response?

part of the normal identity verification process

Please let me know ASAP

From: Diment, David

Just spoken to Patrick DD

Assistant Commissioner, Public Affairs, ATO Corporate

P 02 621 62073 M s47F

From: Media Unit

From: Paul Farrell s47F

Sent: Wednesday, 5 July 2017 2:41 PM

Hi thanks for your time.

From: Cawthra, Frances

courtesy copy their media teams in as well).

Australian Taxation Office

From: Diment, David

Sent: Wednesday, 5 July 2017 4:44 PM

Subject: Re: For urgent response : Medicare cards enquiry [SEC=UNCLASSIFIED]

Sent from my iPad

On 5 Jul 2017, at 4:36 pm, Smith, Susie <Susie.Smith@ato.gov.au> wrote:

Are you both comfortable with this response?

Please let me know ASAP

Sent from my iPad

From: Media Unit

From: McMorrow, Frances

From: Smith, Susie

Sent: Wednesday, 5 July 2017 4:50 PM

To: Smith, Susie

Subject: Media response [DLM=For-Official-Use-Only]

P 02 6216 1179 I M s47F I F 02 6250 0742

From: McMorrow, Frances

Australian Taxation Office

From: McMorrow, Frances

From: Smith, Susie

I think they wanted to see it before it went to the journalist.

Australian Taxation Office

From: Smith, Susie

To: McMorrow, Frances

Subject: RE: Media response [DLM=For-Official-Use-Only]

From: McMorrow, Frances

Australian Taxation Office

From: Smith, Susie

Assistant Commissioner, Public Affairs, ATO Corporate

P 02 621 62073 M s47F

From: Cawthra, Frances

A/g Chief Operating Officer

From: McMorrow, Frances