Important Principle
I hope that the citizens whose identities were falsely used receive every cent of their refunds when they file genuine returns immediately, without waiting for the money to be recovered from the criminals. The IRS is the entity that accepted the false filings, it, and not they, should be the victim.
The same should apply in similar cases involving banks.
Entities like this can control their choice of security measures; if they fail to adequately verify the identity of people making withdrawals or whatever, they need to be the ones responsible.
Biting the hand that feeds IT
