The unusual case reached Greece’s tax-dispute authorities after the taxpayer challenged assessments stemming from amended income-tax returns that he says he never filed.
But the Independent Authority for Public Revenue, Greece’s tax agency, never ultimately determined whether his account had been hacked or whether somebody else had submitted the returns. His appeal was dismissed on procedural grounds because it was filed more than two years after the statutory deadline.
The case highlights a potentially costly consequence of identity theft in an increasingly digital tax system: fraudulent changes to a taxpayer’s reported income can produce genuine tax liabilities, while the usual deadlines for challenging an assessment continue to run.
The episode began on Dec. 27, 2023, when amended income-tax returns for the 2021 and 2022 tax years were submitted through TAXISnet, Greece’s online tax platform.
The returns reported an additional €13,000 of income for 2021 and €11,000 for 2022, attributing the money to construction-related employment.
The taxpayer said none of that income was his. He said he had never worked in construction and had for years been employed full time by the same company.
The amended returns nevertheless had immediate tax consequences. Authorities assessed €2,638.71 for 2021 and €2,548.92 for 2022. Including the applicable additional charges, the total amount assessed reached €6,596.23.
The taxpayer told the authorities that he hadn't submitted the amended returns. Instead, he alleged that unidentified third parties had obtained his TAXISnet credentials and accessed his account without his knowledge or consent.
He linked the changes to an alleged attempt at bank fraud.
According to his account, the purpose of adding €24,000 in purported income was to make his finances appear stronger so that someone could seek a loan using his identity. In effect, he argued that the false tax filings were part of an effort to manufacture the income profile of a more creditworthy borrower.
To support his claims, the taxpayer submitted a range of documents to the authorities. They included an employment-history certificate from Greece’s social-security agency, a complaint filed with the country’s cybercrime authorities, police records, information concerning IP addresses, documents from National Bank of Greece and a formal declaration alleging that his TAXISnet credentials had been stolen.
In supplementary filings, he also submitted recorded conversations with the bank and a chronology of email correspondence.
His argument was straightforward: he shouldn't owe taxes arising from declarations that, according to him, were the product of criminal conduct by third parties.
He also argued that the tax administration had failed to give sufficient weight to evidence of unauthorized access, banking records and the related criminal proceedings. He invoked legal principles including proportionality and the protection of legitimate expectations.
Despite those allegations, Greece’s Directorate for Dispute Resolution, the administrative body that reviews taxpayer challenges before they can proceed further through the legal system, didn't decide whether the TAXISnet account had actually been compromised.
Nor did it determine whether third parties had filed the amended returns or whether the alleged loan-fraud scheme had occurred.
Instead, the case turned on a procedural question.
According to the case record, the tax assessments were posted to the taxpayer’s TAXISnet account on Feb. 21, 2024, and were recorded as having been read that same day. The dispute-resolution authority therefore considered the assessments to have been legally served as of that date.
Under the applicable rules, the taxpayer had 30 days to file an administrative appeal. His deadline was March 22, 2024.
He didn't file the appeal until April 10, 2026—more than two years after the deadline had expired.
That delay determined the outcome. The Directorate for Dispute Resolution rejected the appeal as inadmissible because it was filed late, meaning it didn't need to rule on the substance of the taxpayer’s allegations.
The distinction is significant. The decision neither confirms nor rejects his claim that his TAXISnet credentials were stolen. It also makes no finding that the disputed €24,000 represented income he actually earned.
The authority ruled only that the taxpayer had missed the legal deadline for challenging the assessments through that particular administrative procedure.
The decision doesn't necessarily bring the underlying tax dispute to an end.
The dispute-resolution authority pointed to another option available to the taxpayer: He can file amended returns seeking to withdraw the disputed income reported for the 2021 and 2022 tax years, provided he does so within the applicable statute-of-limitations period.
That route could allow the tax authorities to reconsider the €24,000 in construction-related income separately from the administrative appeal that was dismissed.
