While tangential to the issue discussed here, one example of siphoning tax refunds http://www.cringely.com/2012/03/the-30-billion-hack/ (i think that was linked on HN last week)

VAT statements in Germany are a bit riskier though: If you give the Revenue Service permission to withdraw money and I file a VAT statement for you which shows a large income they'll just go and collect 20%. It's a bit an edge case but that's the reason I manually send the VAT collected each month. I'd feel much safer if the interface was authenticated in some way.