when you file your tax paperwork each year you have to tell them which bank account to send the refund to.
if someone else can file for you they can put in whatever info they like, so.
if someone else can file for you they can put in whatever info they like, so.
if they think you're the target of identity theft they can step it up to requiring a PIN that they mail you?
Here in Denmark we have MitID, which you kind of use for everything. Taxes, every private banking login (you switch banks, keep the login), signing documents, all kinds of healthcare websites and apps, student loans and what not.