Identity thieves, using the IRS website to gain access to information on 104,000 U.S. taxpayers, filed fake tax returns and collected as much as $50 million in refunds, Commissioner John Koskinen said.

The thieves had enough personal information on the taxpayers to get past the security filters on the “Get Transcript” function on the Internal Revenue Service’s website, Koskinen said Tuesday on a conference call with reporters. That allowed them to gain access to past tax returns.