The Internal Revenue Service headquarters in Washington. (Photo by Bill O’Leary/The Washington Post)

Even during this era of cyber-insecurity, here’s a chilling figure: 3.1 billion.

That’s the number of dollars the Internal Revenue Service (IRS) paid in bogus tax refunds in 2014 because of identity theft refund fraud, according to the Government Accountability Office.

The IRS has a Taxpayer Protection Program (TPP) that sounds like it should provide security. It does, but not enough to prevent IRS from paying $30 million to identity theft fraudsters in 2014, based on the 1.6 million screened by the program.  That’s just one of the ways Uncle Sam fights identity theft fraud. About 7,200 of them were bogus. In total, IRS processed more than 150 million individual tax returns in 2015.

Overall, the GAO report indicates the IRS does a decent job of detecting and stopping ID fraud, which is a big business. Crooks attempted to get $25.6 billion from bogus refunds in 2014. The IRS beat them most of the time, stopping or recovering the theft of $22.5 billion, 88 percent of the attempted pillage. But in the remaining cases, crooks got the $3.1 billion.

That could be a low-ball estimate, however. GAO says the IRS might have been beaten an unknown number of times for an undetermined amount of money by undetected cheating.

Regarding TPP authentication, IRS likely underestimated how many fraudulent returns it passed “because the agency did not include potential IDT (identity theft) returns that closely matched information returns provided by third parties, such as W-2s” said James R. McTigue, Jr., GAO’s director of strategic issues.