Internal Revenue Service officials promised that IRS agents wouldn’t knock on doors to enforce Obamacare, but they have ways of making sure people comply with the individual mandate.

The Washington Examiner’s Byron York explains in his new column:

What they mention less frequently is that the IRS has another way to get the money. About three-quarters of U.S. taxpayers receive refunds after filing their returns each year, with the average refund nearly $3,000. After 2014, those people will discover the IRS can take the penalty out of their refunds.

“The IRS is prevented from issuing liens or levies or other enforcement action,” Nina Olson, who holds a job called the National Taxpayer Advocate at the IRS, told a House hearing in August. “It can collect that mandate through what we call ‘refund offset,’ where a taxpayer has a refund coming to them and we would offset that refund amount with the amount of the penalty.”

Olson also predicted that people would be surprised by these deductions as they underwent a “learning curve” in trying to comply with the new regulations.

The IRS, naturally, took a more optimistic view of the situation when questioned by Congress. “In most cases, taxpayers will file their tax returns reporting their health insurance coverage, and-or making a payment, and there will be no need for further interactions with the IRS,” IRS Deputy Commissioner Steven Miller said in September.

York also noted that Obamacare requires the IRS to share taxpayer information with other agencies. “This agency takes data security very, very seriously,” IRS Commissioner Douglas Shulman assured Congress.

The Government Accountability Office reported last year, though, that the IRS does a very poor job of keeping taxpayer information secure.

“In fiscal year 2011, IRS continued to have a material weakness in internal control over information security,” the GAO reported. “In particular, it had deficiencies in its controls over access to the automated systems and software applications it relies upon to process its financial transactions, produce its internal and external financial reports, and safeguard related sensitive information.”