A recent IRS audit found that nearly 500,000 enrollees in Obamacare were able to claim more than $235 million in excess subsidies that the Government will have difficulty collecting back. With a history of fraud and abuse in other federal healthcare programs, it is not hard to believe that the Obamacare vulnerabilities will quickly be exploited as long as they remain in place.  

Obamacare subsidies are based on income.  Enrollees are asked to guess what their future income will be when they sign up in order to calculate their subsidy.  Originally, Obamacare was supposed to do instant checks on previous income levels and follow up with applications that seemed out of character.  The administration loosened those follow-up procedures and replaced them with a disclaimer -"do your best to account for any changes you think will happen."  

In order to account for any miscalculations, the government's current plan involves either providing additional subsidies for those who over-guess, or those who under-guess will have to pay back their excess subsidy money.  

But the issue is that the law caps the total amount of subsidy money that must be returned to the government.  This cap is range bound ($300-$2,500) based on income for those making under 400% of poverty.

Here's an example: A family makes a guesstimate of $40,000 as their annual income for next year.  That gets them a subsidy of $7,980 for the year.  Come filing season their return shows that the family actually made $95,000 and that their subsidy should have been $828.  The difference in subsidy is $7,152, but the family is below 400% of poverty and thus is capped at $2,500 and the taxpayer is on the hook for the $4,645 subsidy difference.

Loopholes like this aren’t limited to premium subsidy caps - you will find similar caps in co-payments and deductibles that follow similar logic.

What is important to note is that the law sharply restricts the ways that the IRS can recover unpaid penalties, other than subtracting them from refunds.  Those who simply make sure they don't receive a refund each year will be able to exploit this loophole until a fix is made.