Cybercriminals are plotting to take advantage of tax season, by fraudulently impersonating consumers and scamming Americans. For the citizens of the United States, tax season is upon us, during which we diligently file our annual tax returns with the US Internal Revenue Service (IRS). A big problem, however, is that, in this digital age of electronically filing forms, the checks and balances to protect against fraud have not satisfactorily kept pace.
Tax ID fraud a terrible problem
Cybercriminals are taking advantage of weak identification validation controls to commit tax fraud. Tax identity theft happens when someone files a fake tax return using your personal information and submits information that results in a refund—but to them, not you. They use your name and social security number with fictitious data, such as a different employer and address, to get a tax refund from the IRS. The IRS, not knowing better, accepts the information and is compelled to issue the refund in a very timely manner, else they must pay interest. So the common practice is to accept the information at face value and issue the refund to the submitter. Thieves will have the funds placed on a prepaid debit card or obtain a refund check they will quickly have cashed. If things are later found to be incorrect, the IRS may move to resolve the problem, but the criminal in most cases is long gone. The real citizen is then left with a rejection notice stating a filing has already taken place when they file their legitimate tax forms. It can take a very long time to correct the matter, more than a year to receive an earned refund, and many frustrating hours navigating through the confusing process.
Attackers are committing a lot of fraud and both the IRS and Federal Trade Commission (FTC) are concerned because the problem swells in size every year. Tax or wage ID theft complaints more than doubled, to more than 221,000 in 2015 from 109,000 in 2014. In the United States, ID theft is on the rise. The FTC received more than 490,000 consumer complaints, a 47% increase over 2014, with the biggest contributor to the rise being tax refund fraud. The US Bureau of Justice estimates 17.6 million Americans were victims of identity theft in 2014. That is about 7% of the US population aged 16 years or older.
Most of the IRS efforts to date have centered on prevention. For 2016, the IRS and FTC have rolled out consumer education and incident reporting sites. Tax identity theft, which can include other forms of tax fraud, has been the most common form of identity theft reported to the FTC during the past several years. The IRS prides itself in quick turnaround for processing electronic filings and issuing refunds, aiming for around 10 days. Within that process is a set of filtering algorithms, which improve every year, to identify fraudulent tax submissions. In 2015 the IRS flagged about 5 million suspicious returns, protecting US$11 billion.
Recently, the US federal government targeted south Florida, one of the nation’s hot spots for ID fraud, and issued a Geographic Targeting Order for check cashing companies to take extra steps in verifying customers’ identification before cashing income tax returns. For refund checks greater than $1,000, customers must provide valid government-issued identification, and the check cashing company must take a digital picture of the customer and obtain a clear thumbprint for the transaction to proceed. These are extreme measures to be sure, but one targeted specifically for two counties to stem the flow of tax fraud.
Best practices to protect yourself against tax ID fraud
- File your taxes as early as possible. Sadly, it is a race. The first submission, whether it be yours or a fraudster’s, will likely be the return accepted from the IRS. So get your tax return into the IRS as fast as possible. File electronically if you don’t already to expedite the process.
- Protect your social security number (SSN). Nowadays, many organizations from healthcare to utilities may ask for your SSN. Challenge them and verify how they will use and protect the information. For every company that has your SSN, the chance of its being exposed due to a data breach goes up. Many companies will use the SSN as a unique identifier or as part of a verification process, but some are open to using a different number if asked. So ask!
- Check your credit report. Unusual activity can be an indicator of trouble. Get a copy and look for activity that you did not initiate. By law, these reports are free at least once a year. Go to the FTC site for more information or directly to com to order your free annual report.
- Report ID theft quickly. Visit IdentityTheft.gov, the federal government’s one-stop resource to help you report and recover from identity theft. You can report theft, get step-by-step advice, sample letters, and your FTC Identity Theft Affidavit. These resources will help you fix problems caused by the theft. If your SSN has been compromised, contact the IRS ID Theft Protection Specialized Unit at 800-908-4490.
- Consider getting an Identity Protection PIN (form 14039), a six-digit number assigned to eligible taxpayers to help prevent the misuse of their SSN on fraudulent federal income tax returns. However, you currently can’t opt out once you get an IP PIN. You must use the PIN to confirm your identity on all future federal tax returns.
Be wary of IRS scams
This time of year IRS scams are rampant. Sometimes they come in the form of a phone call, while others arrive via email. Beware of claims that state you owe money to the IRS and demand immediate payment. The IRS sends only mail, no calls or email.
The IRS will never:
- Call to demand immediate payment, nor will the agency call about taxes owed without first having mailed you a bill.
- Demand that you pay taxes without giving you the opportunity to question or appeal the amount they say you owe.
- Require you to use a specific payment method for your taxes, such as a prepaid debit card.
- Ask for credit or debit card numbers over the phone.
- Threaten to bring in local police or other law-enforcement groups to have you arrested for not paying.
If you receive any of these IRS imposter scams, report them to the FTC at ftc.gov/complaint and to the Treasury Inspector General for Tax Administration (TIGTA) online or at 800-366-4484.
Be prepared and informed
During tax season be aware and protect your tax return. Early efforts can save you from a long year of frustration.
More information about tax identity theft is available from the FTC and the IRS at:
Interested in more? Follow me on Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.
Stay Updated
Follow us to stay updated on all things McAfee and on top of the latest consumer and mobile security threats.
