You may be just getting around to gathering forms and receipts and filing taxes, but that doesn't mean someone else hasn't filed a fraudulent return in your name yet.
Javelin Strategy & Research notes that identity fraud pried $16 billion from 12.7 million U.S. consumers in 2014, creating an identity fraud victim every two seconds. However, the Internal Revenue Service notes that it had to stop 19 million suspicious returns worth more than $63 billion in fraudulent refunds from 2011 through October 2014.
In fiscal year 2014 alone, the IRS launched 1,063 identity theft related investigations, resulting in 748 convictions. The Treasury Inspector General for Tax Administration (TIGTA) who oversees the the IRS notes that the agency confirmed 28,076 fraudulent tax returns involving identity theft in 2014, down from 85,385 a year earlier.
However, even as the IRS cracks down, Krebs Security notes that tax fraud has drifted down to the state level. Last year, Intuit's TurboTax had to suspend state filings briefly until it could determine the cause of that fraud. Intuit notes that its customers' habit of re-using passwords at multiple sites made their tax information on TurboTax vulnerable to identity thieves who simply used the password a customer had in place on a less-secure site.
“Anyone that sends data with their Social Security Number without password protecting the data is at risk,” says Debbie Oster, a certified public accountant and director with Margolin, Winer & Evens on Long Island. “Utilizing online banking or purchasing platforms can also open up individuals to risk – even if the process of entering sensitive information is as secure as possible, the possibility of a data breach after the fact always looms.”
Oster notes that she typically discovers that tax fraud has been committed when she attempts to tries to file a client's return electronically, but has the return rejected on the grounds that it has already been filed using the client's Social Security number. While mistakes happen and either the client or the person filing the return could have entered the wrong Social Security number by mistake, it's a warning sign that advisors are taking more seriously. Meanwhile, Scott Eherenpreis, principal at Friedman LLP in New York, notes that people who receive an extension and file their taxes later are often vulnerable to fraud, as are taxpayers who don't notice an offsetting refund on taxes they owe or who received feedback from the IRS regarding wages from an employer they've never worked for.
ReKeithen Miller, a certified financial planner and portfolio manager with Scarsdale, N.Y.-based Palisades Hudson Financial Group in its Atlanta office, notes that the first step a taxpayer should take if a return comes up pre-filed is to notify the IRS -- if the IRS hasn't notified you already. You're then going to have to file both a paper return -- because you're still on the hook for your taxes -- and Form 14039, Identity Theft Affidavit to let the IRS know identity has been stolen and that the agency should give your account a closer look. Even people whose data have been stolen through a data breach or some other means should file Form 14039 as a precautionary measure. You can also contact the IRS at the Identity Protection Specialized Unit, toll-free at 1-800-908-4490, to start securing your account, and you can reach multiple state agencies at the numbers listed toward the bottom of this page.
“For taxpayers whose identities have been compromised, the IRS can issue them an identity protection PIN, which is a six-digit number assigned to eligible taxpayers that helps prevent the misuse of their Social Security number on fraudulent federal income tax returns,” Miller says. “Once issued, this number must be included on every federal tax return a taxpayer files in the future to help the IRS confirm that the actual taxpayer is filing the return.”
The IRS will typically issue a PIN by mail after a taxpayer files Form 14039 and it will send taxpayers a new PIN each year to use on their upcoming tax filings. Without the proper PIN, the IRS will not process the tax return.
“Due to rampant identity thefts in Florida, Georgia and Washington D.C., the IRS allows their residents to opt-in to the identity protection PIN program without having to file paperwork with the IRS showing their identity has been compromised,” Miller says. “This can serve as a preventative measure to tax fraud.”
Granted, there are a whole lot of other precautions you can take before you reach the stage where you require an IRS PIN. Krebs notes that before you have your identity stolen and have to report it to banks and credit agencies anyway, you always have the option of accessing a free copy of your credit report from Equifax, TransUnion and Experian each year through annualcreditreport.com or by phone at 877-322-8228. You can also opt out of unsolicited credit card or insurance offers by going to www.optoutprescreen.com, or 888-5OPT-OUT, which will remove your name, address and personal information from lists supplied by the credit bureaus.
Meanwhile, if you discover your identity's been stolen and you live in any state but Michigan, you can have put a freeze on your credit until you get the situation sorted out. Granted you may want to hold off on that option if you need access to credit for a loan or a purchase in the near future, but it's an easy way of securing your digital data and locking thieves out.
“On top of digital identity theft, tried and true, 'old school' methods are still prevalent as well,” Oster says. “For example, are you shredding all sensitive documents before you discard them?”
There are even simpler safeguards, including not carrying your Social Security card or paperwork with your Social Security number on it. If you receive Social Security payments, check your Social Security earnings statement for any fraudulent activity. Also, if you receive calls from people claiming to be the IRS, don't offer any personal information and tell them to send any request by mail. The IRS will typically only contact you initially by mail and, later, by registered mail. If you receive any such calls, notify the inspector general's office at 1-800-366-4484.
“In the last couple of weeks, my wife has received phone calls from an individual claiming to be from the IRS who said that she owed money and that he needed her Social Security number,” Eherenpreis says. “You have to ask them to send anything over the mail and never offer any information over the phone or e-mail.”
Lastly, know that if you do have to talk to the IRS about a fraudulent return, it can take four months to a year to straighten things out. If you don't have the free hours to do so yourself or just aren't used to dealing with the government, it may be best to delegate that responsibility as much as the IRS allows.
“Dealing with tax fraud takes a lot of patience, so be prepared to spend a lot of time corresponding with the IRS,” Miller says. “You also have the option of engaging your tax preparer to communicate with the IRS on your behalf, if they are qualified to do so.”