Identity Theft Blog and Resources

Guest Post by Kayla Matthews The Internal Revenue Service (IRS) is the group responsible for investigating tax fraud instances allegedly committed by U.S. businesses or the country's citizens. Here's what you should know about that process: How do you report tax fraud to the IRS? The IRS maintains a dedicated page that walks people through how to report suspected tax fraud. The basic process is to mail the appropriate form, which prompts the IRS to look into the matter. When you believe an individual or business is not following tax laws, the associated document is typically called 3949-A Information Referral. You can print the form off of the tax fraud reporting section of the IRS website or call a recorded hotline number listed there to request that a copy of the form be mailed to you. Bear in mind that you cannot make a tax fraud report through that number; the IRS only accepts written documents.Instead of sending that form, you can send a letter that includes as much information as possible to help the organization assess the case. Include the following things: The name of the individual or business in question The respective Social Security Number or Employer Identification Number A brief description of the alleged violations committed, including how you became aware of them The estimated dollar amount of the applicable income The years during which the violations occurred Your name, address, and phone number  The IRS allows submitting anonymous reports. However, it says that it's more helpful to them if you provide your identifying information. The IRS keeps the details confidential. How does the IRS examine tax fraud reports? Based on the information contained in a report about alleged tax fraud, the IRS has internal teams that look into things further to determine the most appropriate actions to take. More specifically, the IRS has a division called Criminal Investigation (CI) that pursues cases of possible tax fraud and other financial-related crimes. The IRS started screening for fraudulent tax returns in 1977. When the IRS has evidence suggesting fraudulent tax returns, the CI department of the IRS has eight Scheme Development Centers (SDCs) tasked with screening for tax refund fraud. The staff at the SDCs also work with all other IRS departments during their checks. When people at the SDCs find problematic information, they refer cases to CI field offices and the investigators there. When the IRS contacts taxpayers for any reason, they always do so through the mail and never by phone. A case of what appears to be tax fraud may not always come about because of intentional wrongdoing. For example, an accountant could make an honest mistake when preparing someone's tax returns, triggering an IRS audit. For tax professionals, it is beneficial to stay abreast of tax law changes and participate in industry certification programs to avoid mistakes that cause fraud. In addition, it’s also helpful for taxpayers to know the red flags associated with illegal tax activity to avoid audits or serious cases of fraud. What happens when the IRS cracks down on tax fraud? The IRS has between 3–6 years to investigate tax fraud depending on the amount of underpaid tax. According to the CI's 2018 annual report, it identified $9.69 billion worth of tax fraud, issued 1,399 warrants and had a 91.7 percent conviction rate. Moreover, it initiated 1,714 tax crime investigations and recommended 1,050 prosecutions. On a related note, 1,052 parties received tax crime-related sentences. However, many instances of tax fraud result in civil penalties rather than criminal prosecutions. Data collected in 2018 indicates that the IRS assessed nearly $29.3 billion in civil penalties. Almost $12 billion of that amount originated from individual tax returns or those related to estates and trusts. Is tax fraud a big problem? Tax fraud cases often capture the headlines, but some people understandably wonder whether the overall problem of tax fraud is truly substantial or just overblown. Firstly, keep in mind that the IRS tracks something called the tax gap — the difference between taxes owed and taxes paid. The IRS recently released its tax gap estimates and said that taxes get paid voluntarily and on time in 83.6 percent of cases, which is virtually unchanged from its last tax gap estimate. The most current data is not as up to date as you may think, though. It covers 2011–2013, and the one before that dealt with 2008–2010. And, the percentage of taxes paid rose to 85.8 percent during both periods after the IRS proceeded with enforcements. However, the same report said that the tax gap grew by 11 percent compared to the last estimate, totaling $381 billion. Additionally, a watchdog insists that the IRS is not efficiently combatting fraud associated with corporate mergers and acquisitions. A report released in September 2019 says the IRS spent 27,874 workdays looking into such matters from fiscal years 2015–2018 and did not make changes to the associated filings after completing their investigations. Another study showed that the Criminal Investigation Unit pursued near 25 percent fewer cases than in 2010. Analysts cited budget cuts as a primary reason for the reduced enforcement. Other variations exist that determine the prevalence of tax fraud. For example, evasion rates differ according to the type of taxes paid and the associated income bracket of a taxpayer. The information you need Whether you file taxes, prepare them or are merely interested in tax fraud, the information here should prove useful. You also now know what to do if you need to report possible fraudulent incidents. Kayla Matthews, a tech and security journalist, has written articles for sites including WIRED, Information Age, Security Boulevard, and the National Cyber Security Alliance. To see more of her work, follow her on Twitter @KaylaEMatthews or check out her tech blog, Productivity Bytes.

Identity theft may not be your main concern this tax season, but it definitely should be on your radar. What is tax identity theft or tax-related identity theft? The official IRS website states that “tax-related identity theft occurs when someone uses your stolen Social Security number to file a tax return claiming a fraudulent refund.” Although this type of identity theft may sound like a rare occurrence, it actually affects more people than you might think. In fact, according to Fraud.org, “tax identity theft was the single biggest type of identity theft complaints to the Federal Trade Commission in 2014. Conservative estimates put the cost of this fraud to the nation’s taxpayers at $5.2 billion annually.”Clearly, there are reasons why you should be worried about tax identity theft. We asked several identity theft, cybersecurity, and finance experts to explain what they think you need to know about tax identity theft, what you should do if you do fall victim to tax identity theft, and what you can do to reduce your risk of becoming a victim this tax season. Arthur Rosatti, Attorney with Ashley F. Morgan Law, PC What you should know: “It is a big problem that the IRS has been fighting a lot over the past decade. Most people find out they are a victim when they attempt to file their own return and the IRS sends a notice rejecting their return. Not only are taxpayers experiencing ID theft, many scammers are stealing the identity of their children.” What victims should do: “If this happens to an individual, that person will have to submit additional paperwork to the IRS to prove who they are. Specifically, Form 14039 has to be submitted to the IRS. I also include the tax return that was rejected, proof of ID, and proof of residence. If the return is rejected because of a child credit issue, it is often necessary to provide proof of the child and that you are the parent/guardian responsible for the child's care.”What you should do: “File as soon as possible, check your credit report regularly, and get a PIN from the IRS. Also, just guard your social security number as much as possible.” Steve Weiseman, Lawyer, College Professor, Author, and Identity Theft/Scam Expert at Scamicide What you should know: “Income tax identity theft, by which identity thieves file phony income tax returns with counterfeit W-2s using the Social Security number and name of their victims is still a major problem for the IRS and taxpayers, costing us all billions of dollars each year. Although the IRS has gotten a bit better about detecting income tax identity theft, it is still a multi-billion dollar problem each year and if it happens to you, it can create great problems and delays in getting your legitimate income tax refund. You find out that you have been a victim when you are contacted by the IRS informing you that an income tax return has already been filed using your Social Security number, and they cannot process your return and provide your refund until they have finished an investigation.In 2015, a report of the Treasury Inspector General for Tax Administration (TIGTA) disclosed that despite IRS assurances to the contrary, it took the IRS an average of 278 days to resolve individual income tax identity theft cases and return the rightfully owed tax refund to the victimized taxpayer. In a heartening example of some good news, TIGTA now says that the IRS has lowered the time to resolve the income tax identity theft cases of individual taxpayers to 166 days, which, although to my mind, is still too long, is a significant improvement. Recently, however, through the joint efforts of the Federal Trade Commission (FTC) and the IRS, you can now file electronically an IRS Form 14039 which is the form necessary to report if you have become a victim of income tax identity theft to the IRS. Being able to file this form now electronically should speed up the process of the IRS investigation of instances of income tax identity theft and reduce the time before you can get your income tax refund if one is due.”What you should do: “Along with protecting the privacy of your Social Security number as much as possible, the best thing you can do to protect yourself from income tax identity theft is to file your income tax return as soon as possible in order to make sure your return is filed prior to that of an identity thief. Income tax identity theft only works if the identity thief files a tax return before you do.In order to file a Form 14039 electronically, you should go to the FTC's www.Identitytheft.gov website where you will be asked questions necessary to automatically complete the form. Once the form is completed, you will be able to review it and, if it meets with your approval, submit the form directly to the IRS through the www.Identitytheft.gov website. You should also download and print out a copy of the form for your own records as well. You should receive a confirmation from the IRS of receipt of the form within thirty days.”What victims should do: “If you do find yourself a victim of income tax identity theft, you should file a police report immediately and then file a paper tax return with an attached Form 14039 Identity Theft Affidavit along with a copy of the police report to the IRS to hasten the process of recovering your tax refund.” Vincenzo Villamena, CEO of Global Expat Advisors What you should know: “If one tries to e-file their tax return and it is not accepted due to a duplicate copy already being filed, then they are likely subject to tax identity theft. In most cases, the perpetrators file these fraudulent returns early, so they are ahead of the victim in order to get their return accepted by the IRS first and before the IRS begins to catch on to the theft. Generally speaking, the person’s refund will be deposited in a bank account or more often taken in the form of a prepaid debit card which can be used for purchases or resold on the open market.”What victims should do: “They should contact the IRS immediately to inform them of the theft. They will have to paper file with a special pin for a number of years ago. The most important thing is to let the IRS know so the real tax return will be accepted properly and without penalty.”What you should do: “Be careful where you upload tax documents and send documents with your Social Security number. These documents should always be stored on secure servers with 256-bit encryption. Furthermore, do not send tax documents over email unless password-protected; however it would be better if uploaded on a secure server. The IRS will never call you, so do not believe any robo-dialed phone calls. I have seen an increased number of phone scams this year where people are asked to pay off IRS debt or confirm their Social Security number over the phone. They are threatened with large fines or jail time, but this is completely fake as the IRS will never call or email anyone; all correspondence is via snail mail. Please be sure that the IRS has an updated mailing address on file so that valid correspondence will reach you.” Steven Hausman, President of Hausman Technology Presentations What you should know: “One of the best things to do to determine if you have been a victim of identity theft is to check regularly your credit reports at the three major credit reporting bureaus. Since you are allowed one free report each year, you should request one report from one of these bureaus every four months. There are also certain services which state that they are continually trolling the internet for fraudulent uses of your social security number and other personal information.There are also some telltale signs that your personal information has been compromised: You get a copy of your tax return from the Internal Revenue Service when you had not requested it. You have filed your annual federal tax return and find that it has been rejected because someone else had filed it previously. Similarly, you get a tax refund from a return that you have not yet filed. You do not receive bills or mail that you have been used to receiving in the past. This could be an indication that thieves may have used your personal information to change your address. If you should apply for credit and find that you are rejected or when you check your FICO score, and you find that it has gotten much lower. This may be because criminals are trying to open credit card accounts in your name. You note that you are getting bills for purchases you did not make and that your credit card account(s) may have unauthorized transactions on the monthly bill. In accounts where you have implemented two-factor authentication (which you should do), you find that you are getting alerts from the bank. This could mean that someone is attempting to access your account because they may have some of your personal information. You may find a number of very small charges on your credit card. This could be because someone has stolen this information and is checking to make sure the card is still active before making a number of very large purchases. You might be rejected for credit. You might receive mail from the Internal Revenue Service because someone requested documentation online from the IRS but was unable to get it because of their security protocols. In that case, the IRS might send it to your address of record by mail. In addition, it is possible that your electronically-filed tax return is rejected. The latter circumstance might be due to the fact that a criminal has already filed a fraudulent tax return in your name in the hopes of obtaining a refund. When you check your credit card bill at the end of the month (and you must check your bill in detail each month) some charges might show up that you did not make. You do not receive bills that you would ordinarily expect to receive. This might mean that a thief has taken over your billing address. If you have an employer and someone has stolen your Social Security number they may attempt to file for unemployment benefits in your name. In such a case, your current employer may notify you that this has occurred. There may be a number of small charges on your credit card statement for a few dollars each. This may be because criminals are testing to see if the credit card number they have stolen from you is still valid and active.” What victims should do: “There are some very specific things to do. These include the following: File a crime report with your local police department File a report with the Federal Trade Commission Place a fraud alert on all your credit reports (also see where I have indicated applying a credit freeze below) Make sure that your rigorously review your credit card statements every month for erroneous charges Consider opening new credit card accounts and bank accounts Make certain that you utilize strong passwords on all of your online accounts Purchase a micro-cut shredder and use it regularly to destroy all financial records File an identity theft affidavit (Form IRS 14039) with the Internal Revenue Service Do not carry your Social Security card with you Do not place any personal information on social media sites or use inaccurate information (Do you really need to list your birthday for everyone to see?) Should you get a PIN number for your tax returns?Absolutely yes. One of the main concerns with any cyber breach where your social security number may have been obtained is that someone can file a tax return in your stead earlier in the year than you may file. Any return that the crook has filed will be sure to be eligible for a refund (why else would they file?) which they will then cash. If, however, you have the six-digit PIN from the IRS, they would need to know that before filing. If you complete the identity theft affidavit (Form IRS 14039) for the IRS, they can supply this PIN. You can also obtain a PIN online from the IRS.” What you should do: “. . . place a freeze on all of your credit accounts. This means that no one will be able to apply for a credit card or any sort of credit in your name without removing the freeze. I understand that some people might find this inconvenient, but the freeze can be easily removed temporarily for a short period of time if you should have the need to apply for a loan or a new credit card. A small amount of inconvenience, in my opinion, is minor when compared to resolving the consequences of identity theft and having large credit card bills or a fraudulent tax return being submitted in your name.” Bob Harkson, CFP, Chief Financial Planner at Phase 2 Wealth Advisors What you should know: “This occurs when a tax scammer obtains (steals) your personal information. A tax return is then filed in your name, typically claiming a large, but bogus, tax refund. That tax refund is then routed to an address that is not yours. The fraudsters will receive the money whether you were actually owed a refund. A person typically finds out they were a victim of this scam when they go to file a return and it is rejected by the IRS because ‘you have already filed a return’.The IRS doesn't initiate contact with taxpayers by email, text messages, or social media channels to request personal or financial information. You will be initially contacted by mail. Another scam is to receive a call with a caller ID that says IRS, don’t be fooled.”What you should do: “File early — Less time for scammers to get to you, be diligent with passwords — change them frequently and make them complex, (and) guard your personal information. Shred documents with personal information. Save it to secure online storage or be sure your computer is encrypted.” Jamie Cambell, Cybersecurity Expert and Founder of GoBestVPN What you should know: “You should look for tax-related issues that come up when you're not expecting it. (For instance) you have issues when filing a tax return because more than one tax return was filed using your identity (or) you have pending actions or receive notices for a tax return you didn't file.What victims should do: Immediately contact the authorities. File a report with the FTC; they have a dedicated website for this because it happens so frequently: https://www.identitytheft.gov/Assistant Contact your financial institutions (banks) and find out if there are any cards or accounts opened without your permission, and close them immediately. Change all your credentials and make sure to add additional security layers for logging in and opening new cards and accounts. What you should do: Keep your devices clean. Make sure you don't have viruses installed on your devices and don't visit random websites. Don't open emails from strangers. Have a secure password. There are plenty of articles online about generating a secure password and securely managing them. Have 2FA for logging into important services like your financial products. Have additional security layers for opening new cards or accounts. Banks allow this; you can ask them to make sure you say a special phrase or a string of numbers before taking any actions on your account. Justin Lavelle, Chief Communications Director of BeenVerified.com What you should know: “Tax identity theft was the number one type of identity theft according to the Federal Trade Commission in past years.There is no foolproof way of avoiding tax identity fraud. Since Social Security numbers and other personal information are so widely available on cyber black markets, chances are that scammers already have the information they need to commit tax identity fraud against you. It’s your job to stay on top of your financial information to catch anything that looks suspicious.”What you should do: “File your taxes as early as possible during tax season. Scammers depend on the fact that many taxpayers wait until late in tax-filing season to file. Filing early reduces the risk that a tax identity thief will be able to use your personal information to file fraudulently ahead of you. Scammers will also try and file your tax return as early as possible.Thieves don’t need your credit card number or bank account information to steal your identity. A thief just needs one piece of information about you and they can easily gain access to the rest. It’s a common mistake thinking that a thief needs your actual credit card or credit card number to create an identity theft situation, but that’s no longer the case. Make sure to secure birth certificates, Social Security cards, credit cards that aren’t in use and passports in a safe deposit box or in a safe hidden at home.Pay extra attention to snail mail. Snail mail identity theft is still very much a thing. Watch for your monthly billing statements from creditors and banks. Take note and check on statements that have not arrived, as it could be a sign your mail has been intercepted. If you order new checks, choose to pick them up at the bank vs. having them mailed. Also, never put mail in your private post box to be picked up by the mailman. Always put mail in a U.S. Postal Service mailbox.Carefully review any financial statements monthly. Always watch your statements for suspicious activity and charges that appear that aren’t known. This is one of the best ways to catch fraud before it goes very far.”How to know if you are a victim: You do not receive one or more of your monthly bank and financial statements in the mail. You find withdrawals from your bank account that you didn’t make. You find unfamiliar accounts or charges on your credit report. Your medical providers bill you for services you didn’t use or reject claims because you’ve maxed out your benefits. You’ve been notified your information was compromised by a data breach at a company where you do business or have an account. You’ve received notice from the IRS that more than one tax return was filed in your name. What victims should do: Contact the IRS asap. Alert them to what’s going on and how you found out. Place a credit freeze, fraud alert, and/or credit lock on your credit file. Report the identity theft to the FTC and they’ll provide you with a step-by-step recovery plan. Get copies of your credit report from each of the credit bureaus. File a police report. Additional ways you can prevent tax identity theft: Limit the amount of credit cards and personal information (such as passport, social security card, etc.) you carry with you. Take only the cards and information you need. Secure your personal records at home in a lockbox or safe. Keep them hidden in a safe place in your home. Safeguard your personal information online. Don't put personal information such as your birth date on a personal computer profile or social media website. Never provide personal or financial information unless a website site is secure (look for the security padlock in the web browser). Use passwords and change them regularly. Use a combination of letters, numbers, and symbols. Create different passwords for different social media sites, shopping sites, email, etc. Protect your home computer by using a firewall and secure browser, always maintaining current virus protection and avoiding an automatic log-in process. Always sign the back of your credit cards with ‘Ask for photo ID.’ This makes people check your ID before a purchase is made. Use a credit card, not a debit card, when shopping online. Only shop with companies you trust or have done business with in the past. Keep your SSN private. Never give out personal information on the phone to someone claiming to be from the IRS. The IRS will only contact through the mail. Jon Murphy, Cybersecurity Vice President for alliantgroup & Dhaval Jadav, CEO of alliantgroup What you should know: “Tax-related identity theft occurs when someone uses your stolen Social Security number to file a tax return claiming a fraudulent refund. You may be unaware that this has happened until you efile your return and discover that a return already has been filed using your SSN. Here’s how to know if you’ve been a victim of tax identity theft: More than one tax return was filed and your return was rejected. You owe additional tax, have a balance due, refund offset, or have had collection actions taken against them. IRS records indicate you received more wages than you actually earned. If someone uses your SSN to get a job, the employer may report that person’s income to the IRS using your SSN. IRS records will show you failed to report all your income. The agency will send you a notice or letter saying you have wages you didn’t report. State or federal benefits were reduced or canceled because the agency involved received information reporting an income change. An unexpected letter arrives from the IRS or Missouri Department of Revenue which does not appear to apply to you.” What victims should do: File a report with the local police. File a complaint with the Federal Trade Commission atwww.consumer.ftc.gov or the FTC Identity Theft hotline at 877-438-4338 or TTY 866-653-4261. Contact one of the three major credit bureaus to place a “fraud alert’ on your account: Equifax – www.equifax.com, 800-525-6285 Experian – www.experian.com, 888-397-3742 TransUnion – www.transunion.com, 800-680-7289 Close any accounts that have been tampered with or opened fraudulently. If your SSN has been compromised and you know or suspect you may be a victim of tax-related identity theft, take these additional steps: Respond immediately to any IRS notice; call the number provided. Complete IRS Form 14039, Identity Theft Affidavit. Use a fillable form at IRS.gov, print, then mail or fax according to instructions. Continue to pay your taxes and file your tax return, even if you must do so by paper. If you previously contacted the IRS and did not have a resolution, contact the Identity Protection Specialized Unit at 800-908-4490. The IRS has teams available to assist. What you should do: File your tax return as early as possible. Protect your taxpayer PIN. Use unique, complex passwords or a password manager program religiously. Use multi-factor authorization everywhere you can (bank, email, social media, etc.). Beware of phishing by phone, SMS/text, and email. Use a shredder. Collect your mail regularly and use a lock on the box if you can. Don’t carry your Social Security card or any documents that include your Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN). Don’t give a business your SSN or ITIN just because they ask. Give it only when required. Protect your financial information. Check your credit report every 12 months. Review your Social Security Administration earnings statement annually. Secure personal information in your home. Protect your personal computers by using firewalls and anti-spam/virus software, updating security patches. Don’t give personal information over the phone, through the mail or on the Internet unless you have initiated the contact or you are sure you know who you are dealing with. The bottom line As this tax season approaches, it’s important that you keep tax identity theft in mind. As the experts have explained, there are plenty of ways to lessen your risk of becoming a tax identity theft victim. Simply increasing your knowledge of tax identity theft can help. If you can follow the advice in this article, do your own research, and make sure you stay up-to-date on the latest identity theft trends, you will increase your chances of successfully avoiding this type of identity theft.

Do you work for a corporation, especially in the U.S.? You may be at risk for tax identity theft.  ADP is a payroll provider. Hackers were able to acquire tax information of employees of U.S. Bank from ADP. Now, this doesn't mean that ADP was directly hacked into. Instead, what happened, it seems, their authentication system was flawed and ADP failed to implement a protection strategy for the personal data to keep it safe from prying eyes. The crooks registered ADP accounts by using the stolen data of the bank employees. These accounts allowed the crooks to get additional W-2 information-enough to commit tax return fraud. In other words, looks like a W-2 gateway was created to file fraudulent tax returns. If it happened to U.S. Bank and ADP, it can happen many other places as well.  The hackers also used a unique company issued URL. This URL is needed to register an ADP account. It is not known at this point in time if the U.S. Bank URL required credentials to gain access to or not, but since this data breach, U.S. Bank has withdrawn plans to further post the URL online. U.S. Bank has also removed their publicly accessible W-2 form from cyberspace. Despite the data breach, there were only minimal effects to employees and customers of ADP and U.S. Bank. But the minimal adverse outcome is no reason to let your guard down. Next time, the institutions may not be so lucky. Solution: Fill out the IRS Identity Theft Affidavit ASAP. Here: https://www.irs.gov/pub/irs-pdf/f14039.pdf

Tax identity theft, like many other forms of identity theft, is down right terrifying. Each tax season provides an opportunity for tax identity theft criminals to do their dirty work. Once these thieves get their hands on your social security number, the odds of you having a normal tax season are not in your favor. Here are the 10 stages of being a tax identity theft victim: At the beginning of the tax season, you'll likely feel invincible. Little do you know, you just entered into a fight between you and tax identity thieves. You get a notice from the IRS telling you that there has been more than one tax return filed under your name and social security number. 4. You do research on how to report the tax identity theft and you immediately fill out the official IRS Form 14039 which you mail back to the IRS. 5. Now that you've done your part, it's time to wait (a typical IRS tax identity theft case can take up to 120 days to solve). 6. The IRS takes action and hopefully things work out for the best (it can depend on your situation). 7. After your struggle this tax season, you recover and learn from your mistakes 8. You're in good shape for next tax season because you researched and did all you could to prevent tax identity theft. 9. You teach your family, friends, and everyone you know about the dangers of tax identity theft to help keep them safe 10. You never forget your experience and strive to do what you can to avoid becoming a victim of any other form of identity theft If you want to know more about what to look out for and how to report and prevent tax identity theft, visit the official IRS website. To prevent becoming a victim of other forms of identity theft, you might want to look into hiring a professional identity theft protection service. The best identity theft protection companies offer around-the-clock monitoring and immediate notifications if there is any potential for fraudulent activity. They will also help you come up with a recovery plan if you do become a victim of identity theft under their watch.