Man holding glasses

Identity theft may not be your main concern this tax season, but it definitely should be on your radar.

What is tax identity theft or tax-related identity theft?

The official IRS website states that “tax-related identity theft occurs when someone uses your stolen Social Security number to file a tax return claiming a fraudulent refund.”

Although this type of identity theft may sound like a rare occurrence, it actually affects more people than you might think. In fact, according to Fraud.org, “tax identity theft was the single biggest type of identity theft complaints to the Federal Trade Commission in 2014. Conservative estimates put the cost of this fraud to the nation’s taxpayers at $5.2 billion annually.”

Clearly, there are reasons why you should be worried about tax identity theft. We asked several identity theft, cybersecurity, and finance experts to explain what they think you need to know about tax identity theft, what you should do if you do fall victim to tax identity theft, and what you can do to reduce your risk of becoming a victim this tax season.

Arthur Rosatti, Attorney with Ashley F. Morgan Law, PC

What you should know: “It is a big problem that the IRS has been fighting a lot over the past decade. Most people find out they are a victim when they attempt to file their own return and the IRS sends a notice rejecting their return. Not only are taxpayers experiencing ID theft, many scammers are stealing the identity of their children.”

What victims should do: “If this happens to an individual, that person will have to submit additional paperwork to the IRS to prove who they are. Specifically, Form 14039 has to be submitted to the IRS. I also include the tax return that was rejected, proof of ID, and proof of residence. If the return is rejected because of a child credit issue, it is often necessary to provide proof of the child and that you are the parent/guardian responsible for the child's care.”

What you should do: “File as soon as possible, check your credit report regularly, and get a PIN from the IRS. Also, just guard your social security number as much as possible.”

Steve Weiseman, Lawyer, College Professor, Author, and Identity Theft/Scam Expert at Scamicide

What you should know: “Income tax identity theft, by which identity thieves file phony income tax returns with counterfeit W-2s using the Social Security number and name of their victims is still a major problem for the IRS and taxpayers, costing us all billions of dollars each year. Although the IRS has gotten a bit better about detecting income tax identity theft, it is still a multi-billion dollar problem each year and if it happens to you, it can create great problems and delays in getting your legitimate income tax refund. You find out that you have been a victim when you are contacted by the IRS informing you that an income tax return has already been filed using your Social Security number, and they cannot process your return and provide your refund until they have finished an investigation.

In 2015, a report of the Treasury Inspector General for Tax Administration (TIGTA) disclosed that despite IRS assurances to the contrary, it took the IRS an average of 278 days to resolve individual income tax identity theft cases and return the rightfully owed tax refund to the victimized taxpayer. In a heartening example of some good news, TIGTA now says that the IRS has lowered the time to resolve the income tax identity theft cases of individual taxpayers to 166 days, which, although to my mind, is still too long, is a significant improvement.

Recently, however, through the joint efforts of the Federal Trade Commission (FTC) and the IRS, you can now file electronically an IRS Form 14039 which is the form necessary to report if you have become a victim of income tax identity theft to the IRS. Being able to file this form now electronically should speed up the process of the IRS investigation of instances of income tax identity theft and reduce the time before you can get your income tax refund if one is due.”

What you should do: “Along with protecting the privacy of your Social Security number as much as possible, the best thing you can do to protect yourself from income tax identity theft is to file your income tax return as soon as possible in order to make sure your return is filed prior to that of an identity thief. Income tax identity theft only works if the identity thief files a tax return before you do.

In order to file a Form 14039 electronically, you should go to the FTC's www.Identitytheft.gov website where you will be asked questions necessary to automatically complete the form. Once the form is completed, you will be able to review it and, if it meets with your approval, submit the form directly to the IRS through the www.Identitytheft.gov website. You should also download and print out a copy of the form for your own records as well. You should receive a confirmation from the IRS of receipt of the form within thirty days.”

What victims should do: “If you do find yourself a victim of income tax identity theft, you should file a police report immediately and then file a paper tax return with an attached Form 14039 Identity Theft Affidavit along with a copy of the police report to the IRS to hasten the process of recovering your tax refund.”

Vincenzo Villamena, CEO of Global Expat Advisors

What you should know: “If one tries to e-file their tax return and it is not accepted due to a duplicate copy already being filed, then they are likely subject to tax identity theft. In most cases, the perpetrators file these fraudulent returns early, so they are ahead of the victim in order to get their return accepted by the IRS first and before the IRS begins to catch on to the theft. Generally speaking, the person’s refund will be deposited in a bank account or more often taken in the form of a prepaid debit card which can be used for purchases or resold on the open market.”

What victims should do: “They should contact the IRS immediately to inform them of the theft. They will have to paper file with a special pin for a number of years ago. The most important thing is to let the IRS know so the real tax return will be accepted properly and without penalty.”

What you should do: “Be careful where you upload tax documents and send documents with your Social Security number. These documents should always be stored on secure servers with 256-bit encryption. Furthermore, do not send tax documents over email unless password-protected; however it would be better if uploaded on a secure server. The IRS will never call you, so do not believe any robo-dialed phone calls.

I have seen an increased number of phone scams this year where people are asked to pay off IRS debt or confirm their Social Security number over the phone. They are threatened with large fines or jail time, but this is completely fake as the IRS will never call or email anyone; all correspondence is via snail mail. Please be sure that the IRS has an updated mailing address on file so that valid correspondence will reach you.”

Steven Hausman, President of Hausman Technology Presentations

What you should know: “One of the best things to do to determine if you have been a victim of identity theft is to check regularly your credit reports at the three major credit reporting bureaus. Since you are allowed one free report each year, you should request one report from one of these bureaus every four months. There are also certain services which state that they are continually trolling the internet for fraudulent uses of your social security number and other personal information.

There are also some telltale signs that your personal information has been compromised:

You get a copy of your tax return from the Internal Revenue Service when you had not requested it.
You have filed your annual federal tax return and find that it has been rejected because someone else had filed it previously. Similarly, you get a tax refund from a return that you have not yet filed.
You do not receive bills or mail that you have been used to receiving in the past. This could be an indication that thieves may have used your personal information to change your address.
If you should apply for credit and find that you are rejected or when you check your FICO score, and you find that it has gotten much lower. This may be because criminals are trying to open credit card accounts in your name.
You note that you are getting bills for purchases you did not make and that your credit card account(s) may have unauthorized transactions on the monthly bill.
In accounts where you have implemented two-factor authentication (which you should do), you find that you are getting alerts from the bank. This could mean that someone is attempting to access your account because they may have some of your personal information.
You may find a number of very small charges on your credit card. This could be because someone has stolen this information and is checking to make sure the card is still active before making a number of very large purchases.
You might be rejected for credit.
You might receive mail from the Internal Revenue Service because someone requested documentation online from the IRS but was unable to get it because of their security protocols. In that case, the IRS might send it to your address of record by mail. In addition, it is possible that your electronically-filed tax return is rejected. The latter circumstance might be due to the fact that a criminal has already filed a fraudulent tax return in your name in the hopes of obtaining a refund.
When you check your credit card bill at the end of the month (and you must check your bill in detail each month) some charges might show up that you did not make.
You do not receive bills that you would ordinarily expect to receive. This might mean that a thief has taken over your billing address.
If you have an employer and someone has stolen your Social Security number they may attempt to file for unemployment benefits in your name. In such a case, your current employer may notify you that this has occurred.
There may be a number of small charges on your credit card statement for a few dollars each. This may be because criminals are testing to see if the credit card number they have stolen from you is still valid and active.”

What victims should do: “There are some very specific things to do. These include the following:

File a crime report with your local police department
File a report with the Federal Trade Commission
Place a fraud alert on all your credit reports (also see where I have indicated applying a credit freeze below)
Make sure that your rigorously review your credit card statements every month for erroneous charges
Consider opening new credit card accounts and bank accounts
Make certain that you utilize strong passwords on all of your online accounts
Purchase a micro-cut shredder and use it regularly to destroy all financial records
File an identity theft affidavit (Form IRS 14039) with the Internal Revenue Service
Do not carry your Social Security card with you
Do not place any personal information on social media sites or use inaccurate information (Do you really need to list your birthday for everyone to see?)

Should you get a PIN number for your tax returns?

Absolutely yes. One of the main concerns with any cyber breach where your social security number may have been obtained is that someone can file a tax return in your stead earlier in the year than you may file. Any return that the crook has filed will be sure to be eligible for a refund (why else would they file?) which they will then cash. If, however, you have the six-digit PIN from the IRS, they would need to know that before filing. If you complete the identity theft affidavit (Form IRS 14039) for the IRS, they can supply this PIN. You can also obtain a PIN online from the IRS.”

What you should do: “. . . place a freeze on all of your credit accounts. This means that no one will be able to apply for a credit card or any sort of credit in your name without removing the freeze. I understand that some people might find this inconvenient, but the freeze can be easily removed temporarily for a short period of time if you should have the need to apply for a loan or a new credit card. A small amount of inconvenience, in my opinion, is minor when compared to resolving the consequences of identity theft and having large credit card bills or a fraudulent tax return being submitted in your name.”

Bob Harkson, CFP, Chief Financial Planner at Phase 2 Wealth Advisors

What you should know: “This occurs when a tax scammer obtains (steals) your personal information. A tax return is then filed in your name, typically claiming a large, but bogus, tax refund. That tax refund is then routed to an address that is not yours. The fraudsters will receive the money whether you were actually owed a refund. A person typically finds out they were a victim of this scam when they go to file a return and it is rejected by the IRS because ‘you have already filed a return’.

The IRS doesn't initiate contact with taxpayers by email, text messages, or social media channels to request personal or financial information. You will be initially contacted by mail. Another scam is to receive a call with a caller ID that says IRS, don’t be fooled.”

What you should do: “File early — Less time for scammers to get to you, be diligent with passwords — change them frequently and make them complex, (and) guard your personal information. Shred documents with personal information. Save it to secure online storage or be sure your computer is encrypted.”

Tax Return

Jamie Cambell, Cybersecurity Expert and Founder of GoBestVPN

What you should know: “You should look for tax-related issues that come up when you're not expecting it. (For instance) you have issues when filing a tax return because more than one tax return was filed using your identity (or) you have pending actions or receive notices for a tax return you didn't file.

What victims should do:

Immediately contact the authorities.
File a report with the FTC; they have a dedicated website for this because it happens so frequently: https://www.identitytheft.gov/Assistant
Contact your financial institutions (banks) and find out if there are any cards or accounts opened without your permission, and close them immediately. Change all your credentials and make sure to add additional security layers for logging in and opening new cards and accounts.

What you should do:

Keep your devices clean. Make sure you don't have viruses installed on your devices and don't visit random websites. Don't open emails from strangers.
Have a secure password. There are plenty of articles online about generating a secure password and securely managing them.
Have 2FA for logging into important services like your financial products.
Have additional security layers for opening new cards or accounts. Banks allow this; you can ask them to make sure you say a special phrase or a string of numbers before taking any actions on your account.

Justin Lavelle, Chief Communications Director of BeenVerified.com

What you should know: “Tax identity theft was the number one type of identity theft according to the Federal Trade Commission in past years.

There is no foolproof way of avoiding tax identity fraud. Since Social Security numbers and other personal information are so widely available on cyber black markets, chances are that scammers already have the information they need to commit tax identity fraud against you. It’s your job to stay on top of your financial information to catch anything that looks suspicious.”

What you should do: “File your taxes as early as possible during tax season. Scammers depend on the fact that many taxpayers wait until late in tax-filing season to file. Filing early reduces the risk that a tax identity thief will be able to use your personal information to file fraudulently ahead of you. Scammers will also try and file your tax return as early as possible.

Thieves don’t need your credit card number or bank account information to steal your identity. A thief just needs one piece of information about you and they can easily gain access to the rest. It’s a common mistake thinking that a thief needs your actual credit card or credit card number to create an identity theft situation, but that’s no longer the case. Make sure to secure birth certificates, Social Security cards, credit cards that aren’t in use and passports in a safe deposit box or in a safe hidden at home.

Pay extra attention to snail mail. Snail mail identity theft is still very much a thing. Watch for your monthly billing statements from creditors and banks. Take note and check on statements that have not arrived, as it could be a sign your mail has been intercepted. If you order new checks, choose to pick them up at the bank vs. having them mailed. Also, never put mail in your private post box to be picked up by the mailman. Always put mail in a U.S. Postal Service mailbox.

Carefully review any financial statements monthly. Always watch your statements for suspicious activity and charges that appear that aren’t known. This is one of the best ways to catch fraud before it goes very far.”

How to know if you are a victim:

You do not receive one or more of your monthly bank and financial statements in the mail.
You find withdrawals from your bank account that you didn’t make.
You find unfamiliar accounts or charges on your credit report.
Your medical providers bill you for services you didn’t use or reject claims because you’ve maxed out your benefits.
You’ve been notified your information was compromised by a data breach at a company where you do business or have an account.
You’ve received notice from the IRS that more than one tax return was filed in your name.

What victims should do:

Contact the IRS asap. Alert them to what’s going on and how you found out.
Place a credit freeze, fraud alert, and/or credit lock on your credit file.
Report the identity theft to the FTC and they’ll provide you with a step-by-step recovery plan.
Get copies of your credit report from each of the credit bureaus.
File a police report.

Additional ways you can prevent tax identity theft:

Limit the amount of credit cards and personal information (such as passport, social security card, etc.) you carry with you. Take only the cards and information you need.
Secure your personal records at home in a lockbox or safe. Keep them hidden in a safe place in your home.
Safeguard your personal information online. Don't put personal information such as your birth date on a personal computer profile or social media website. Never provide personal or financial information unless a website site is secure (look for the security padlock in the web browser).
Use passwords and change them regularly. Use a combination of letters, numbers, and symbols. Create different passwords for different social media sites, shopping sites, email, etc.
Protect your home computer by using a firewall and secure browser, always maintaining current virus protection and avoiding an automatic log-in process.
Always sign the back of your credit cards with ‘Ask for photo ID.’ This makes people check your ID before a purchase is made.
Use a credit card, not a debit card, when shopping online. Only shop with companies you trust or have done business with in the past.
Keep your SSN private.
Never give out personal information on the phone to someone claiming to be from the IRS. The IRS will only contact through the mail.

Jon Murphy, Cybersecurity Vice President for alliantgroup & Dhaval Jadav, CEO of alliantgroup

What you should know: “Tax-related identity theft occurs when someone uses your stolen Social Security number to file a tax return claiming a fraudulent refund. You may be unaware that this has happened until you efile your return and discover that a return already has been filed using your SSN. Here’s how to know if you’ve been a victim of tax identity theft:

More than one tax return was filed and your return was rejected.
You owe additional tax, have a balance due, refund offset, or have had collection actions taken against them.
IRS records indicate you received more wages than you actually earned.
If someone uses your SSN to get a job, the employer may report that person’s income to the IRS using your SSN. IRS records will show you failed to report all your income. The agency will send you a notice or letter saying you have wages you didn’t report.
State or federal benefits were reduced or canceled because the agency involved received information reporting an income change.
An unexpected letter arrives from the IRS or Missouri Department of Revenue which does not appear to apply to you.”

What victims should do:

File a report with the local police.
File a complaint with the Federal Trade Commission atwww.consumer.ftc.gov or the FTC Identity Theft hotline at 877-438-4338 or TTY 866-653-4261.
Contact one of the three major credit bureaus to place a “fraud alert’ on your account:
- Equifax – www.equifax.com, 800-525-6285
- Experian – www.experian.com, 888-397-3742
- TransUnion – www.transunion.com, 800-680-7289
Close any accounts that have been tampered with or opened fraudulently.

If your SSN has been compromised and you know or suspect you may be a victim of tax-related identity theft, take these additional steps:

Respond immediately to any IRS notice; call the number provided.
Complete IRS Form 14039, Identity Theft Affidavit. Use a fillable form at IRS.gov, print, then mail or fax according to instructions.
Continue to pay your taxes and file your tax return, even if you must do so by paper.
If you previously contacted the IRS and did not have a resolution, contact the Identity Protection Specialized Unit at 800-908-4490. The IRS has teams available to assist.

What you should do:

File your tax return as early as possible.
Protect your taxpayer PIN.
Use unique, complex passwords or a password manager program religiously.
Use multi-factor authorization everywhere you can (bank, email, social media, etc.).
Beware of phishing by phone, SMS/text, and email.
Use a shredder.
Collect your mail regularly and use a lock on the box if you can.
Don’t carry your Social Security card or any documents that include your Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN).
Don’t give a business your SSN or ITIN just because they ask. Give it only when required.
Protect your financial information.
Check your credit report every 12 months.
Review your Social Security Administration earnings statement annually.
Secure personal information in your home.
Protect your personal computers by using firewalls and anti-spam/virus software, updating security patches.
Don’t give personal information over the phone, through the mail or on the Internet unless you have initiated the contact or you are sure you know who you are dealing with.

The bottom line

As this tax season approaches, it’s important that you keep tax identity theft in mind. As the experts have explained, there are plenty of ways to lessen your risk of becoming a tax identity theft victim. Simply increasing your knowledge of tax identity theft can help. If you can follow the advice in this article, do your own research, and make sure you stay up-to-date on the latest identity theft trends, you will increase your chances of successfully avoiding this type of identity theft.

Write a review for Experian IdentityWorks℠

What is your overall rating of Experian IdentityWorks℠?

Tell us about your experience with Experian IdentityWorks℠?

Are you or have you ever been a paying customer of Experian IdentityWorks℠?