Thieves always find new ways to steal money. In the digital age, opportunities for theft are abundant — and relatively easy to execute. This time of year, one type of theft to be especially vigilant in guarding against is “tax identity” theft.
Instead of stealing a tax refund check from your mailbox, a thief can now file a fraudulent return in your name and request the IRS to send the “refund” to an address or an account that isn’t yours. You won’t know you’ve been scammed until you try to file and your real return is rejected because the IRS thinks it’s a duplicate.
Fortunately, the IRS catches most fraudulent returns before they are fully processed, but some aren’t discovered until refunds have been paid out to thieves. That’s bad news for victims. According to a 2023 report to Congress by the National Taxpayer Advocate, “victims of tax-related identity theft are waiting an average of nearly 19 months for the IRS to process their returns and send their refunds” (see table).
How thieves get your information
To file a fraudulent tax return, a thief must first gain access to information that can be used to impersonate the actual taxpayer, including the taxpayer’s Social Security number. Such information can be gleaned in several ways.
Thieves may use database hacking or online “phishing” scams to acquire a taxpayer’s identity details. But low-tech approaches are simpler and often more fruitful. For example, medical forms typically request a patient’s Social Security number, providing easy access for a “dirty” employee at a doctor’s office, clinic, or hospital. (Kiplinger.com lists medical offices and hospitals among the riskiest places to divulge a Social Security number.)
Other low-tech approaches include stealing documents from a person’s mailbox or trash. Another is “pretexting,” in which a thief obtains personal information via phone by impersonating a bank employee or government official.
Here are several “best practices” for protecting your personal information.
Store your Social Security card in a secure place. Don’t carry it in your purse or wallet.
Do not reveal your complete Social Security number unless legally required. Ask medical providers and others who may ask for your Social Security number to use an alternate identifier.
Never give your Social Security number or any other account details to an unsolicited caller. Although the person on the other end of the line may claim to be an IRS agent or bank official, that probably isn’t true. (The IRS uses postal mail to contact taxpayers.)
Shred documents containing personal information. Tossing unshredded tax forms, bank statements, or medical information in the trash makes an inviting target for an ID thief.
Use strong passwords and multi-factor authentication for websites. This is especially crucial for sites that use your Social Security number, such as tax preparation providers.
Watch out for phishing scams. A suspicious email (or text) asking you to click a link or download an attachment is likely an attempt to collect information about you.
Monitor accounts. Watch your bank and credit card accounts for any suspicious activity.
An ounce of prevention…
One way to reduce the likelihood of a fraudulent tax return being filed in your name is to file as early as possible in the tax season. That increases the likelihood that your return will reach the IRS before any fraudulent version may show up.
Because early filing may not always be possible, the IRS offers another way to protect yourself against fraudsters. Upon request, the tax agency will provide a unique six-digit code, called an IP PIN, to include with your tax return. (A husband and wife can each request an IP PIN if desired, even if filing jointly.)
The IP PIN is similar to an authentication code used to provide security for an online bank or brokerage account. “The IP PIN prevents someone else from filing a tax return using your Social Security number,” says the IRS website.
An IP PIN lasts only one year, so you must retrieve a new one each tax year via your online IRS account — unless you have already been the victim of tax-related ID fraud. In that case, the IRS will automatically generate a code and send it to you by postal mail.
What to do if you’ve been a victim
The IRS recommends these steps if you suspect or know you’ve been a victim of tax-related ID theft.
If your e-filed return is rejected because of a duplicate filing, complete IRS Form 14039 (PDF). Attach that form (Identity Theft Affidavit) to a completed paper return and mail it to the IRS.
If you get an ID theft alert from the IRS (via postal mail), respond immediately. Many victims fail to respond, thus delaying the resolution of their cases.
Go to IdentityTheft.gov. That site offers details on protecting your financial accounts following an ID theft.
For more help, visit the IRS web page titled “IRS Identity Theft Victim Assistance: How It Works.”
