The IRS, state authorities and the tax preparation industry have joined together to combat identity thieves rushing to file their bogus state and federal returns in your name while you’re still gathering your paperwork.
The unprecedented public-private partnership, known as the Security Summit Initiative, is aimed at slowing the flood of phony tax returns filed each year by imposters armed with stolen Social Security numbers and counterfeit paperwork that can allow them to claim big refunds before the real taxpayers – whose identities they’ve assumed – can file their legitimate returns.
People don’t know they’ve been victimized until they file their return and it’s rejected – because the IRS computers only accept one filing per Social Security number. Dealing with all the paperwork involved to prove you were victimized can slow down your return by months.
Identity thieves have been quite successful at fooling the IRS and state taxing authorities in recent years. The IRS reported that in 2013, it paid out $5.8 billion in fraudulent refunds to identity thieves.
Preventing this fraud is now a top priority at the IRS because the phony tax returns are pouring in. In the first 11 months of last year, the agency stopped payment on 1.4 million returns that were filed by identity thieves attempting to claim refunds of $8 billion.
New safeguards put in place as a result of the security summit in March 2015 include industry-wide standards for passwords, account validation and information sharing to help spot and stop fraud.
“Because of these new protections, taxpayers may notice some minor – but important – changes when they file their returns,” IRS Commissioner John Koskinen said in a phone briefing with reporters.
For example, for people using tax preparation software, there will be new sign-in requirements for accessing their accounts.
“Many other new safeguards we’ve put in place will be invisible to taxpayers. But they are all invaluable to us, because they will help us do a better job of protecting everyone at tax time – both at the federal and state levels as well as those using tax software,” Koskinen said.
Kathy Pickering, vice president of regulatory affairs at H&R Block, said the new measures should take a big bite out of tax refund fraud.
“The work we’ve done is going to make a big difference,” she said. “It’s really done a lot to raise awareness across the whole tax ecosphere from the taxpayer to all of the industry players. It’s also helping the states understand the problem and how they can work with industry to combat some of these issues.”
Processing your return may be slower
Even with the new anti-fraud protections in place, the IRS says it expects to process nine out of 10 federal tax refunds within 21 days.
But in a report to Congress earlier this month, the National Taxpayer Advocate at the IRS said hundreds of thousands of taxpayers experienced “substantial delays” last year because the IRS computers mistakenly flagged their returns as potentially fraudulent. The concern is this could happen again this filing season.
At the state level, don’t be surprised if it takes longer to get your refund this year.
“Everyone’s focus now is on getting it right, rather than getting the refund out the door in a hurry,” said Verenda Smith, deputy director of the Federation of Tax Administrators. “The days of fast refunds are gone – and frankly should never have existed. The days of accurate processing are here. Honestly, very few taxpayers are going to notice that much of a difference.”
Smith told NBC News that some taxpayers may be contacted by their state taxing authority to prove their identity by providing a driver’s license or answering ID verification questions.
“These are to protect you and the taxpayers’ dollars,” she said.
Some states have already alerted the public about possible processing delays. And they are urging employers to speed up the filing of W2 information needed to verify earnings.
Illinois, for example, won’t send out refunds until March. Connie Beard, director of the Illinois Department of Revenue, said new security protocols implemented last year resulted in an overall savings of nearly $5 million.
“By delaying tax refunds by just a few weeks, we’ll be able to better detect attempts at identify theft and ensure taxpayer refunds do not fall needlessly into the hands of criminals,” Beard said in a statement.
In Utah, a new law prevents the State Tax Commission from issuing any income tax refunds before March 1 unless both the employer and employee have filed all required returns and forms. On its website, the commission says: “This means your refund might be delayed if your employer has not electronically submitted their information to the Tax Commission by January 31.”
North Dakota Tax Commissioner, Ryan Rauschenberger has asked people in his state for their patience and understanding. He said his office stopped more than 900 returns claiming $1.3 million in fraudulent refunds last year.
And the Hawaii Department of Taxation has advised taxpayers that refunds for some taxpayers may be delayed for up to 16 weeks because of additional anti-fraud measures in place.
What’s new for DIY taxpayers?
Expect to see some security upgrades if you use tax preparation software. You will be required to use a password that’s at least 8 digits and includes numbers, letters and special characters.
Two of the big names in DIY tax software, Intuit (maker of TurboTax) and H&R Block, are providing customers with new security alerts and options that exceed the new industry standards. Both companies will now notify customers when certain changes are made to their accounts, such as signing in for the first time on a new device, updating a payment method or changing a password.
“If we don’t know that taxpayer, we may ask a few additional security questions or do some additional authentication measures,” said H&R Block’s Pickering.
TurboTax, which had to suspend filing of state tax returns for two days last February after “an increase in suspicious filings,” has developed some significant new security options to validate your identity when you log into your account:
- Multi-Factor Authentication: Online customers now have the option to require this every time they log in. To access their account they will need to provide a unique, six-digit code sent to their pre-designated personal device along with their password.
- Fingerprint Security: Customers with Apple devices can use Touch ID to authenticate their online account with their fingerprint.
- Token Technology: Customers can install a soft token app on their mobile device that generates a random six-digit number needed to access their TurboTax account. The number can only be used once.
Julie Miller, Intuit’s vice president of communications, told NBC News she feels optimistic about the changes that have been made since last filing season. But the fraudsters won’t give up, she said.
“The industry recognizes that there’s no silver bullet, but the steps that we’re taking are absolutely the right things to do for taxpayers and to protect the U.S. tax system,” Miller said. “We recognize that this is going to be a marathon, not a sprint, and taxpayers need to know that the tax preparation industry, including the states and the IRS, are working to protect them and we’re going to keep on that.”
What can you do to protect yourself? The common advice is to file early, but some people, including those waiting for forms from a brokerage account, can’t do that. Still, experts say it’s smart to file as soon as you have all the documents you need.
This is Tax Identity Theft Awareness Week and there are a number of online events designed to help you understand the problem and find out how to minimize the risk and what to do if you become a victim.
The IRS has a series of Security Awareness Tax Tips on its website.
A reminder for anyone who needs a copy of a previous year’s federal tax return: You can no longer use the IRS Get Transcript tool to view and print a copy online. The IRS disabled that feature last year because it was being used by fraudsters. You can use the Get Transcript by Mail service to order it online. The IRS will mail the transcript to your address of record. You should receive it within five to 10 days.