Tax season is here, and the fact that you can file your taxes online means that scammers can try that, too — and they may already have enough of your personal information to do so.
There are two simple ways to thwart this effort: File a return before a criminal does, and sign up for the IRS’s new PIN program.
Around 80 percent of Americans now file their tax return online, according to data from the IRS. And tax fraud has become a big business: The agency identified $2.3 billion in tax fraud in 2020. More than 100,000 people reported fraud that stemmed from either from tax- or employment-related identity theft, according to the Federal Trade Commission.
Since the U.S. has no designated national identification system, the IRS still relies heavily on taxpayers providing their Social Security number to authenticate they are who they say they are. But with SSNs so frequently used for identification, and data breaches so common, experts say everyone should assume that criminals have everything they need to file a false tax return.
“The Social Security number is being used in a way it was never intended to be used,” said Eva Velasquez, the president of the Identity Theft Resource Center, a nonprofit that helps victims of identity theft.
The sheer number of companies that ask for and store Americans’ SSNs — and then lose them to hackers — means that the number of people who have not been compromised “is effectively zero,” she said.
“We need to acknowledge that,” Velasquez said. “To that end, the things that you can do become even more important.”
The first is to opt in for an Identity Protection PIN, a feature the IRS previously used to protect taxpayers who were already the victims of identity theft. This is the first tax season it’s available to all taxpayers, though some states have had similar programs for years.
The IRS does not offer two-factor authentication, a basic cybersecurity tool that has become widespread in services like email, social media, and banking, that helps users prove their identity. But the IP PIN aims to serve a similar function. After you pass a verification process, such as providing your name, birthday, address, and some financial information, the IRS will assign you a unique six-digit number you’ll need to file your taxes. Once that’s set up, criminals will have a significantly harder time filing tax returns in your name.
The second is to file taxes as soon as you can prepare them — which effectively blocks criminals from filing your return — instead of waiting until the April 15 deadline.
“Nothing's ever under control when you're talking about the bad guys."
Though they’re frequently blocked, criminals are already trying to file as many false tax returns as they can with stolen personally identifiable information, said Jarod Koopman, director of cybercrime at the IRS Criminal Investigations Unit.
“From our perspective internally, the biggest scams are just trying to take those known [personally identifiable information] aspects, or whatever information they've stolen, and use it to file false tax returns,” Koopman said in a phone interview.
“A lot of times we now see them trying to institute it with different artificial intelligence or machine learning components to use some type of a script, or automated filing, to get them out quicker. It's a kind of numbers game,” he said.
Investigators at the IRS monitor hacker forums where criminals trade not only Americans’ personal information but also guides on how to commit tax fraud, and flag some accounts for added security. Its investigations led to 108 people being sentenced for ID-theft related crimes in 2020, a spokesperson said in an email, and 226 people the year before.
“Nothing's ever under control when you're talking about the bad guys,” Koopman said. “We have outstanding capabilities and we feel comfortable going after criminals.”
“But you're never going to be comfortable that this problem is solved. We're constantly fighting to stay ahead,” he said.