The Department of Justice estimates that 17.6 million Americans had their identities stolen in 2015, and almost 222,000 people reported tax or wage identity theft to the Federal Trade Commission (FTC) last year. The number of phishing and malware threats related to taxes has already quadrupled over last year’s number. Unfortunately, some people who were victims of Internal Revenue Service (IRS) tax refund theft found a nasty surprise when they tried to file this year: they’d been hit by identity thieves again.
Thieves can steal a victim’s personal information and have her tax refund sent to the thieves’ bank accounts or addresses; then, when the victim tries to file her own return, her request is rejected. That’s bad enough. But now the KrebsOnSecurity blog is reporting that identity thieves are using the supposedly secure Identity Protection (IP) PIN number the IRS sent previous tax refund fraud victims to, once again, steal their federal refund money.
“I tried to e-file this weekend and the return was rejected,” one such victim told KrebsOnSecurity. “I received the PIN since I had IRS fraud on my 2014 return. I called the IRS this morning and they stated that the fraudulent use of IP PINs is a big problem for them this year.”
It’s surprisingly easy for identity thieves to uncover a previous victim’s IP PIN, which is needed for verification on the victim’s next tax returns. After all, the IRS allows you to retrieve your PIN online after answering four questions from Equifax, the consumer credit bureau. Because the answers to these questions, which include addresses, loan amounts and dates are easy to find online (especially on social networks that ask you to input a lot of information, like Facebook), thieves are able to steal the PIN and yet another year’s tax refund.
At least, the FTC has made it easier to report identity theft with their revamped site, IdentityTheft.gov, which automatically fills out the proper forms and where to send them to get your identity back. But at the heart of the issue is the IRS’ own website and the lax security.
Hopefully the IRS fixes these easy-to-exploit security issues. In the meantime, you can read up on how to stop identity theft if you believe you’ve been a victim, as well as ways that you can check if your online accounts have been hacked.
[Tax Identity Theft via Alexandru Miroiu/Shutterstock]
