During tax season, millions of Americans prepare to download tax forms and file returns to the IRS online. While everything is fine most of the time, cybercriminals are eager to take advantage of any potential vulnerabilities in the process.
There are several common kinds of consumer tax scams, explains Glenn Tierney, senior director of fraud investigations for Fidelity. There's tax identity theft, where someone uses your personal information, including a Social Security number, to file a tax return in your name and fraudulently claim your refund. Or criminals might impersonate the IRS on a call, with the intention of swindling you out of your money.
Recovery from these incidences can be costly. Victims of any kind of identity theft spend an average of 100 to 200 hours over 6 months or more to discover, investigate, and recover from the crime, according to Allstate Identity Protection. And the impact on their credit and finances can last for years. "It's critical that consumers recognize the signs of tax fraud," says Tierney.
Here's what you should be on the lookout for to help protect yourself and your family.
The signs of tax identity theft
The first indication that you're a victim of tax identity theft may be a notice from the IRS of suspicious activity or a bill for taxes due. Or you can't file your tax return electronically because another return has already been filed using that Social Security number.
Those aren't the only signs that someone has stolen your identity, or is trying to, and paying attention to early indications like these could give you a head start on recovery—or even prevent a fraudulent return from being filed:
- You get a letter from the IRS telling you that an online account has been created in your name when you never opened one, or that an existing account has been disabled when you made no changes.
- You're sent an employer identification number that you never asked for.
- You receive a tax transcript you didn't request.
- You get a tax form for wages from an employer you haven't worked for.
- You start getting unsolicited emails or calls from someone claiming to be a tax professional.
Contact the IRS immediately if you wrongly receive any of the above.
Common ways to steal personal data
While it's important to stay vigilant during filing months, you should be alert to attempts by cybercriminals to steal your personal data year-round. To trick you into handing over sensitive information, criminals most commonly turn to these social engineering scams.
Phishing: These are fraudulent emails designed to fool you into submitting sensitive personal information. You might get an email purporting to be from the IRS that requests "missing" information or claims you need to take "urgent action." Phishing emails often contain malicious attachments or links that, if clicked on, launch programs that collect any data you enter.
Remember: The IRS will not initiate contact with you by email. Instead, the agency mainly communicates through the US Mail. Never respond to what appear to be IRS-branded emails.
Text message scams: These fraudulent texts often contain bogus links claiming to be IRS websites or online tools. Other than account authentication for IRS Secure Access, the only verified online account by the Federal body, the IRS won't use text messages to communicate with you. Also, the IRS will never send messages via social media. Do not click on these links on your mobile device, and report unsolicited texts or emails that appear to be from the IRS to phishing@irs.gov.
Phone scams: You've likely gotten one of these robocalls from someone impersonating an IRS agent. The ominous, prerecorded voice may demand immediate payment for back taxes, even threatening you with arrest. Cybercriminals can fake or "spoof" phone numbers to appear to be from an IRS office in Washington or local law enforcement. The IRS will never call you to demand immediate payment using, say, a prepaid debit card, gift card, or wire transfer, threaten to call in law enforcement, or ask for credit or debit card numbers. Hang up.
Unemployment fraud: Many states have experienced a surge in fraudulent unemployment claims using stolen identities, the IRS reports. You could discover that someone collected unemployment benefits in your name during tax-filing season. Since these benefits are potentially taxable, states issue a Form 1099-G to recipients, which reports total benefits paid out and any taxes withheld. If a Form 1099-G shows up in your mailbox and you didn't collect those benefits, report it to the issuing state's unemployment agency and request a corrected form.
How to protect against tax-related identity theft
One of the best methods for preventing tax identity theft is to get an identity protection (IP) PIN from the IRS. These 6-digit numbers known only to you and the IRS help verify your identity when you file. You can apply for one online using the Get an IP PIN tool at IRS.gov.
In addition, keep in mind that criminals can also purchase data on the black market or obtain it from breaches and leaks. So make it a habit to follow basic cybersecurity best practices. These include closely guarding your personal information, using strong, unique passwords and not repeating them across accounts—a password manager can help with this—and using multi-factor authentication where possible.
You can also help stave off a stolen refund by filing your return as early as possible, beating criminals before they attempt to file in your name.
What to do if you're a victim of tax fraud
If you know or suspect you're a victim of tax fraud, you should still proceed with paying your taxes and filing a return, even if you have to do so by mail. In addition, the IRS recommends taking these actions:
- If your e-filed return is rejected because of a duplicate filing under your Social Security number, complete the Identity Theft Affidavit online or print the fillable PDF form, then attach it to your return and send it by mail.
- Respond immediately to any authentic IRS letters.
- You can also try calling the IRS at 800-908-4490. Keep in mind, however, that in recent years the IRS has experienced long delays for help by phone.
Recovering from tax identity theft is an arduous process that makes tax filing even more stressful than it is. The best protection is to prevent it from happening in the first place by staying vigilant. With a bit of extra effort, as well as caution, you can file your return every tax season with peace of mind, knowing your data, identity, and refund are safe from cybercriminals.