Blog

Identity Theft and Filing Your Tax Return: Risks and Prevention

Identity theft has became a major problem in recent years. Cybercriminals are only becoming more effective at what they do whether they are acting alone or with major crime syndicates: in many cases, they only need a name to get started on stealing your assets and opening fraudulent accounts in your name. Additionally, too many organizations rely on Social Security numbers opposed to other personally-identifiable information (PII) to verify users’ identities. This is unfortunately what facilitates large-scale theft like the recent Equifax breach.

When it comes to filing your taxes, identity theft creates a whole other set of inconveniences. You may find that your tax refund has been denied or a hold placed on your return if someone already filed a tax return under your name and/or Social Security number. By getting to know the various types of identity theft scams and tactics related to tax filing, you can safeguard yourself ahead of time. Here are some things you should know about identity theft and your taxes.

1. Keep email communications with your tax professional as secure as possible.

Do you communicate with your tax professional via email? Refund theft is a major motivator for identity thieves and you may be at risk without even knowing it. Hackers have gotten very sophisticated when it comes to this: no longer content with just stealing your Social Security number, they can actually impersonate you by hacking into your email account and telling your tax professional that they now want your tax refund to go to another address or bank account. Or, they can impersonate your tax professional and ask you to verify information via email that they already have.

First, tell your tax professional to always notify you by phone in the event they receive such an email (or that you receive one that looks suspicious.) Any tax documents, like copies of your returns, need to have a strong password or other safeguard if you send or receive them via email. Encrypted documents should be as tough to crack as possible so don’t include the password in that email. You should also check in with your tax professional’s PII practices since tax offices are popular targets of identity thieves, even if they take care to shred documents.

Use a secure email account with actual end-to-end encryption such as ProtonMail. Enable two-factor authentification so that it gives hackers less of a chance of getting in, and don’t use a "pet password" for your email.

2. Report your identity theft to the IRS and take proper precautions if you think your information was compromised.

If you can confirm that your information was stolen in a breach, or suspect that it was, the IRS has a set of protocols for this. Breaches don’t always result in having your identity stolen, but if your account was indeed compromised or you received a notice from the IRS that your tax return was rejected due to a duplicate filing under the same Social Security number, you must file an identity theft affidavit. You can also apply for an IP PIN, an identity theft PIN number that will let you file your tax return without using your Social Security number.

In the meantime, you should also report the identity theft to the appropriate channels like the FTC, requesting a credit freeze from the credit bureaus to prevent new accounts from being opened in your name, and financial institutions to halt having your bank accounts and credit cards used fraudulently. 

3. Become familiar with the "dirty dozen" tax scams, including the fact that the IRS will never contact you by phone or email regarding taxes due.

Few things strike fear into peoples’ hearts more than hearing from the IRS and finding out that they owe a lot of money in taxes and need to take immediate action. However, if this is the case for your tax situation, you’re being scammed. These are referred to as the "dirty dozen" scams in tax professional circles.

Ignore any phone calls and voicemails that you receive from callers claiming to be the IRS and that you owe all this money in taxes. You should always do a reverse look-up on those numbers then report them to the FTC since they are scams. Less tech-savvy people tend to be hit harder by these scams a result.

In the event that you DO owe taxes, you will always get a written notice from the IRS that details a proper assessment made against your account and how much your bill is. This notice and/or bill will be sent to the last-known address they have on your file. In the event of actual collection issues for past-due accounts, you are also contacted via mail and given at least 30 days’ notice before your wages are garnished or assets seized. The IRS will never call or email you about it.

Because of this, you should also never open any attachments from emails that come from unfamiliar addresses claiming to be with the IRS or your state tax agency. They are direct phishing attempts to get your identity information.

4. Become aware of signs of tax-related identity theft.

If you haven’t had any of the telltale signs of identity theft such as noticing new accounts opened in your name or suspicious transactions on your credit cards, it doesn’t mean it hasn’t happened necessarily. If an identity thief fraudulently filed a tax return on your behalf, you may actually receive a refund check at your home address without filing your real tax return. You may also receive notices from the IRS that a tax return was already filed, or notices for adjustments to be made to your tax return based on the fraudulent one that was already submitted.

Keep an eye out on the mail for these signs of tax-related identity theft, then take proper actions with the IRS by requesting an IP PIN and certificate of identity theft.

The IRS, and some state tax agencies, are taking identity theft very seriously. However, it’s not enough to stop cybercriminals who are getting better and better at what they do while lawmakers can be slow to act on penalizing them while protecting taxpayers. By taking proper precautions with your PII and records containing it, as well as the means of contact you use like your email accounts and devices, you can help deter identity thieves from accessing your information. Always be wary of communications from parties you are unfamiliar with that claim the content and/or attachments are concerning your tax returns.