Handling tax-related identity theft

Taxpayer data is stolen through corporate and government data breaches and then monetized via ransomware or refund theft, thereby creating a higher risk of tax-related identity theft. In addition, the different relief measures enacted to help victims of COVID-19 provided multiple opportunities for identity theft. The following discusses indicators of such theft, corrective steps to take if it occurs and preventive measures to protect a taxpayer’s identity.

Tax-related identity theft defined

Tax-related identity theft occurs when someone uses another person’s Social Security number (SSN) to file a tax return and claim a fraudulent refund. In many cases, taxpayers are unaware any theft has occurred until they are notified by the Internal Revenue Service (IRS). Taxpayers should be aware of how to identify whether they are impacted, what to do if they suspect identity theft as well as how to prevent it.

Identity thieves typically purchase or steal information from individuals, businesses, hospitals or nursing homes. Thieves also use the list of public deaths issued by the Social Security Administration to obtain SSNs. Fraudulent tax returns are then filed using the stolen identification information. Commonly, data is obtained through email and telephone phishing as well as discarded financial information, including bank records, credit card receipts, discarded tax returns or other personal and financial information. Credit card theft has been the most common form of identity theft for the past two years.

Indicators determining whether tax-related identity theft has occurred

For tax-related identity theft to occur successfully, the thief must file the fraudulent tax return early in the year (before the taxpayer), often before Forms W-2 or 1099s are received by the IRS. Taxpayers may not be aware of the theft until a tax notice is received, generally, for one of the following reasons:

• More than one tax return has been filed using the taxpayer’s SSN
• The taxpayer’s balance due/refund has been adjusted for a year in which they did not file a tax return
• IRS records indicate the taxpayer received wages for an unknown employer
• IRS sends an authentication letter (5071C, 4883C, 5747C) when the taxpayer has not yet filed a return
• Taxpayer receives notification an IRS online account was created or accessed without their consent