Handling tax-related identity theft

Taxpayer data is stolen through corporate and government data breaches and then monetized via ransomware or refund theft, thereby creating a higher risk of tax-related identity theft. In addition, the different relief measures enacted to help victims of COVID-19 provided multiple opportunities for identity theft. The following discusses indicators of such theft, corrective steps to take if it occurs and preventive measures to protect a taxpayer’s identity.

Tax-related identity theft defined

Tax-related identity theft occurs when someone uses another person’s Social Security number (SSN) to file a tax return and claim a fraudulent refund. In many cases, taxpayers are unaware any theft has occurred until they are notified by the Internal Revenue Service (IRS). Taxpayers should be aware of how to identify whether they are impacted, what to do if they suspect identity theft as well as how to prevent it.

Identity thieves typically purchase or steal information from individuals, businesses, hospitals or nursing homes. Thieves also use the list of public deaths issued by the Social Security Administration to obtain SSNs. Fraudulent tax returns are then filed using the stolen identification information. Commonly, data is obtained through email and telephone phishing as well as discarded financial information, including bank records, credit card receipts, discarded tax returns or other personal and financial information. Credit card theft has been the most common form of identity theft for the past two years.

Indicators determining whether tax-related identity theft has occurred

For tax-related identity theft to occur successfully, the thief must file the fraudulent tax return early in the year (before the taxpayer), often before Forms W-2 or 1099s are received by the IRS. Taxpayers may not be aware of the theft until a tax notice is received, generally, for one of the following reasons:

• More than one tax return has been filed using the taxpayer’s SSN
• The taxpayer’s balance due/refund has been adjusted for a year in which they did not file a tax return
• IRS records indicate the taxpayer received wages for an unknown employer
• IRS sends an authentication letter (5071C, 4883C, 5747C) when the taxpayer has not yet filed a return
• Taxpayer receives notification an IRS online account was created or accessed without their consent

Steps to take if tax-related identity theft is suspected

• Call the number on the tax notice(s) received immediately. A power of attorney (POA) will need to be filed if an authorized party will be calling on the taxpayer’s behalf.
• Complete and file IRS Form 14039, Identity Theft Affidavit (fillable forms located at irs.gov), along with a copy of the taxpayer’s photo ID. The IRS will contact the taxpayer for next steps.
• Proceed with filing tax return (by paper, if rejected) and pay related taxes.
• Report theft to local police department as well as the Federal Trade Commission (FTC).
• Place a fraud alert or credit freeze with one of the credit bureaus; request a copy of credit report for review. Credit freeze laws vary from state to state.
• Freeze or close credit cards and change login and password information for accounts. If you use the same username and/or password on another site, change them on that site as well.
• Contact companies from where the fraud was suspected.

 Preventing identity theft

• Protect your SSN and other personal financial information: confidential information should not be carried around. Personal information should only be provided when absolutely necessary. Extreme caution should be used when providing information over the phone or through the mail/internet. The IRS will never request personal or financial information electronically.
• Monitor your credit report.
• Check your Social Security Administration earnings statement annually.
• Shred financial documents when no longer needed.
• Use multifactor authentication, firewalls, anti-virus protection software and strong passwords.
• Encrypt email attachments containing personal identifying or financial information.
• Educate yourself on the multitude of phishing, charitable, educational institution and telemarketing scams.
• Do not open attachments or click links from unknown senders.
• Use separate personal and business email accounts.

 How the IRS is helping

In an effort to inhibit tax-related identity theft, the IRS is increasing taxpayer authentication, improving tax system defenses and promoting information protection and taxpayer awareness and communication. The IRS has partnered with tax preparation and software firms as well as state tax administrators in this endeavor. For example, a multifactor authentication process has been implemented for remote access to accounts. Access under this process must include at least two of the following:

• Something you know: a password, personal identification number (PIN), challenge question or pattern
• Something you have: a hardware (security fob or smart card) or software token (typically stored on private computer or device needing an additional authentication factor such as private encryption key or activation token software)
• Something you are: biometric data such as a fingerprint, voiceprint or iris scan

Another safeguard implemented by the IRS is the Identity Protection PIN (IP PIN). This is a six-digit identification number separate and distinct from the taxpayer’s SSN, known only to the IRS and the taxpayer. The Get an IP PIN online tool is available between mid-January and mid-November for those taxpayers voluntarily wanting another layer of identity protection when filing their tax returns (applications are also available via regular mail or in person). As part of this process, the IRS requires an identity verification for the taxpayer, the spouse and any dependents. Confirmed victims of identity theft will receive an IP PIN from the IRS each year.

Finally, a taxpayer can file an assistance request for taxpayer advocate services. Form 911, Request for Taxpayer Advocate Service Assistance, is used by qualifying taxpayers unable to resolve a specific matter with the IRS. The Taxpayer Advocate Service (TAS) is a separate, independent organization within the IRS handling requests submitted using this form.

Keep in mind, a typical case can take several months to resolve and may cause refunds to be delayed for an extended period of time. According to federal privacy laws, information related to the filed fraudulent tax return can only be disclosed to the primary or secondary taxpayer listed on the return.

The IRS does not request personal or financial information or initiate contact with taxpayers using email.

We encourage you to connect with your Baker Tilly advisor regarding how the above may affect your tax situation.

The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.