Tax Identity Theft: How it happens and how to fix it
Tax identity theft is a billion-dollar industry. Each year, thieves attempt to use taxpayer information to file millions of fraudulent tax returns and receive a refund. The U.S. Treasury loses billions of dollars annually to stolen identity refund fraud – and victims are left wondering how it happened to them and how they can fix it.
Why does stolen identity refund fraud happen?
It’s relatively easy for a thief to file another person’s tax return in today’s current tax system. Thieves need only a name, Social Security number (SSN) and date of birth to file a fraudulent return. And most of the time, the thieves are untraceable.
Because of the record high amount of personal data being exposed in recent data breaches involving companies and governments, thieves can find personal information pretty easily. Then, thieves can make up a W-2 and file a return claiming a big refund, which is then deposited in a bank account of their choice – all electronically.
In recent months, thieves have also become successful at gaining W-2 wage information. This information supplements a name, date of birth and SSN and increases their chances of making it past IRS filters.
If fraudulent returns get past IRS detection systems, thieves can successfully steal thousands of dollars per tax return. The only real challenge for tax identity thieves is to file before the taxpayer does. That’s why most stolen identity refund fraud happens early in the filing season or to individuals who may no longer have a filing requirement, like retired people.
How will a taxpayer know if they’ve become the victim of tax identity theft?
There are basically two ways to detect tax identity theft.
1. The IRS rejects a taxpayer’s return – because someone else already filed it.
When a taxpayer tries to e-file a return, the IRS rejects it because a return has already been filed under their name and SSN. If the taxpayer files a paper return, the IRS will send a notice letting them know the same thing. At that point, they may be confused because they haven’t successfully filed yet. Chances are, they’re the victim of stolen identity refund fraud.
2. The IRS contacts a taxpayer about income that they didn’t earn.
Employment-related tax identity theft happens when someone uses another person’s SSN to get a job or otherwise earn income. It’s an even bigger headache to resolve than a stolen refund. If this happens, the taxpayer will find out about it later in the year when the IRS sends a notice about additional income that was not included on the tax return. (In fact, the income is not the taxpayer’s at all, but instead was earned by a thief and reported under the taxpayer’s identity.)
Now, the IRS is auditing the taxpayer or trying to collect taxes from them. These cases can take up to a year to resolve. During that time, victims receive IRS notices and may even have future refunds frozen until the problem is fixed.
One way to combat the employment-related tax identity theft is to find out what information statements (W-2 or 1099) are being filed under a taxpayer’s SSN. In July of each year, taxpayers can ask the IRS to provide wage and income transcripts. Taxpayers can order them online or by mail and the IRS will provide the transcript online or by mail.
Taxpayers should review the document for any discrepancies or unfamiliar income and contact any unfamiliar payers if they don’t think they should have received an information statement from them. This is a great way for taxpayers to proactively guard against someone using their SSN for employment-related tax identity theft.
What victims of stolen identity refund fraud theft should do
Victims of stolen identity refund fraud should act immediately. Here is what they should do:
1. Contact the IRS.
Confirm that a return was filed using their information and register that they are a victim of tax identity theft. The IRS has a special unit to help: the Identity Protection Specialized Unit. Call (800) 908-4490, from 7 am to 7 pm, Monday-Friday.
2. Complete an IRS identity theft affidavit.
Complete IRS Form 14039, Identity Theft Affidavit. The IRS encourages taxpayers to report their tax identity theft to local police, the Federal Trade Commission and credit agencies. However, they don’t have to attach those reports with the Form 14039.
3. File the tax return.
If their return was rejected, immediately file the tax return by mail and attach the Form 14039 and proof of identity. Victims should not wait to file. If the IRS receives the return after the tax deadline (April 17, 2018), and the taxpayer has a balance due on their return, the IRS may charge a late-filing penalty regardless of the circumstances.
After taxpayers complete these steps, the IRS may send Letter CP01A every December or early January. This letter will provide the taxpayer with an Identity Protection Personal Identification Number, or IP PIN, that they will need to use to file their tax return. Some taxpayers may receive instructions on how to retrieve an IP PIN using the IRS online retrieval system. Without this IP PIN, the taxpayer won’t be able to file electronically for that year. They’ll receive a new IP PIN by mail each year.
Refund delays: How long?
Victims of tax identity theft will have their refund delayed. In some cases, refund delays can reach six months or more. The length of time it will take for the IRS to resolve the case depends on case complexity and volume.
An ounce of prevention: how to help better protect taxpayers from becoming victims of tax identity theft
Taxpayers can help better protect themselves by practicing simple measures to keep their personal information private and secure. For example, taxpayers should not carry their Social Security card or give out their SSN or birth date on the phone, email, text or in public. Do not share user IDs, passwords or PINs – and make them hard to guess. Close unused credit card accounts and destroy the card. Shred documents containing personal information. Request a copy of a credit report and keep tabs on who might be accessing it.
Taxpayers should also beware of scams. The IRS will always contact taxpayers by mail first about taxes owed. And the IRS will never:
- call to demand immediate payment or ask for credit or debit card information over the phone,
- email or connect on social media to request personal information or
- require a specific payment method.
But these measures alone won’t always be sufficient. Tax identity thieves can get the information they need to file a return from data breaches of companies and governments. In these cases, taxpayers need to be vigilant.
For example, one taxpayer was able to avoid stolen identity refund fraud tax identity theft because she signed up for H&R Block’s Tax Identity Shield, the first service specifically directed to helping protect against the growing problem of tax identity theft. After signing up, she got a notice from H&R Block that someone had attempted to use her information to file a return. She called to confirm that she had not filed yet and H&R Block was able to stop the fraudulent return. Because of the Tax Identity Shield’s quick notification and her action, she was able to e-file her tax return as normal.
When the worst happens, the Tax Identity Shield supports taxpayers in the tax identity restoration process with completing the necessary tax documents, setting up fraud alerts and filing an FTC complaint and police report. Another taxpayer with Tax Identity Shield said the team, which she described as a task force busy on her case, helped her recover her tax identity with empathy and compassion.
Tax identity theft is relatively easy in today’s current tax system but recovering from it is not nearly as simple. To learn more about tax identity theft, taxpayers should consult a tax professional.
Read Jeff Jones’ statement on protecting taxpayers from the 2018 IRS Security Summit with the new IRS commissioner, fellow tax industry CEOs, and state tax commissioners.
Check out the latest updates now available with H&R Block’s Tax Identity Shield. This is just another way the tax experts are trying to keep clients safe.