Criminals take advantage of every opportunity to prey on unsuspecting individuals, and tax filing season is no exception. Tax refund identity theft happens when bad actors get their hands on your personal information, such as your name, date of birth and/or Social Security number that they then use to file a fraudulent tax return and obtain a refund. One of the easiest ways to help prevent this is to file your tax return early – before an identity thief has the chance to file a fake one.
“Over the past few years, the IRS (Internal Revenue Service) has rolled out additional safeguards to protect filers against identity theft. While there are safeguards in place, taxpayers should be aware that tax refund identity theft is still possible and criminals are getting more creative in the ways they go about it," says Trevor Buxton, fraud communications manager and Certified Fraud Examiner with PNC Bank.
As the IRS cracks down, bad actors are finding new ways to try to steal your data and claim your refund, and they’re increasingly targeting tax preparers too. We asked Buxton what filers need to know to help protect themselves this tax season.
How frequently do tax preparers get hacked?
Hacking tax preparers has increased over the past year or so. This could be a result of the IRS strengthening their vetting process to detect bogus tax returns, which may be prompting the bad guys to turn their attention to tax preparers. By doing so, they can attempt to get all of the information they need to file a fraudulent return that will pass the higher scrutiny now being applied to tax submissions.
Are there precautions I can take to prevent this from happening?
The simple answer is no, but things like filing your taxes early and being selective about the preparer you choose can help minimize your risk. It’s always important to do your homework on an accountant and to feel completely comfortable with them before turning over your valuable information, but it’s particularly important now that tax preparers are increasingly being targeted. You also should be familiar with their security practices. Even if you have a longstanding relationship with a tax preparer, it’s smart to apply a little extra scrutiny as you engage with them. Ask your tax preparer if their firm has ever been hacked and what security measures they have in place to prevent fraud and theft. Things like virus and malware scanning software and VPN use can go a long way toward protecting client information. Employees should be thoroughly trained on security protocol and should know, for example, not to click on links or open attachments from unknown emailers who may be posing as prospective clients or the IRS.
What should I do if my tax preparer has been hacked?
If you’re a taxpayer and you notice a refund you weren’t expecting in your bank account, this is a clue you might be victim of tax fraud. This will typically be followed by a call to let you know that it was deposited accidentally and to transfer to an account posing as the IRS. The first step is to notify your bank. You will probably need to close the account since the bad guys now have your bank account information. The second thing to do is to contact the IRS to let them know you suspect you’re a victim of fraud. Finally, if you haven’t been in contact with your tax preparer, you should contact his or her office to let them know their data might have been compromised.
How can I minimize the damage if my tax preparer has been hacked?
It’s smart to take a few initial precautions when you’re a victim of a data breach. If you have been a victim of tax fraud specifically, the IRS will mail you an Identity Protection PIN that is refreshed every year. The IRS will only accept returns for those people with that PIN on it, so if you have been victimized, you need to protect that number. This system, however, is not foolproof. If fraudsters have your personal information, they can contact the IRS to get the PIN refreshed. If you are expecting to receive a PIN and haven’t, there’s a chance it was intercepted. Contact the IRS to check on the status and notify them you haven’t received your PIN yet.
Customers should also be on the lookout for phishing – where fraudsters send emails that mimic the IRS and “fish” for information. Phishing emails can contain attachments with innocuous titles like “tax transcript” that, once opened, download malware that scans your device for financial information that fraudsters can use to file a tax return in your name.
