ATTN: Financial editors
(c) 2015, The Washington Post.
Tax fraud happens every year, but it seems that this year even more people are sitting down to prepare their taxes only to find out that someone has already filed in their name -- and taken off with their tax refund.
Some states are seeing a spike in suspicious returns and so far, it appears that most of those questionable tax returns were submitted using software from TurboTax, one of the largest providers of tax preparation software, which temporarily stopped sending out state returns last week while it looked into the matter.
Intuit, the parent company for TurboTax, says its systems weren't breached and that the fraudsters using its software to file fake returns stole the personal information somewhere else. The FBI recently launched a probe to find out if the fraud is a result of a data breach.
There are three main ways that fraudsters can obtain personal information to file fake returns, says Chester Wisniewski, a senior security adviser for Sophos, a security software vendor. They involve phishing scams that trick people into giving up their account information or personal details, security breaches exposing consumers' personal information and fraudsters reusing account passwords that people repeat from other accounts, he says.
People who haven't been affected should file as soon as they can, says Lisa Schifferle, an attorney with the Federal Trade Commisson. "We recommend people file early so they can beat the scammers to the punch," she says.
Recovering from tax fraud can be a painful and lifelong process. Here's what you should do if you're a victim:
--Report the fraud: Fake tax returns need to be reported directly to the identity protection division of the IRS. Victims need to fill out an Identity Theft Affidavit to create an alert on their account. Some people may need to file their returns on paper while the IRS works to confirm their identity. Identity theft victims are then issued an identity protection pin from the IRS that they need to submit along with their Social Security numbers when they file their tax returns going forward. Last year, the IRS also made these pins available to people in high fraud states, such as Georgia, Florida and D.C., who want the added protection. Victims can also file a complaint with the FTC and report the fraud to their local police department.
--Check your credit report: A thief with enough information to file a fraudulent tax return in your name may also try to take out loans or open new credit cards using your Social Security number, says Becky Frost, senior manager of consumer education at Experian. Identity theft victims need to check their credit reports periodically to watch for accounts taken out in their name, she says. (You can access three free credit reports a year on AnnualCreditReport.com.)
Identity theft victims should also set up credit alerts with the three major credit reporting bureaus --TransUnion, Equifax and Experian -- so that they can be notified if someone applies for a loan or credit using their Social Security number, Frost says. Some people might put a credit freeze on their account, which restricts who can pull a credit report, making it more difficult for thieves to open accounts in your name, Wisniewski says.
--Change your passwords: It's a good idea to change the passwords on your financial accounts -- and to make sure they are all different, Wisniewski says. Usernames and passwords for several big companies have been leaked in recent weeks and thieves may test that account information to try to sign on to Web sites for banks and tax preparation companies. Passwords should be long and include a mix of numbers, letters and symbols. It might even be safer to lie in password recovery questions -- think of how easy is it for people to look up what city you were born in -- as long as you remember your fake answers, he says.
People should also take advantage of additional security measures available for financial accounts, such as multi-factor authentication, which require users to provide a code or other information in addition to their password when signing on. Often the codes are sent to the person's e-mail or cell phone, which would mean that scam artists would need to steal the person's phone or access their e-mail in addition to figuring out their password, Wisniewski says. Some consumers may view the extra step as a pain, but "when it's a financial account, or perhaps even your health care account, you really should be taking advantage," he says.
--Don't fall for another scam: Anytime there is a high profile scam, other thieves try to take advantage by initiating new schemes that take advantage of victims or worried consumers. TurboTax has already warned of new phishing scams from thieves pretending to be from the company that ask people to verify their personal information.
Last year, there was a spike in the number of scam artists pretending to be from the IRS, says Schifferle. As part of the scam, people call taxpayers and scare them into believing they owe back taxes, threatening jail time if they don't pay up. Keep in mind that the IRS doesn't call or e-mail taxpayers asking for personal information. If you think you owe money, check through IRS.gov. Don't call the number left in a voice mail or e-mail message.
--Be patient: The IRS says the typical case of identity theft takes 120 days to resolve. And even after a person proves his identity to the IRS, credit fraud can be a lifelong problem for identity theft victims, Schifferle says. Consumers should continue to check their credit reports for accounts and loans others may be opening in their name.
bc-tax-fraud
Business on 02/17/2015