Con Watch: Protect Yourself from Income Tax Identity Theft

Income tax identity theft is one of the fastest growing and easily committed crimes in the U.S. Learn how and why it happens and how to protect yourself.

Money on a tax return

Weekly Newsletter

The best of The Saturday Evening Post in your inbox!


Steve Weisman is a lawyer, college professor, author and one of the country’s leading experts in cybersecurity, identity theft and scams. See Steve’s other Con Watch articles.

Many people look forward to a nice refund at tax time. Unfortunately, a thief could steal your tax refund right out from under you.

Income tax identity theft is a simple crime. It starts when a thief files an income tax return using your Social Security number and a counterfeit W-2 to produce a substantial fraudulent refund.

How do criminals get ahold of your Social Security number? They might steal your Social Security card from your wallet or purse, or they could hack into the database of any of the organizations you’ve given your Social Security number to, such as your employer or a hospital. Some stolen numbers are sold on the Dark Web, a part of the World Wide Web where high-tech crooks buy and sell stolen credit cards, Social Security numbers, and other contraband.

People over 65 are vulnerable in another common place: their Medicare cards. While the issuers of driver’s licenses, insurance cards, and other identification cards have stopped using Social Security numbers for identification, Medicare has persisted in doing so, unnecessarily putting millions of Americans at risk for identity theft. Congress finally passed legislation in 2015 to stop this practice, but it doesn’t go into effect for newly issued Medicare cards until 2019, and Medicare isn’t required to change the ID numbers for people currently receiving Medicare until 2023.

According to a 2015 report of the Government Accountability Office, the IRS paid out $5.8 billion in bogus refunds to identity thieves for the tax year 2013. This figure probably understates the true amount because of the difficulty in determining the actual amount of undetected fraud. Often, the IRS doesn’t find out about income tax identity theft until two income tax returns are filed using the same Social Security number. Citizens of Puerto Rico — because they are required to obtain a Social Security number but are not required to file a federal income tax return — are frequent targets of income tax fraud, as are children, seniors, or even dead people. Because the IRS receives only one return for their Social Security number, discovering the crime is more challenging.

One silver lining is that because this crime is so easy to commit, gangs and drug dealers have turned away from sometimes violent street crime to simpler and more lucrative income tax identity theft.

To its credit, in the last two years, the IRS has made significant progress in combatting income tax identity theft through joint efforts with state tax administrators and private tax preparation leaders. One step they have taken is to review the IP addresses of computers filing income tax returns online in an effort to weed out computers filing multiple returns. The IRS also monitors how long it takes to complete an electronic income tax return — completing a fake return generally takes less time than preparing a legitimate one.

Despite recent IRS press releases touting how many fraudulent income tax returns they’ve identified, they are notably silent about the number of fraudulent refunds they still send out, which, according to the GAO’s most recent annual figures, exceeded $3.1 billion and could be significantly more.

The crux of the problem is both when and where employers file W-2s for their employees. Until this tax year, employers weren’t required to file W-2s with the federal government until as late as March 31 . Additionally, the W-2s are filed not with the IRS but with the Social Security Administration, which generally does not get around to sending them to the IRS until July. A criminal has a big window of time in which to file a fake tax return and get a refund before the IRS even has a chance to see your real W-2s and realize there’s a problem.

This year, a new law requires employers to  file W-2s by January 31. Unfortunately, they still are filed with the Social Security Administration rather than the IRS, so the delay in getting them to the IRS remains. The IRS is also experimenting with a pilot program that uses a 16-digit code to validate W-2 information when filing using income tax software. That should help, but this program is a long way off from general use.

How to Protect Yourself from Income Tax Identity Theft

Below are a few tips that will help protect you against income tax and other Social Security fraud:

  1. Protect the privacy of your Social Security number. Don’t carry your Social Security card in your wallet; it should be kept in a safe deposit box or home safe. Don’t throw documents that show your Social Security number in the trash; shred them instead.
  2. Limit where you provide your Social Security number. Many forms ask for a Social Security number when it isn’t necessary, but just because someone (including your doctor) asks for it doesn’t mean they need it or have a right to it. And never give your Social Security number to someone on the phone.
  3.  Avoid filing your income tax returns using WiFi, where your return can be easily intercepted.
  4.  Don’t store your income tax returns on your computer. Instead, use a portable hard drive disconnected from your computer so that if your computer is hacked, your income tax return will not be stolen.
  5. Most importantly, file your income tax return as early in the tax season as you can. If you file your income tax return with the IRS before the identity thief does, you will avoid income tax identity theft. Note that the only way you find out if you have been a victim of income tax identity theft is when the IRS notifies you because two tax returns have been filed. There is no protocol for people to contact the IRS to find out if an income tax return has been filed for a child or a deceased person.

For more information, you can read the IRS’s Taxpayer Guide to Identity Theft. If you are a victim, you can file a complaint with the FTC at


Steve Weismanis a lawyer, a college professor at Bentley University, and one of the country’s leading experts on scams and identity theft. He also writes the blog

Become a Saturday Evening Post member and enjoy unlimited access. Subscribe now


Your email address will not be published. Required fields are marked *