Con Watch: The Threat of Income Tax Identity Theft Is Growing

Steve Weisman is a lawyer, college professor, author, and one of the country’s leading experts in cybersecurity, identity theft, and scams. See Steve’s other Con Watch articles.

Although the IRS has made some recent improvements in their efforts to reduce income tax identity theft, according to the Government Accountability Office it still costs taxpayers more than $2 billion a year.

Income tax identity theft occurs when a criminal electronically files an income tax return using your Social Security number along with a counterfeit W-2 that enables them to receive a substantial refund. You don’t realize you’re a victim until you file your legitimate return and are notified that a one has already been filed using your name and Social Security number.

And then the fun starts.

According to the IRS, it currently takes the IRS approximately 260 days to correct the problem and send you your legitimate refund. I predict that it will take even longer this year: while the number of income tax returns filed has gone up 19 percent in the last ten years, the budget of the IRS has gone down by 20 percent. The IRS is not only underfunded and understaffed, but also uses some of the oldest computer systems in the federal government. As of late December 2021, the IRS still hadn’t processed six million income tax returns from last year.

And if you think you can get help on the IRS’s “Where’s My Refund” tool, think again. “Where’s My Refund” only provides information for already processed returns and doesn’t provide any explanation for delays or information about income tax identity theft.

As for getting help on the phone, calls to the IRS last year increased threefold over the previous year to a record 282 million calls. Of those calls, only 32 million were actually answered by IRS customer service representatives.

Most often people become aware that they have become a victim of income tax identity theft when they receive a letter from the IRS (the IRS will never initiate communications with you by email, phone call, or text message; that is the purview of scammers posing as the IRS). The IRS sends out this letter when someone has already filed an income tax return using your name and Social Security number. The letter requests that you contact the IRS via a toll-free phone number to verify your identity in order to start the processing of your legitimate income tax return. Unfortunately, from personal experience I found it impossible to reach someone at the IRS to help. It wasn’t until I enlisted the assistance of my U.S. Senator whose staff contacted the IRS on my behalf did I get any response.

If you are lucky enough to get through to an IRS customer service representative, you still may not be able to verify your identity over the phone and may be required to make an appointment to go to an IRS office in person.

So how can you protect yourself from becoming a victim of income tax identity theft and avoid all of these problems? Protecting the privacy of your Social Security number is an essential element. Unfortunately, you are only as safe as the security at the legitimate places that have your Social Security number. Data breaches at companies and government agencies have resulted in pretty much everyone’s Social Security number being stolen by cybercriminals. The Equifax data breach of 2017 alone resulted in the theft of 147 million Social Security numbers.

Generally, when cybercriminals steal massive amounts of personal information such as Social Security numbers, they then sell the stolen information to other cybercriminals on the Dark Web, that part of the Internet where crooks buy and sell goods and services. One thing you can do to protect yourself is to avoid providing your Social Security number to legitimate companies with which you do business merely because you are asked for it. Medical care providers, for instance, routinely ask for your Social Security number, but they do not need it.

By far the best thing you can do to protect yourself from becoming a victim of income tax identity theft is to file your income tax return electronically, and as soon as possible. A cybercriminal cannot make you a victim of income tax identity theft if you file your own return first.

And to actually end this column with something good to say about the IRS, last year the IRS expanded its Identity Protection PIN opt-in program that provides individual taxpayers with a six-digit code that is required to be included on your income tax return. This will protect you even if your Social Security number has been compromised because the IRS will not process your return unless it carries your PIN.

The IRS started the Identity Theft Protection PIN program ten year ago, but initially it was only available to people who were already victims of identity theft. Now anyone can get a PIN. The PIN is only valid for a single year and must be applied for anew each year.

Featured image: Shutterstock