ID Theft and the IRS
Unfortunately, we are seeing a significant rise in ID Theft victims this year. Tax-related identity theft is often discovered when an e-filed tax return gets rejected and we are notified that it has already been filed using one of our client's social security numbers. As discouraging as this is, it's not too surprising when you consider the number of large corporate and government data breaches that have occurred over the last few years (see our Identity Theft 5-part series). All that personal information stolen from Target, Sony, Home Depot, JP Morgan, Anthem and many other companies has been available to cyber criminals who can piece it together to steal identities and file fraudulent tax returns. You may recall that the IRS itself was hacked in 2015 through the Get Transcript app and IP PIN program (which, according to this new report, the IRS then failed to deactivate despite repeated recommendations from the Treasury Inspector General for Tax Administration)!
Not only that, but the IRS just announced that the personal data of another 100,000 taxpayers may have been stolen through a breach of the online student financial aid application, FAFSA. Security concerns were suspected back in September, but the online tool wasn't disabled until March. In the meantime, hackers filed 8,000 fraudulent tax returns totaling $30 million (click here for article)!
It is estimated that the IRS paid $2.2 billion in 2015 for fraudulent tax return refunds but also prevented $12.3 billion more. To combat this serious threat, the IRS convened with state tax agencies and tax industry leaders to implement new safeguards. One of the first initiatives rolled out last year was to require a two-step authentication process for getting transcripts online.
This year, the IRS has strengthened
password
requirements
for tax-related software like we use here at the firm.
How does this affect you?
- Applying for financial aid will be more time-consuming without the online data retrieval tool, which is expected to be offline until October.
- If you are using our secure portal (which we hope you are!), your account will time out after 30 minutes of inactivity, and you will now be required to change your password every 90 days. Passwords may not include your login or name and must contain at least 8 characters with upper case, lower case, alpha, numerical and special characters.
- We hope you never become a victim of tax-related ID theft, but if you do, we are here to help! Our new Data Security and ID Theft Guide on our website provides additional information and assistance.
