Taxes Hacked? Top Tips To Recover From Identity Theft

With all the news this past week regarding TurboTax shutting down e-file activity, I thought it would be important to share some information that will help if your identity has been stolen. Identity theft comes in many forms. Over the last several years scammers have stolen millions by e-filing fraudulent tax returns on behalf of taxpayers using personal identifiable information purchased on black market websites. This type of identity theft has grown exponentially and the IRS is struggling to combat it with existing fraud detection measures.

How do I know?… Well, it happened to me this past week. Someone crafted a tax return with fake W2 details and my personal information in an effort to collect a refund before I could submit my return. Yes, the guy who talks about cybersecurity non-stop has had his identity stolen. Ironic huh? As a matter of fact it can happen to anyone. This type of theft doesn’t require any special tools, insider access, or skills. You can even run this scam from jail. With hundreds of millions of Americans impacted by data breaches and a dysfunctional federal system of checks and balances, we are all at risk.

If you are a victim, one of two things may happen. 1.) You will receive a letter stating that you have recently filed a tax return that is under review. This will come from the IRS directly and include your social security number and any names related to the filing. 2.) The fraudulent filing may bypass fraud detection measures and when you go to e-file, an existing submission will be in the system resulting in an error.

In either case, you need to take immediate measures to protect yourself. Here are ten things you will need to do:

1.) Don’t panic! Visit the IRS Taxpayer Guide to Identity Theft website – All the information from this point forward relates to the instructions on this website.

2. ) File a police report. Call your local non-emergency (311) police line. An officer will be sent out to file a report. Request a copy. You will need to reference this report in other steps.

3.) Call the IRS (800-908-4490) and report you received the letter. Tell them that you did not file the return and answer their verification questions. The IRS will then review your record and confirm that the tax filing was blocked or under review. They can also check the status of your spouse’s record. Ask them to make a note of your call and flag a fraud report your SSN / account.

Here is what they will most likely tell you:

  • If you received a letter they already have stopped any return from happening.
  • You most likely cannot e-File this year.
  • When you file you will have to provide some additional details along with your paper filing. (see step 3.)
  • Once you file, you will receive your return along with a letter confirming the situation has been resolved. You will want to keep this in the event any future fraud is attempted.
  • Returns when a fraud has been committed could take up to 180 days.

4.) Submit an Identity Theft Affidavit (Form 14039)Fax or mail a copy with proof of ID (blown up) to IRS with original notice. Mail it in as soon as possible and then include a second copy with your upcoming Tax Return.

5.) Sign up for a Credit Monitoring Service. Check for any suspicious activity and report it if it exists. You may want to do this for your family members as well. Besides, a monthly credit score isn’t a bad thing to have access to for your financial health.

Each of the three credit bureaus have their own flavor and they are basically the same. Other options like LifeLock and Identity Guard offer similar features but add in some other tools like blackmarket website and non-credit financial account monitoring.

6.) Visit the Social Security Administration website. You can check your account to see if any additional W2s have been associated with your SSN by creating an account on MySocialSecurity.

SSA cross checks your identity with Experian. If you do not already have an account established, create one prior to step 7 & 8 otherwise you will need to go to your local SSA office to get a activation code.

7.) Setup Credit Fraud Alerts. These alerts are intended to inform the lenders to the existence of identity theft. They do nothing to stop/block access to your credit. You have to rely on the lender who is reviewing your credit to do the right thing.

8.) Freeze your credit reports. This is like putting a lock on your credit report and makes it harder for anyone to make an inquiry. Therefore, anyone attempting to open a line of credit in your name wont be able to either. Here are links to do this on all three bureaus.

The cost is between $5 – 10 per site. The downside is that you will need to lift the freeze each time you want to open a line of credit or apply for a loan. Experian, Equifax and TransUnion claim that these measures will not impact your credit score in any way. More information on Alerts and Freeze from Equifax.

9.) File a complaint with the FTC. Their website will walk you through the process.You will need to include a reference number on your Police Report for this step.

10.) Check for GreenDot Debit Cards. It is common for fraudsters to open GreenDot prepaid debit cards around the same time as their false return. GreenDot issues a temporary account number, providing a legitimate place to send your refund. You may even receive a physical card in the mail around the same time in your name. These are hard to detect since as a debit card, they will not show up on credit reports. If the thieves successfully trick the IRS, a refund will be placed in the account and the funds can be used just like a normal debit card at ATMs, kiosks, and check out lines.

Calling GreenDot’s customer support line (866-795-7597) only offers automated services. You can verify the existence of an open card using your SSN and date of birth. Unfortunately, there isn’t a way to deactivate the card or report it as fraudulent. If you want to take any preventative action, you can try calling the GreenDot corporate offices (626-765-2000) and press 8 for customer support. The odds of getting a real person on the line are slim, but it is worth demanding that they cancel the debit account and block any new accounts from being opened.

Is that it?!

Now that you have completed these ten steps, the work isn’t over quite yet. The means of establishing identity in the United States is based on the Social Security Number which at it’s very core is broken. Once you have followed these steps there are no guarantees that the issue won’t rear it’s ugly head again. You have to stay vigilant about monitoring your credit and personal information and you should demand greater security measures from any companies who ask for your personal information.