With the April 15th deadline now visible on the calendar, many Americans are finally sitting down to do their taxes. The good news? A standard return isn't that hard and there's still plenty of time to get it done. The bad news? One of the most popular online tax filing services is still compromised.
New reports in the Washington Post describe a new breed of tax fraud using the online platform. Previous attacks would focus on filing fraudulent returns using stolen personal information. Such returns were usually riddled with errors designed to inflate the amount of a potential refund, which would be routed to an account far away.
New attacks seem to have taken a different direction. Criminals use stolen email and password information to amend recently filed returns. The only change they make is the account number into which any refund will be deposited.
While only a few people have been victims of this kind of fraud, investigators are still working with TurboTax to identify the source of the leak. In the meantime, additional security measures have been added to online accounts. New logins will be required to answer credit report style identity verification questions, like former addresses, roommates and employers. So-called "knowledge-based authentication" (KBA) procedures are of suspect value.
Fraudsters with access to personal information can find it remarkably easy to get more. Real estate transaction databases can quickly eliminate possible choices about former addresses. The multiple choice nature of the questions makes it possible to mechanically "crack" the authentication procedure in relatively short order.
To make matters worse, fraudsters are getting better at covering their tracks. According to security blog KrebsOnSecurity, more and more scammers are registering accounts using stolen identity information on IRS.gov. Because IRS.gov accounts aren't necessary for e-filing, many people never have cause to create one. One thing they are useful for, though, is getting copies of past tax returns. This is a vital step in protesting a fraudulent return.
Scammers have identified this weak point in fraud prevention and begun registering accounts using stolen personal information. This presents one more hurdle in the face of fraud reporting. It also gives scammers more time to take the money and run. Without an IRS.gov account, the IRS is bound by policy not to disclose any information on a tax return to anyone not designated on the return as an approved party. This does mean they're protecting the privacy of criminals, but there's little they can do about the policy at this point.
The core of the problem, according to Krebs, is that the IRS uses those same KBA procedures. Sophisticated scammers are increasingly adept at bypassing these procedures. That means one less barrier between them and your money.
If you think you've been the victim of tax-related fraud, there are still steps you can take. Read on for three ways you can fight back against tax fraud and get your money back!
1.) Create an IRS.gov account and use a strong password
The current KBA authentication protocol can be broken into relatively easily. If you register your account now, you can create a much stronger password to protect yourself. At time of press, the IRS is not allowing new accounts to be created, but new procedures for account verification are forthcoming.
Once you've created your account, use a strong password that includes numbers, letters and symbols. Make it unique to your IRS account to reduce the possibility that your password will be compromised. Once you create your login information, write it down and put it with this year's tax documents (preferably locked in a safe location). You'll need it again next year!
2.) Request a copy of this year's tax return
If you think your information has been used to file a fraudulent tax return, you'll need a copy of the return to file a dispute. If you can't get it with an IRS.gov account, you'll need to get a hard copy. The IRS has a form for this and they'll charge a small fee for processing.
The from you're looking for is Form 4506. This will get you a printed photocopy of the return, including all information about refund destination. This may help you track down the stolen money, and it will definitely help you in proving to the IRS that this wasn't your work.
3.) Beware of 'Money Mule' scams
Increasingly, international fraudsters are having difficulty getting the money out of the country. That's why they turn to Americans who are desperate for a buck. They'll advertise on sites like Craigslist for "financial processing assistants." They use your checking account to receive the funds, then you'll wire or send a portion of the proceeds to another bank. It's one way of eliminating the paper trail of tax fraud. That's been the laundering scheme of choice for many tax fraud perpetrators this season.
It's clearly illegal and very dangerous, but it also makes it possible for scammers to steal money in the first place. Beware of any job solicitation that offers to pay you for your ability to have a checking account. If they were a legitimate business, they could get one all their own and wouldn't have to pay you for the privilege!