IRS & Tax Industry Band Together to Combat Tax Fraud
Starting in 2015 the IRS began working with state tax administrators and tax preparation and software companies in a major effort to combat identity theft tax refund fraud.
This tax fraud battle includes several initiatives to improve taxpayer authentication and detect refund fraud, share and assess information about fraudulent activity, and increase public awareness of the need to protect personal information.
Among the earliest initiatives are the following (IR 2016-94, 6/29/16):
-
Protocols requiring all individual tax software customers to update their security credentials to a minimum eight-digit password and establish security questions.
-
Software providers shared approximately 20 data elements from tax returns with the IRS and states to help identify possible fraud. These elements are confidential but include information to identify returns prepared quickly by automated programs. From January through April 2016, the IRS stopped $1.1 billion in fraudulent refunds claimed by identity thieves on more than 171,000 tax returns. Better data from returns and information about schemes meant better internal processing filters to identify identity theft tax returns.
-
Participants from the tax industry performed regular reviews to identify possible identity theft schemes and reported them to the IRS and state agencies to help stay on top of emerging schemes. Thanks to leads reported from the tax industry, the IRS suspended for further review 36,000 suspicious returns January through May 8, 2016, and $148 million in claimed refunds. A “Taxes. Security. Together” campaign was launched to increase public awareness about the need for computer security and provide people with tips on how to protect their personal information.
Additional initiatives were put in place for the 2017 filing season, and like the earlier ones, they generally were invisible to taxpayers. A few of the 2017 initiatives were:
-
Expanding a W-2 Verification Code test to cover approximately 50 million forms in 2017. The selected forms contained a 16-digit code that taxpayers and tax preparers entered when prompted by software. The code helped validate not only the taxpayer's identity but also the information on the form. However, in November of 2019, the IRS announced it would discontinue the Form W-2 Verification Code pilot program for the 2019 tax year. This was because of the law change by the PATH Act that now requires employers to submit Forms W-2 by January 31 each year. The earlier filing date for W-2 forms has helped the IRS combat fraud and identity theft and superseded the need for a verification code.
-
Identifying additional data elements from tax returns that will help improve authentication of the taxpayer and identify possible ID theft scams and sharing data elements from corporate tax returns.
-
Creating an Identity Theft Tax Refund Fraud Information Sharing & Analysis Center (IDTTRF-ISAC) to collect and analyze tax-related ID theft schemes and serve as the early warning system for the IRS, state agencies and the tax industry.,
-
Expanding the “Taxes. Security. Together.” awareness campaign to tax return preparers to ensure they have the information they need to protect themselves from cyberattacks and to safeguard taxpayer data.
-
Creating a process for financial institutions to identify questionable state tax refunds and return them to states for validation.,
-
Continuing enhancement by the software industry of software password requirements for individuals and tax professional users – providing additional safety prior to filing.,
As a result of these many initiatives over the last 5 years, the IRS has been able to prevent more than $24 billion in fraudulent refunds from being paid out, and the number of taxpayers reporting they were ID theft victims has fallen substantially.
However, in spite of the progress the IRS and its Security Summit partners have made, the ID thieves are continuously changing their tactics and targets. Most worrisome now are business identity theft and data theft from tax professionals, particularly thieves hacking into practitioners' computer systems, stealing client data and filing fraudulent tax returns, often before a preparer even knows they have been victimized. Thieves are also aiming to steal tax practitioners’ Electronic Filing Identification Numbers (EFIN) or Preparer Tax Identification Numbers (PTIN) to use in filing fraudulent returns. Tax professionals who experience a data theft should contact their IRS stakeholder liaison immediately for assistance. To find your local stakeholder liaison, go to: https://www.irs.gov/businesses/smallbusinesses-self-employed/stakeholder-liaison-local-contacts
The IRS has created the following list of warning signs that your client’s data may have been stolen:
-
The IRS or state tax agencies begin to reject client e-filed returns because returns with their Social Security numbers were already filed;
-
Clients who haven’t filed tax returns begin to receive taxpayer authentication letters from the IRS to confirm their identity for a submitted tax return;
-
Clients who haven’t filed tax returns receive refunds;
-
Clients receive tax transcripts that they did not request;
-
Clients who created an IRS Online Services account receive:
a) an IRS notice that their account was accessed,
b) IRS emails stating their account has been disabled, or
c) receive (unexpectedly) an IRS notice that an IRS online account was created in their names
-
The number of returns filed with your Electronic Filing Identification Number (EFIN) exceeds the number of clients you have;
-
Tax professionals or clients are responding to emails that you did not send;
-
Network computers are running slower than normal;
-
Computer cursors are moving or changing numbers without anyone touching the keyboard; and
-
Employees are being locked out of network computers.
For information on how to develop a program (plan) to protect client data see IRS Publication 4557.
Multi-Factor Authentication
The IRS and Security Summit partners have requested that tax professionals select multi-factor authentication options whenever possible to prevent identity thieves from gaining access to client accounts. A multi-factor or two-factor authentication – which often involves a security code sent via text – offers an extra layer of protection for the username and password used by the tax professional. (IR-2020-170, Jul. 29, 2020)