For Cyber Criminals, It's Always Tax Season

Most of us breathe a sigh of relief when tax season is over. Unfortunately, the end of tax season no longer means an end to tax worries because identity thieves are working on tax fraud schemes year-round. According to the IRS, taxpayers need to be on constant guard against tax-related identity theft—a crime in which someone uses your stolen Social Security number (SSN) to file a fraudulent return in your name.

According to a recent news release from the IRS, criminals are increasingly mounting attacks against tax preparers. They typically send phishing emails that claim to be from tax software companies asking the preparers to update their software or their login credentials and directing them to a fake website. When the tax professionals respond, the criminals either steal their passwords or download malware that then steals account information from the preparer’s computer. Tax fraud criminals also sometimes send fake emails, supposedly from an executive, to an organization’s human resources team asking for employee info, and some simply use stolen SSNs purchased from the Dark Web.

Tax identity theft is growing: a 2017 Javelin Research report found a 31 percent increase in criminals taking over tax preparers’ accounts to file fraudulent returns or redirect client refunds to themselves. To combat the problem, the IRS, state tax agencies, and the tax industry have launched an education series called “Don’t Take the Bait” to teach tax professionals and agencies how to spot scams and better protect themselves and their clients.

But the IRS also has advice to help taxpayers protect themselves. First, watch for any evidence that:

• More than one tax return was filed using your SSN
• You owe additional tax, refund offset, or have had collection actions taken against you for a year you did not file a tax return
• IRS records indicate you received wages or other income from an employer for whom you did not work

If you see any of these warning signs, immediately call the IRS and, if you think someone has fraudulently claimed your tax refund, complete IRS Form 14039, Identity Theft Affidavit, and submit it to the IRS to get the refund you have coming.

If you use a tax professional to prepare your returns, it’s also worth asking them how they protect your personal information: how do they protect paper documents and information on their computers, and how have they educated their staff to resist phishing attacks? If they don’t have ready answers, you can point them to the “Don’t Take the Bait” information at irs.gov. And if they’re not worried about the problem and not eager to get started on better security, maybe you should find a tax preparer who is.