Busy season has barely begun, but the fraudsters are at it already and in a new way.
The latest scheme is to use taxpayers’ real bank accounts to deposit refunds from fraudulent tax returns. A crook posing as a debt collection agency employee then contacts taxpayers to say the refund deposit was made in error and that they should forward the deposit to the bogus debt collector.
According to an IRS statement about the latest fraud, “this scheme is likely just the first of many that will be identified this year.” But because the agency, state tax agencies and the tax industry — collectively known as the Security Summit — have ramped up identity theft deterrents, fraudsters have evolved, too. They now target tax professionals for client information.
The twist here is that the crooks know that it’s tougher to identify and stop bogus tax returns when they use actual taxpayer data that includes income, dependents, credits and deductions. “Generally, criminals find alternative ways to get the fraudulent refunds delivered to themselves rather than the real taxpayers,” the IRS states.
It’s yet another head-scratcher, and IRS criminal investigators are examining how the newest scam happens. But, so far, most cyber thefts happen when a tax preparer or co-worker opens a phishing email and clicks on a link or attached file that contain malware. Some malware downloads in secret on computers, allowing crooks to see each keystroke — known as keystroke software — or give them remote access to the computers. Either way, the thieves then can steal the data stored on the computers.
Taxpayers should be particularly alert to unusual activity, such as receiving a tax transcript or tax refund that they didn’t request. In the latter situation, here’s what taxpayers should do:
- Contact the Automated Clearing House (ACH) department of the bank or financial institution that received the direct deposit and have them return it to the IRS.
- Call the IRS toll-free at (800) 829-1040 (for individuals) or (800) 829-4933 (for businesses) to explain why the direct deposit is being returned.
- Be aware that interest may accrue on the bogus refund.
The IRS offers further information about returning erroneous refunds in Topic Number: 161 — Returning an Erroneous Refund.
In the case of paper refunds that are bogus, for instance, the guidance advises what taxpayers can do if they have or haven’t yet cashed the check.
Tax professionals who have data thefts, meanwhile, should contact their IRS Stakeholder Liaison, who will let the appropriate agency officials know about it and also be the preparers’ contact.
All practitioners should review Data Theft Information for Tax Professionals for details about the process and the additional steps they should take.
A security professional can offer explicit advice, but one preliminary step includes contacting the IRS and law enforcement, states in which they prepare state returns.
Another is to email the Federation of Tax Administrators at [email protected] to find out how to report victim information, state attorneys general for each state, security experts and tax preparers’ insurance companies, clients, and the three credit bureaus.
About Terry Sheridan
Terry Sheridan is an award-winning journalist who has covered real estate, mortgage finance, health care, insurance, personal finance, and accounting and taxation issues for newspapers, magazines, and websites. A Chicago native and former South Florida resident, she now lives in New England.