Intuit, the maker of the TurboTax software program, is reporting a jump in fraudulent state tax returns. If you are a victim of fraud, experts warn that consumers who have had their identities stolen need to take action to protect themselves from further fraud.
Intuit, the maker of the TurboTax software program, is reporting a jump in fraudulent state tax returns. If you are a victim of fraud, experts warn that consumers who have had their identities stolen need to take action to protect themselves from further fraud.Paul Sakuma/Associated Press

Tax fraud happens every year, but it seems that this year even more people are sitting down to prepare their taxes only to find out that someone has already filed in their name – and taken off with their tax refund.

Some states are seeing a spike in suspicious returns and, so far, it appears that most of those questionable tax returns were submitted using software from TurboTax, one of the largest providers of tax preparation software, which temporarily stopped sending out state returns while it looked into the matter.

There are three main ways that fraudsters can obtain personal information to file fake returns, says Chester Wisniewski, a senior security adviser for Sophos, a security software vendor. They involve phishing scams that trick people into giving up their account information or personal details, security breaches exposing consumers’ personal information and fraudsters reusing account passwords that people repeat from other accounts, he said.

People who haven’t been affected should file as soon as they can, said Lisa Schifferle, an attorney with the Federal Trade Commisson. “We recommend people file early so they can beat the scammers to the punch,” she said.

Recovering from tax fraud can be a painful and lifelong process. Here’s what you should do if you’re a victim:

Report the fraud: Fake tax returns need to be reported directly to the identity protection division of the IRS. Victims need to fill out an Identity Theft Affidavit to create an alert on their account. Some people may need to file their returns on paper while the IRS works to confirm their identity. Identity theft victims are then issued an identity protection PIN from the IRS that they need to submit along with their Social Security numbers when they file their tax returns going forward. Last year, the IRS also made these PINs available to people in high fraud states, such as Georgia, Florida and D.C., who want the added protection. Victims can also file a complaint with the FTC and report the fraud to their local police department.

Check your credit report: A thief with enough information to file a fraudulent tax return in your name may try to take out loans or open new credit cards using your Social Security number, said Becky Frost, senior manager of consumer education at Experian. Identity theft victims need to check their credit reports periodically to watch for accounts taken out in their name, she says. (You can access three free credit reports a year on AnnualCreditReport.com.

Identity theft victims should also set up credit alerts with the three major credit reporting bureaus – TransUnion, Equifax and Experian – so they can be notified if someone applies for a loan or credit using their Social Security number, Frost said. Some people might put a credit freeze on their account, which restricts who can pull a credit report, making it more difficult for thieves to open accounts in your name, Wisniewski said.

Change your passwords: It’s a good idea to change the passwords on your financial accounts – and to make sure they are all different, Wisniewski said. Usernames and passwords for several big companies have been leaked in recent weeks and thieves may test that account information to try to sign on to Websites for banks and tax preparation companies. Passwords should be long and include a mix of numbers, letters and symbols. It might even be safer to lie in password recovery questions – think of how easy is it for people to look up what city you were born in – as long as you remember your fake answers, he said.

People should also take advantage of additional security measures available for financial accounts, such as multi-factor authentication, which requires users to provide a code or other information in addition to their password when signing on. Often the codes are sent to the person’s e-mail or cellphone, which would mean that scam artists would need to steal the person’s phone or access their e-mail in addition to figuring out their password, Wisniewski said.

Don’t fall for another scam: Anytime there is a high-profile scam, other thieves try to take advantage by initiating new schemes that take advantage of victims or worried consumers.

Last year, there was a spike in the number of scam artists pretending to be from the IRS, Schifferle said. As part of the scam, people call taxpayers and scare them into believing they owe back taxes, threatening jail time if they don’t pay up. Keep in mind that the IRS doesn’t call or e-mail taxpayers asking for personal information. If you think you owe money, check through IRS.gov. Don’t call the number left in a voice mail or e-mail message.

Be patient: The IRS says the typical case of identity theft takes 120 days to resolve. And even after a person proves his identity to the IRS, credit fraud can be a lifelong problem for identity theft victims, Schifferle said. Consumers should continue to check their credit reports for accounts and loans others may be opening in their name.

ID theft insurance may not be worth the cost

The data breach at Anthem, one of the nation’s largest health insurers, put about 80 million consumers at risk of ID theft. States are seeing a spike in fraudsters using stolen identities to file for income tax refund checks, and new hacks seem to be discovered every week. That’s made ID theft protection a booming industry, with new products being launched and existing ones tweaked to help with, and profit from, the anxiety.
H&R Block is the latest player to get into the business. In January, it launched Tax Identity Shield, which, for $29.95 a year, does an annual, pretax season scan for your name on websites suspected of selling personal information, sends an e- mail if your information is on another tax return filed through H&R Block, and gives basic help navigating red tape.
While details of all the protection products vary greatly, most charge from $10 to $30 a month. For that, services include credit monitoring, fraud resolution and, increasingly, insurance for out-of-pocket costs or losses tied to ID theft. It’s not unusual for plans to offer up to $1 million in coverage. And it’s that insurance angle that comes in for the most criticism by consumer experts.
For one thing, the coverage typically kicks in only for losses not covered by one’s financial institution or by other policies, such as homeowner’s insurance. “It’s a hollow promise,” says Gary Frank, chief executive of LCG, a national provider of employer-sponsored legal benefits. “They’re claiming to provide coverage for things that are already being provided by the consumer financial institutions.”
Identity fraud statistics just out from Javelin Research & Strategy put the need for insurance in perspective. There are two primary categories of fraud: existing account fraud, such as when someone gets access to your credit card, and new account fraud, which uses your information to open new accounts. Existing account fraud is by far the most prevalent, accounting for $14 billion of the $16 billion in total fraud losses last year, according to Javelin. The mean consumer cost for this type of fraud, however, was just $63, and many victims will pay nothing.