Since peaking in 2014 at 766,000, the number of reports of tax-ID theft involving federal returns has dropped dramatically. But risks remain to tax filers who don’t protect themselves. Thieves are using new methods to get access to tax filers’ information in order to file false claims in their names, and then pocketing fraudulent refunds before anyone knows what’s happening. Laura Saunders writes in The Wall Street Journal:
And thieves are constantly trying to defeat new detection efforts. In some recent schemes, phishers pretend to be high-level executives requesting W-2 information for many workers.
Brian Krebs, a cybersecurity expert who publishes the Krebs on Security website, trolled the Dark Web earlier this year and found stolen W-2 forms for sale, for between $4 and $20 of bitcoin each.
“It was the first time I had seen W-2s,” he says.
To protect yourself against tax-ID theft, here are helpful tips:
*Push your preparer. Respected stand-alone accounting firms are a rich target now, experts say. Clients of these firms often pay taxes in April but don’t file returns for up to six more months after getting an extension—so the information is valuable to thieves in the meantime. Ask about the firm’s cybersecurity.
*Minimize tax refunds. The average refund now tops $3,000, and ID theft victims have to wait months for theirs. If you adjust withholding to get a lower refund or even small bill for tax due, there will be less pain if you’re a victim.
*Don’t be lazy with passwords. Make them strong and don’t use the same one for different portals, especially if you do your taxes online.
*Practice good cybersecurity hygiene. Resist giving out your Social Security number and other personal information. Shred paper records. Use antivirus protection in your computer. Don’t do your return on unsecured Wi-Fi. Don’t fall for a scammer impersonating the IRS.
Also, don’t click on links that appear to be from your online tax-prep firm—they might be from phishers. Instead, enter the firm’s site directly.
*Act quickly if you’re a victim. The IRS has posted a clear list of steps to take at irs.gov. It includes links to state tax agencies, which should be notified as well.
Inform the Federal Trade Commission. It keeps data on ID thefts and also offers help to victims.
Then wait. The IRS says that ID-theft cases are typically resolved within 120 days, but complex cases may take 180 days or longer.
*Ask for assistance. If your employer, tax preparer, or another firm compromised your information, ask for further help. In most states, they are required to notify you, says Brian Lapidus, a data-breach specialist with the risk-consulting firm Kroll.
Victims are often offered restoration services after a data breach, he adds. This typically includes credit monitoring for up to two years and sometimes monitoring for payday-loan fraud as well.
Read more here.
