Equifax breach to test IRS defenses

The Equifax data breach exposed a treasure trove of information thieves could use to file fake tax returns under a victim’s name and claim a refund before the victim can.

Although the Internal Revenue Service has plenty of experience with this type of fraud and has taken steps to prevent it, the magnitude of the Equifax breach will certainly test its defenses.

Equifax said “the incident” potentially exposed names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers for about 143 million Americans.

In many cases, that’s enough information for thieves to file a fake tax return, even if the employer and wage data on the return does not match what is reported on an employee’s W-2 form. That’s because employers don’t file W-2 forms with the IRS, but rather with the Social Security Administration — which sorts out name and number mismatches before forwarding W-2 information to the IRS.

Until this year, employers had until the end of February to file W-2 forms by paper or until March 31 to submit them electronically. As a result, the IRS could issue refunds to taxpayers before it had their W-2 forms.

This year, based on a federal law known as the PATH Act, employers must must file W-2 forms to the Social Security Administration by Jan. 31. The earlier deadline “will make it easier for the IRS to verify the legitimacy of tax returns and properly issue refunds to taxpayers eligible to receive them,” the IRS said.

The PATH Act also requires the IRS to hold refunds for any tax return claiming the Earned Income Tax Credit or Additional Child Tax Credit until Feb. 15. These credits have sometimes

been improperly claimed by real taxpayers and identity thieves. The IRS estimated that 24 percent or $16.8 billion in EITC payments were issued improperly in fiscal year 2016.

As an additional safeguard, the IRS began placing a 16-digit “verification code” on about 2 million W-2 forms last year. Individuals or their tax preparers are supposed to enter the code when prompted by taxfiling software. The IRS will expand the program to 50 million W-2 forms this year and eventually to all. Failure to enter the code will not result in the rejection of your tax return. However, the IRS uses the verification code to help verify the information on your Form W-2, the IRS said.

This system won’t be foolproof, because the IRS will start accepting returns as early as Jan. 23 next year and many taxpayers don’t get a W-2 form because they’re self-employed or unemployed. The verification code is different from the Identity Protection Personal Identification Number the IRS issues to some taxpayers. This is a sixdigit number assigned to eligible taxpayers that helps prevent the misuse of their Social Security number on fraudulent federal income tax returns, the IRS said. Taxpayers with a PIN must enter it on their tax return or the return will be rejected.

The only ways to get an IP-PIN is if the IRS sent you a notice containing the PIN, if you received a letter for the IRS inviting you to get one or if you file your tax return as a resident of Georgia, Florida or the District of Columbia and ask for one.

The IRS offered PINs to about 700,000 taxpayers whose personal information was targeted or accessed by identity thieves in 2014 and 2015 through its Get Transcript website. The IRS also offered those whose returns were accessed a free Equifax identity theft protection product for one year.

The Wall Street Journal, citing unnamed sources, reported that people who purchased credit-monitoring services from Equifax were among those whose credit-card information was stolen as part of the data breach.

Equifax said that in addition to the 143 million Americans whose personal information was potentially accessed, “credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed.”

Equifax did not disclose what kind of “personal identifying information” the dispute documents contained, nor did it respond to a request for comment. On its website, however, Equifax says that when people request a dispute, fraud alert, security freeze or disclosure, they need to provide additional identifying information from a list that includes a W-2 or 1099 form, driver’s license, pay stub, passport, cell phone bill or bank statement.

These consumers could be at greater risk of identity theft because “the more data an attacker has, the harder it is to stop them,” said Mark Nunnikhoven, a vice president with Internet security company Trend Micro.

The IRS, working with state tax agencies and the tax-preparation industry, has also initiated behindthe-scenes measures the agency won’t discuss because it doesn’t want to tip off identity thieves.

Thanks to such measures, the IRS said the number of people who filed affidavits with the agency saying they were victims of identity theft fell by more than half — to 237,750 in the first nine months of this year compared to 512,278 the same period last year. It also saw a nearly 50 percent drop in the number of fraudulent returns that made it into the IRS tax processing systems and a 50 percent drop in the number of suspect refunds stopped by banks and returned to the IRS.

“It will be interesting to see what the statistics are at the end of 2017 to see if they could reduce or stem the fraud,” Nunnikhoven said.

Consumer advocates are encouraging taxpayers to file early to prevent thieves from getting the jump on them. But taxpayers don’t always have all the information they need to file as soon as tax season starts. Filing early and amending later can be a big hassle. Consumers could also reduce their risk by thinking twice about what information they share on social media.

In the past, thieves have gained enough information, from social media or elsewhere, to pose as a trusted supplier or key executive in the company and send an email to human resources asking for all employees’ W-2 information, Nunnikhoven said.

Consumer advocates are encouraging taxpayers to file their tax returns early to prevent thieves from getting the jump on them.