Tax Professionals Should Continue to Watch for Tax Identity Fraud Threats

• The Internal Revenue Service (IRS), state tax agencies and the tax industry want tax professionals to be on guard against new and ongoing threats involving their systems and taxpayer data.
• Scams that could lead to tax identity fraud include ones based on the pandemic, work-from-home and other spear phishing scams.
• Identity criminals may use the data to file fraudulent tax returns or sell it on the dark web for other criminals to use.
• To avoid tax identity fraud, tax professionals should know how to spot and avoid spear phishing scams, spot identity crimes that involve data theft, help clients protect themselves while working from home, create a security plan and sign clients up for Identity Protection PINs.
• To learn more, or if you think you were the victim of tax identity fraud, contact the Identity Theft Resource Center toll-free by calling 888.400.5530 or using the live-chat function on the company website idtheftcenter.org.

Tax season has come and gone. However, that does not mean tax identity fraud has disappeared. The Internal Revenue Service (IRS), state tax agencies and the tax industry recently renewed their call for tax professionals to guard against new and ongoing threats involving their systems and taxpayer data.

“The IRS and the Security Summit partners continue to advance their shared efforts to protect the federal and state tax systems from identity thieves,” said IRS Commissioner Chuck Rettig. “As we’ve increased our defenses, cyberthieves increasingly turn to tax professionals, especially smaller operations, to look for security vulnerabilities. This is a critical link in protecting sensitive taxpayer information. By taking some basic security steps, tax pros help protect against the relentless efforts of identity thieves.”

Possible Threats to Tax Professionals

The IRS, state tax agencies and the tax industry want tax professionals to watch out for emerging vulnerabilities seen by practitioners using cloud-based services. The IRS says that over the past year, identity criminals continued to use COVID-19 and work-from-home as tactics for various tax scams.

Criminals could target tax professionals with tax identity fraud schemes that are both tech and tax savvy, as well as well-funded. Scammers may trick their way or break into a tax professional’s computer system to access client data. Also, a lack of strong authentication can make the information vulnerable even if a tax professional has a client’s data stored in a secure cloud.

How Identity Criminals Use Stolen Data

There are a handful of ways criminals can use the data they steal. They can file fraudulent tax returns, making it more difficult for the IRS and the state to detect because the fraudulent returns use real financial information. Identity criminals can also sell the basic tax preparer or taxpayer information on the dark web so other criminals can file fraudulent tax returns.

How to Avoid Tax Identity Fraud

• Avoid spear phishing scams. The IRS says one of the most successful tactics used by identity criminals against tax professionals is spear phishing scams. Criminals craft personalized emails to entice tax professionals to open a malicious link or attachment. Tax professionals have been especially vulnerable to spear phishing scams from thieves posing as potential clients. Thieves may carry on an email conversation for several days before sending an email containing a link or attachment. Never click on a link or attachment without reaching out directly to the source to verify the validity of the message.
• Know how to spot tax identity fraud. Many tax professionals who report data thefts to the IRS also say that they were unaware of the signs of theft. There are many signs of tax identity fraud: 1) Multiple clients suddenly receiving IRS letters requesting confirmation that they filed a tax return deemed suspicious; 2) Tax professionals may see e-file acknowledgments for far more tax returns than they filed; 3) Computer cursors may move seemingly on their own.
• Sign up clients for Identity Protection PINs (IP PINs). The IRS now offers IP PINs to all taxpayers who can verify their identities online, on the phone with an IRS employee after filing a Form 15227 or in person. The IP PIN is a six-digit number known only to the taxpayer and the IRS. It helps prevent an identity thief from filing a fraudulent return in the taxpayer’s name. Tax professionals cannot obtain an IP PIN for their clients. Clients must verify their identities with the IRS. To do so, use the “Get an IP PIN” tool on IRS.gov.
• Create a security plan. It is a good practice, and federal law also requires paid tax return preparers to create and implement a data security plan. An information security plan protects the business and client information while providing a blueprint for action in the event of a security breach. For many tax professionals, knowing where to start when developing a written security plan presents challenges. Resources like IRS Publication 4557, Safeguarding Taxpayer Data are available to assist. 
• Help clients protect themselves whether working from home or traveling. With many organizations continuing to work from home, taxpayers may find themselves conducting their affairs – whether personal, business or financial – in a different way. Tax professionals can help their clients protect themselves by sharing information on computer security. These cyber-smart tactics protect the tax professionals and their clients.

What Consumers Can Do to Stay Safe

While scams that target tax professionals do not directly involve consumers, there are still steps one can take to reduce the risk of tax identity fraud.

• Only choose a professional tax preparer with a valid IRS Preparer Tax Identification Number (PTIN).
• Have a strong 12+ character unique passphrase for all online accounts to make it harder for criminals to break.

Contact the ITRC

Whether you are a professional and believe you fell for a tax scam or a consumer who thinks they may have fallen victim to tax identity fraud, the Identity Theft Resource Center is here to help you. You can speak with an expert advisor by calling toll-free (888.400.5530) or using the live-chat function on the company website. Just visit www.idtheftcenter.org to get started.