Client Data is ‘Precious Commodity,’ IRS Warns Tax Pros

The IRS building is seen in Washington on Sept. 28, 2020. Erin Scott/Reuters

The IRS has issued a warning asking tax professionals to watch out for “identity theft red flags” as criminals attempt to steal clients’ sensitive data.

“Tax professionals have a precious commodity that identity thieves desperately want—client tax information. With stronger fraud defenses put in place by the IRS and Security Summit partners, identity thieves need this essential information to help complete their crime,” the agency said in an Aug. 8 news release. In case tax professionals identify an identity theft issue, they should “immediately” contact the IRS as well as insurance or cybersecurity experts to determine the cause and extent of loss.

The agency advised tax professionals to watch out for the following warning signs from their clients to determine if there is an identity theft risk:

• Clients receiving notice that an IRS online account was created without their consent, or that the IRS disabled their account or someone accessed their account without their knowledge.
• Clients receiving a tax transcript they did not request.
• Clients receiving “balance due” or other IRS notices which are incorrect based on the tax return they have filed.
• Clients responding to emails or calls that their tax consultant did not initiate.
• Clients receiving tax refunds even though they have not filed their return.

The IRS asked tax pros to watch out for slow or unexpected computer actions like software taking longer than usual to process; computer cursor moving without the mouse being touched; and getting locked out of a system or network unexpectedly.

If the tax returns of clients are rejected because their social security number was used on another return, it should be seen as a red flag by tax professionals, the IRS states.

Getting IRS authentication letters even though a tax return has not been filed is also a matter of concern. So is getting more e-file receipt acknowledgments than what has been filed by the tax professional.

Tax identity theft is an issue that affects hundreds of thousands of American taxpayers. Identity thieves use the stolen information to file fraudulent tax returns or sell the data to other fraudsters.

According to a May 10 report by the U.S. Treasury, the IRS identified almost 1.1 million tax returns as being potentially fraudulent for the 2023 filing season as of March 2. The 1.1 million potentially fake returns had a refund claim totaling around $6.3 billion.

The IRS had confirmed 12,617 tax returns as fraudulent, preventing the issuance of $105.3 million in refunds to identity theft criminals.

“It’s important for tax professionals to protect their systems from identity thieves who always look for new methods to steal data,” said IRS Commissioner Danny Werfel, according to the release. “There are practical ways for practitioners to keep on top of the latest trends and signs of data and identity theft.”

Dealing With Security Breach

When theft of client data is identified, tax professionals should determine the type of data breach. Hackers may have stolen data by pretending to be someone that an employee at the tax service trusts and thus gained data access details.

Criminals may have resorted to brute force attacks to break into the service’s systems. They could have also used an existing vulnerability or security flaw in the network to steal data.

Tax professionals must identify the information that was compromised and the time period when the breach occurred.

In case a tax pro determines that they have been a victim of data theft, they should report the matter to a local IRS stakeholder liaison, the details of which can be found on this webpage.

“Speed is critical. IRS stakeholder liaisons will ensure all the appropriate IRS offices are alerted. If reported quickly, the IRS can take steps to block fraudulent returns in the clients’ names and will assist tax pros through the process,” the agency warns.

Professionals can also send an email to the Federation of Tax Administrators at [email protected].

In addition, the tax service should check with their insurance firms to see if the policy covers data breaches. The Federal Trade Commission (FTC) can provide guidance on how to handle breach situations.

When notifying clients, tax professionals must inform them about the data that was stolen, the impact it can have, what is being done to deal with the breach, and what clients must do to tackle potential identity theft issues.

Massive Tax Identity Theft

The IRS warning to tax professionals comes as seven individuals were charged in early March for a stolen identity tax refund scheme that sought to collect $100 million from the IRS.

The conspirators are alleged to have stolen the identities of accountants and taxpayers by filing at least 371 false tax returns claiming over $111 million in refunds from the tax agency, according to a March 13 press release by the Department of Justice (DoJ).

Fraudsters used the stolen data of taxpayers and tax preparers to approach the IRS as authorized agents of the taxpayers.

“The conspirators then allegedly directed the IRS to change the addresses on file for the taxpayers and to send their tax information, including account transcripts and wage records, to the addresses controlled by the conspirators,” according to the release.

Then, they “used this information to electronically file tax returns claiming fraudulent refunds and directed the IRS to split the refunds among several prepaid debit cards.”

“Prior to issuing tax refunds to some taxpayers, the IRS allegedly sent verification letters to the addresses controlled by the defendants, and the defendants and others, pretending to be the taxpayers, instructed the IRS to release the refunds.”