The 2018 tax prep season is in full swing, and so are hackers who smell easy money. Shortly after January 29, 2018 when the Internal Revenue Service (IRS) opened its e-filing system, a new twist on tax-related identity theft surfaced. The new scam leaves victims on the hook for paying the IRS back for fraudulent tax returns.
How the Scam Works
The first red flags surfaced when a number of tax preparers were hacked by crooks reportedly using phishing emails to infect preparers’ computers and steal client files. Days later, according to an IRS alert, the IRS received and processed bogus tax returns filed under those victims’ names.
If you’re a victim, the first twist occurs when a bogus refund is sent to your legitimate bank account or mailbox. Unfortunately, that deposit is no cause for a spontaneous vacation.
Once the refund is received, the scam takes one of several possible directions. In the first variation, crooks call you posing as a collection agency representing the IRS. You’re directed to transfer the funds to a specific account, but you can be assured it never reaches the government. When the IRS discovers the erroneous payment—and they will—you owe the government a refund!
A second approach involves an automated phone call allegedly from an IRS agent. It threatens criminal fraud charges, arrest, and the “blacklisting” of your Social Security number (SSN). The call wraps up with a case number and telephone contact details to refund the cash. The IRS will never make this type of call as an initial method of contact, so don’t succumb to these strong scare tactics.
How to Return that Deposit
There’s a right way to give back a fraudulent tax refund to make sure you don’t put yourself in financial jeopardy. The method depends on whether the deposit was made electronically or you receive a paper check. The IRS offers step-by-step directions on the process. You may have to call the IRS to report the problem, so be prepared to meet their stringent identification standards. One more heads up: you may also owe interest on the erroneous refund under federal law.
How to Protect Yourself
The #1 takeaway from this new scam is that you need to guard your banking data—both routing number and unique personal account data—just as completely as you guard your SSN. This means thinking twice before writing someone a check. A personal check contains full bank account details except for your password. Depending on who you’re handing the check to, it may wiser to pay by credit card.
Another good idea is to set a banking alert to notify you when deposits are made, and make sure you resist temptation and never cash any unexpected refund checks you might receive in the mail.
Ask your tax preparer about their security protocol for your sensitive data. It should be more than a locked filing cabinet and should include training to identify and help block scams.