IRS tax return scams are nothing new. While there’s been a small decrease in the number of fraud investigations launched by the IRS in 2017 compared to earlier years, they remain an annoying issue for taxpayers every March and April. Scammer will pose as another person, file taxes on their behalf, and claim their tax refund. They will often phish unsuspecting consumers by phone or email. This tricks them into revealing personal information so they can impersonate them. Remember, the IRS does not notify people by phone, so if you get a call claiming to be from an angry IRS rep, it’s a fake. But, as annoying as these scams can be, they aren’t the most worrisome issue facing taxpayers.
A more serious problem in 2018 is that hackers may already have bought or stolen your Social Security Number (SSN) from one of the many data breaches over the past few years. There have been enough major data breaches like Yahoo and Equifax that involves SSNs that they should no longer be considered secure. Criminals can buy and sell personal info on the Dark Web, and data dumps from old hacks are often released for free or for extremely cheap after enough time has passed. This means that the SSNs from a single data breach can spread far and wide on the underground internet and could be in the hands of many different malicious actors.
The IRS has begun to address this problem. They offer a six-digit number called an IP PIN to select taxpayers who are at risk of their SSN being misused. This number replaces that taxpayer’s SSN when confirming their identity and can be used even if their SSN is compromised. If you have the option of signing up for one, we highly recommend doing it. This is a good short-term solution and hopefully it will be expanded.
But in the long term, the United States needs a replacement for the SSN. This replacement ID should include digital certificates. The phrase “national ID” might sound unsettling, but the reality is that a simple number is too basic of an identification method in a digital world. Estonia has a digital identity system and other countries like Singapore are moving in that direction. The only way to permanently solve the problem of tax return fraud (and other issues around stolen identities) is to use a more secure method of identification than SSNs.
Read more about tax fraud and how to prevent it here on Secplicity, or dig deeper into cloud security to learn how some of the SSN data breaches could have been prevented.