The following is an article published March 2, 2016, by Michael Cohn of Accounting Today.
Many of the special personal identification numbers given out by the Internal Revenue Service to protect victims of identity theft may have been stolen, according to a security research site.The site Krebs on Security reported Tuesday that a South Dakota CPA, Becky Wittrock, had her Identity Protection PIN stolen. She works as CFO at GeoTek Engineering & Testing Services in Sioux Falls. The IRS issued her an IP PIN in 2014 after her identity was stolen and thieves tried to file tax returns under her name. However, when she tried to use the IP PIN to file her taxes this tax season, she learned that identity thieves had struck again and filed a tax return using her IP PIN. She contacted the IRS and was asked a long series of security questions. She discovered someone had filed a return in her name only three weeks earlier and claimed a large tax refund.
Related read: IRS Identifies and Halts Recent Threat to its E-file PIN Application
“The guy said, ‘Yes, I do see a return was filed under your name on Feb. 2, and that there was the correct IP PIN supplied,’” Wittrock told Krebs On Security. “I asked him how can that be, and he said, ‘You’re not the first, we’ve had many cases of that this year.'”
In addition to informing her there were many such cases, the IRS representative told her that it would not be using the six-digit IP PIN next year and would use a different authentication method next year.
Accounting Today asked an IRS spokesman for comment and received the following statement, referring back to a data breach last year involving the IRS’s online Get Transcript app, which affected hundreds of thousands of taxpayers (see IRS Finds ‘Get Transcript’ Data Breach Was More Widespread).
“After the Get Transcript incident last year, we began a review of IRS.gov tools that use e-authentication procedures, including the IP PIN application,” said the IRS statement. “Unlike Get Transcript, the IP PIN tool is available to a limited number of taxpayers who must have special markers on their tax accounts to successfully access the tool. Most taxpayers receive their IP PIN via mail and never use the tool. For certain taxpayers, the tool is their only alternative to access an IP PIN. This includes IP PIN holders who lose their numbers, taxpayers in our pilot locations and taxpayers we invite to use IP PIN because they have non-tax identity theft issues.
We recognized additional safeguards were needed for the IP PIN application, given the amount of personally identifiable information already in criminals’ hands. This filing season, we took appropriate actions in our processing systems and filters to identify and stop those fraudulent returns with IP PINs obtained from the tool. There are extra protections for taxpayers with IP PINs inside our processing systems. The IRS has a number of protections to monitor traffic on IRS.gov, and we continue to closely monitor the IP PIN situation.”
Related read: IRS Alerts Payroll and HR Professionals to Phishing Scheme Involving W-2s
Staying up-to-date on the latest threats to security and your identity can be confusing and time consuming. Our tax team receives notice directly from the IRS, allowing us to communicate to you as quickly as possible.
If you have any questions about your IP-PIN, identity theft, tax return fraud or risk, please contact me directly at hkass@zinnerco.com or any of our professionals at 216-831-0733.