Liz Weston

Dear Liz: My CPA sent my completed tax return to my home address via first-class mail with no tracking number. The large envelope should have arrived in two days. Over a week has passed and it’s nowhere in sight. I am freaking out as it has all my financial data and is a gateway to fraud of every sort!

The various post office officials have really done nothing to assist in its location. I have credit freezes at all three bureaus and my bank accounts require passwords. What else can I do to try to avert disaster? I have been so distraught it has literally made me ill. And before you say it, yes, this mode of transit will never happen again.

Answer: It shouldn’t have happened in the first place.

With so much identity theft and tax refund fraud these days, it’s astonishing that tax preparers continue to send sensitive, personal information through the U.S. mail with no tracking — and in envelopes helpfully marked with the CPA firm’s name to make the returns easier for thieves to spot.

Your credit freezes should prevent identity thieves from opening new credit accounts in your name using purloined information, but they won’t stop tax refund fraud.

There’s typically not much you can do to protect yourself from this crime. People who have already been the victims of such fraud can request an “identity protection personal information number” or IP PIN from the Internal Revenue Service to prevent future fraudulent filings.

The IRS also allows residents of Florida, Georgia and the District of Columbia to request IP PINs as part of a pilot program, but residents of other states aren’t eligible.

You can try to file as early in the year as possible, but that’s no guarantee a criminal won’t file using your Social Security number first — and then it can take months to get any money you’re owed.

To help protect your bank accounts, see if your bank offers something called “two-factor authentication.” Two-factor authentication requires something you know, such as a password, plus something you have, such as a token that creates unique number codes or code that’s texted to your cellphone.

If your bank doesn’t offer this layer of protection, and only ascertains your identity with the use of security questions, strongly consider moving your accounts to another bank.

Security questions are easy to hack, as evidenced by the massive breach of the IRS’ Get Transcript service, where hackers were able to successfully answer the security questions for hundreds of thousands of taxpayer accounts.