Ask Liz Weston

Get smart with your money

Identity Theft

Q&A: Another way to get help with a stubborn IRS problem

By Leave a Comment

Dear Liz: I read your advice about what to do when a refund is delayed. We overpaid our 2025 federal taxes by $16,200. It was the first year my husband was retired and we wanted to make sure enough tax was withheld from his pension.

Our professionally prepared, e-filed return should have been very simple. Yet, like your letter writer, we were at first asked to confirm our identity, then on June 1 we were told to wait two more months, and since then we’ve heard nothing.

My husband was able to get through on the phone. They apologized for “ghosting us” and told us to wait until early November, because they are investigating “income and withholdings.” Yeah, right. The Taxpayer Advocate Service did not want our case because we cannot prove a severe enough financial hardship, but this is affecting our budget. Any suggestions? Our congressman’s office never returned our message.

Answer: Try one of your U.S. senators. Like congressional representatives, they have constituent services teams dedicated to helping people resolve problems with federal agencies.

The IRS asked you to verify your identity because something about your return raised concerns about possible fraud. Your personal information may have been exposed in a data breach, your return may have differed substantially from previous years or someone else may have filed a return using your Social Security number. It’s also possible your return was simply selected for additional review.

Once you verified your identity, though, your refund should have been processed. Yours has gotten stuck in the agency’s gears somewhere, so it’s time to get help (and maybe cast a vote against your current representative in November’s election).

Q&A: How to protect QCD checks from mail theft

By 1 Comment

Dear Liz: In response to a reader whose check to the IRS was stolen from the post office, you (again) warned readers that mail theft and check fraud have soared and that electronic payments are now the safest way to send money.

I’ve been making my charitable donations using qualified charitable distributions from my IRA. My brokerage does this by mailing me a check in the amount I request, payable to my charity. I then mail the check to the charity.

It seems risky, but it is the only way I can use the QCD option to donate untaxed dollars. Is there a safer way to do this?

Answer: You’ve touched on an unfortunate reality. People are being warned not to mail checks because of rampant theft, yet brokerages still rely on sending physical checks for certain transactions such as qualified charitable distributions or 401(k) rollovers.

Since you can’t eliminate the risk with electronic transfers, see if you can eliminate at least one trip through the mail. Ask if the brokerage will mail the check directly to the charity, rather than sending it to you first. If that’s not an option and the charity is local, you could hand-deliver the check.

Another possibility is to find out if your IRA offers check-writing privileges. If it does, you could write the check directly to the charity. Use indelible black gel ink, which is harder to remove than regular ballpoint ink, and consider sending the check by certified mail so you can track its delivery.

You also should closely monitor your account to make sure the check gets cashed. IRA checkwriting agreements can require customers to report missing or fraudulent checks promptly. Waiting too long could jeopardize your ability to recover a loss.

As you know, qualified charitable distributions allow people 70½ and older to transfer money directly from an IRA to an eligible charity without including the distribution in taxable income. To count for that tax year, though, an IRA check must clear by year-end. Make sure the check is sent before December to leave plenty of time for the charity to receive and deposit it.

Q&A: What do you do when an ex takes out a credit card in your name?

By

Dear Liz: My ex-husband took out a credit card in my name without my knowledge. By the time I discovered it on a credit report, he had over $14,000 in charges on the card. I was able to close the credit card, but cannot remove my name and Social Security number from the account. My ex refuses to pay off the credit card nor does he make payments on the card as a judge ordered him to do in court six months ago. I have called the issuing bank, visited in person, spoken with everyone that I can, to no avail. The best they can do is flag the card for fraud. Since the credit card is not being paid off, it is damaging my credit score. Do you have any advice?

Answer: Report the crime to your local police and file an identity theft complaint with the Federal Trade Commission at IdentityTheft.gov. The police report means your ex could be arrested and prosecuted for his crime, but without it you may not be able to get your credit restored.

Submit copies of the police report and the FTC affidavit to the bank, along with a letter explaining the situation. Make it clear that you are the victim of identity theft, that the account is fraudulent and that the bank should remove your personal identifying information when reporting the account to the credit bureaus.

Next, dispute the account with each of the three major credit bureaus. You can get free access to your credit reports at AnnualCreditReport.com. (Type the full address into your browser to make sure you don’t land on a lookalike site.) While you’re at it, freeze your credit report at each bureau. There’s no better way to prevent criminals from opening new credit accounts in your name. Freezing your credit report is free, and you can temporarily remove the freeze without cost whenever you want to apply for credit.

Q&A: Relative’s oversharing puts family at risk

By

Dear Liz: Your recent column on identity theft touched a nerve. My husband and I are very cautious about online security and don’t post details on social media that could be used in identity theft. But his mother constantly overshares, has no privacy filters on her accounts and ignores our requests to avoid posting our children’s names or our birthdays. Last week she posted “Happy 7th birthday to my beautiful granddaughter Bailey!” So now the world knows our daughter’s name and exact birth date. How can we get her to stop?

Answer: Older generations sometimes poke fun at younger generations for documenting every detail of their lives on social media. But many older folks ignore a basic rule of internet etiquette, which is that you shouldn’t post about others without their consent. Children, especially, need to be protected from exploitation by identity thieves, cyber bullies, sexual predators and data-mining tech companies. Your mother-in-law clearly doesn’t understand the hazard she’s creating, but her desire for attention does not outweigh your need for privacy or your right to protect yourselves and your children.

Now, first things first. Your mother-in-law may not understand how privacy settings work, so your husband could offer to help her set those up. That alone can help limit the damage she can inflict.

Next, consider having a face-to-face conversation with her where you and your husband calmly explain your concerns and repeat your request that she refrain from posting your private information. (Your husband may need to solo on this one if your relationship with her is contentious.) Focusing on her past mistakes could make her defensive, so consider framing this with “we” statements such as “We’ve made the decision to keep private details off the Internet to protect our children from predators and reduce our vulnerability to identity theft.”

Clearly explain the consequences if she ignores the request. You and her husband will need to discuss this beforehand, obviously, but the repercussions should be significant enough to communicate how important this is. With some grandparents, the idea of you no longer sending photos and details of the grandkids’ lives may be enough. With others, you may need to limit all contact.

Q&A: How do I protect myself from identity theft?

By

Dear Liz: I am regularly notified by my identity theft protection service that there has been a data breach somewhere where my data is stored. I don’t know what in the world I’m supposed to do about this. I try to follow all the recommended precautions, but I also wonder: now that all Social Security data is somewhere in the cloud under some mystery person’s control, is it even worth trying to keep up?

Answer: You’ve discovered the oxymoron inherent in an identity theft protection service. Such companies can’t actually protect you from identity theft, and knowing your data has been compromised is of limited value if you can’t actually do anything to prevent its misuse.

Focus instead on what you can do to make yourself less of a target. Start by freezing your credit reports at the three major bureaus: Equifax, Experian and TransUnion. Credit freezes are free and make it hard for identity thieves to open new credit accounts in your name. You can easily and quickly “thaw” your reports temporarily if you need to apply for credit.

You’ll still need to monitor your credit reports for suspicious activity, and you can request free reports from AnnualCreditReport.com. (Type that name directly into your browser. If the site asks for a credit card, you’re in the wrong place.)

Get serious about online security. Create unique passwords and use multi-factor authentication wherever it’s available, but especially on financial, email and social media sites. Consider using a virtual private network to further protect yourself. Erase all personal data from phones and other gadgets before discarding.

Prevent tax refund fraud by getting a free Identity Protection PIN from IRS.gov. You’ll need to use the PIN to file your tax return, but that should prevent someone else from ginning up a false return and claiming a refund using your ID.

Limit the information you share on social media and elsewhere. Keep your birthday, your pets’ names and your children’s names private. Learn how the privacy features work on the sites you use. Look for options to disable location sharing, limit access by strangers and manage which third-party apps can access your account.

Finally: monitor, monitor, monitor. Regularly review every financial account for suspicious transactions and report any you find immediately. Check medical statements and health insurance records for unauthorized activity as well.

Q&A: Safeguarding your personal data is hard. Here are a few tips.

By

Dear Liz: I was recently alerted that my Social Security number has been found on the dark web. My information was part of the AT&T breach that took place recently. I am no longer an AT&T customer and haven’t been for several years, but they have not made any contact with me. What do I do to keep myself safe and how do I get my information removed from the dark web? Why hasn’t AT&T reached out to me?

Answer: As a consumer, you don’t have much power. Companies often demand your personal data, such as Social Security numbers, before they’ll do business with you. Once your information is in their databases, you have no control over what happens to it. And if your information is leaked, there’s no way to remove it from the dark web.

You can’t even be sure how your information got there, given the sheer volume of database breaches in recent years. If you’re an adult with a Social Security number, chances are pretty good that number can be found on the black market sites where criminals buy and share information, says Eva Velasquez, chief executive of the Identity Theft Resource Center, a nonprofit that helps identity theft victims.

In other words, your data may have been compromised long before the latest incident, which AT&T says affected 73 million current and former customers. AT&T began notifying impacted customers via letters or email starting in April. Those customers should have received an offer for free credit monitoring.

There are a few things you can do to make yourself a bit less vulnerable to identity theft, such as putting freezes on your credit reports, not clicking on links in texts or emails if you didn’t initiate the transaction and using digital wallets or other secure payment methods.

Also, don’t be your own worst enemy. Beware of sharing personal information (birth dates, address, phone number, etc.) on social media. Consider limiting your audience to people you know and trust, Velasquez says.

The Identity Theft Resource Center also recommends using passkeys, a technology that replaces passwords, whenever you’re offered that option. If a passkey is not available, the center suggests using passphrases of 12 characters or more rather than shorter passwords. A passphrase is a sequence of words that can be personalized for easier memorization, typically with numbers added and a mix of capital and lowercase letters. The center gives an example of a passphrase for a 2015 University of Texas graduate: “H00kEmH0rns2015.” You’ll still need unique passphrases for every account and site. You also should turn on two-factor authentication or multi-factor authentication where available. This requires an extra step, such as getting a code on your phone or from an app, but this will make your accounts harder to compromise.