Who’s giving crooks your tax information? Could be your preparer–or your boss

fraud, scam, theftThe IRS is reporting a 400 percent increase this year in malware and phishing scams as crooks try to get their hands on your tax data. Some of the scams target tax preparers, with emails that try to fool them into downloading bogus client documents or clicking on supposed links to the IRS. And some of the bad guys are going straight to your boss, reports the National Association of Enrolled Agents:

As if there weren’t already enough schemes out there to steal your identity, crooks have a new scam involving gaining access to employees’ tax forms W-2. In this scenario, emails are sent to human resources departments, supposedly from high-ranking company executives, requesting W-2s for a list of employees. Those forms have personal data that includes social security numbers. The scam was successful recently at Snapchat, a social media company in Venice, CA. Someone posing as Chief Executive Evan Spiegel requested W-2 data for nearly 700 current and past employees. Shortly after the information was sent, the HR employee became suspicious, but the information was already in the wrong hands.

Some of the stolen data is used to file phony tax returns and collect refunds. Other times it’s used to fuel imposter scams, where criminals posing as IRS agents threaten you with lawsuits or jail. Keep in mind that your first contact with the IRS over a problem won’t be a phone call or an email. The agency still uses old-school snail mail to notify taxpayers of problems.


Lies, damn lies and press releases

Customer Support liarA recent press release from an “identity theft protection company” was so filled with misinformation, I had to double-check make sure it wasn’t April Fool’s Day.

Here’s what it said:

The Federal Trade Commission believes ID Fraud will be a significant issue during this tax season. Many people will consider freezing their credit report if they fear they’ve been a victim of ID Theft but national ID theft protection company, Protect Your Bubble, says consumers may want to be patient before going through the the credit freeze process.

Reasons To Rethink Freezing Your Credit During ID Fraud Scare

Here are some reasons you may want to consider for any stories you might be planning around tax season:

  • If you do put a freeze on your credit report it can take up to a month for the credit bureaus to do the unfreeze

  • During a freeze, all credit cards are frozen

  • Your debit card may also be impacted

  • Consumers may need to go to a cash lifestyle even to pay bills

  • All of your automated bill payments are then frozen and that can negatively impact your credit even further if/when you miss payment

It goes on, but each of those bullet points is patently, demonstrably untrue. In reality:

  • Unfreezing a credit report takes a few minutes by phone or online. Credit bureaus have to respond to written requests within three days.
  • Credit cards are not affected by a credit freeze.
  • Debit cards are not impacted by a credit freeze (freezes apply to credit reports, not bank accounts).
  • There’s no reason to go to cash when your credit and debit cards still work.
  • Automated bill payments aren’t affected, since neither your credit cards nor your bank accounts are altered by a freeze.

When I asked the public relations person who sent out the press release to explain, I got back an apology for for “miswording the bank/credit card payments in the pitch” but then she repeated some of the [baloney]:

If they [individuals] are alerted to the fact that they may have been a victim of ID Theft, they should not rush to freeze their credit report since it can be a lengthy process to unfreeze. Due to the growth in phishing scams consumers need to be cognizant of the realities of what may or may not be taking place.

Um, what?

I tried again, contacting the company itself. This is what I got back:

Upon reviewing the press release, we see how the statement about the payment of bills and credit cards when a credit report is frozen was misleading. You’re correct: A frozen credit account will not prevent you from paying bills. But, I think it’s important to point out that consumers will have a difficult time applying for a new credit / debit card while their account is frozen. In any case, consumers should check with their financial institutions and creditors to verify their unique policies.

I’m not sure why you’d have trouble getting a debit card, unless you were opening a new account and the bank ran a credit check. But the fact that you have to unfreeze your credit reports if you want to apply for a new credit card is indeed a potential downside. It’s a potential downside that wasn’t even mentioned in the press release, however. And the statements weren’t “misleading.” They were wrong. As in “Holy cow, we blew it, this is embarrassing” wrong.

Credit freezes are something you should consider if you’ve already been the victim of identity theft or you’re at high risk because your Social Security number has been stolen or exposed in a breach. Credit freezes pretty much prevent new account identity theft, where someone opens new credit accounts in your name. If you’ve got a freeze in place, you likely won’t need “identity theft protection,” which is an oxymoron anyway because the companies can’t protect you from anything; at best, they can give you early warning and help you clean up the mess. The press release’s suggestion that you hold off on a freeze “until there has been an activity reported against you specifically” is rather witless. Waiting for the bad guys to steal your credit after they’ve got their hands on the keys is like closing the barn doors after the horses have fled.

Credit freezes come with costs. You typically must pay to freeze and unfreeze your reports ($2 to $15 per bureau, depending on your state law, for each freeze and thaw). If you’re planning to apply for credit, change insurers or wireless carriers, or start utility service, you have to remember to thaw your report so those providers can have access. So there’s a hassle factor, but credit freezes won’t mess up your day-to-day financial life.

A final thought: The press release mentions tax season identity theft, a reference to the fact that identity thieves are filing phony tax returns right and left. But nothing–not a credit freeze, and certainly not an “identity theft protection company”–can protect you from that crime. That’s what’s so awful about it. For more, read my Reuters column, “Why identity thieves are targeting your tax return.



Want to protect yourself from tax return theft? You can’t.

Zemanta Related Posts ThumbnailA surge of bogus tax return filings has highlighted a grim truth: We can’t protect ourselves from this rising threat.

An underfunded, understaffed IRS manages to thwart many attempts, but still sent more than $5 billion in refunds to identity thieves in the 2013 tax year. Most state tax agencies aren’t nearly as sophisticated in detecting fraud, which is why the bad guys seem to be targeting them this year.

The core problem is that the key to your tax refund–as well as to your credit and your health records–is your Social Security number, which was never intended as an all-purpose identifier.

Even if you’re vigilant in protecting your  number, you’re still at risk, because a lot of companies aren’t so vigilant.

Court Ventures, now a subsidiary off Experian, sold an unknown number of records including Social Security numbers to identity thieves from a database of 200 million files. Anthem’s breach exposed 80 million people’s records. And they’re hardly the only ones. The US Postal Service, University of California Berkeley, the Oregon Employment Department, dozens of hospitals and medical centers–the list of places Social Security numbers have been stolen goes on and on and on. (Check out the Privacy Rights Clearinghouse chronology of breaches, showing more than 1 trillion records have been compromised.)

You may be able to beat the thieves to your tax refund by filing early–but that boat has already sailed for many victims.

Read more in my Reuters column, “Why identity thieves are targeting your tax return.”