A surge of bogus tax return filings has highlighted a grim truth: We can’t protect ourselves from this rising threat.

An underfunded, understaffed IRS manages to thwart many attempts, but still sent more than $5 billion in refunds to identity thieves in the 2013 tax year. Most state tax agencies aren’t nearly as sophisticated in detecting fraud, which is why the bad guys seem to be targeting them this year.

The core problem is that the key to your tax refund–as well as to your credit and your health records–is your Social Security number, which was never intended as an all-purpose identifier.

Even if you’re vigilant in protecting your  number, you’re still at risk, because a lot of companies aren’t so vigilant.

Court Ventures, now a subsidiary off Experian, sold an unknown number of records including Social Security numbers to identity thieves from a database of 200 million files. Anthem’s breach exposed 80 million people’s records. And they’re hardly the only ones. The US Postal Service, University of California Berkeley, the Oregon Employment Department, dozens of hospitals and medical centers–the list of places Social Security numbers have been stolen goes on and on and on. (Check out the Privacy Rights Clearinghouse chronology of breaches, showing more than 1 trillion records have been compromised.)

You may be able to beat the thieves to your tax refund by filing early–but that boat has already sailed for many victims.

Read more in my Reuters column, “Why identity thieves are targeting your tax return.”