PINs can beat tax payment fraud

Tax payments are just as prone to fraud as any other payment.

The IRS states there were 649,000 confirmed fraudulent tax returns attempted to obtain $3.1 billion in refunds in 2018. With more than eight billion records exposed in 2019, cybercriminals already have the personal data necessary to impersonate a hefty percentage of Americans filing.

If they don’t have the information needed, they’ll likely launch a phishing attack to steal remaining details, with the IRS has warning that phishing is one of the most common scams during tax season. In fact, cybercriminals have already begun scheming this year, launching a phishing campaign targeting ADP users, informing them their W-2 forms are ready and prompting them to click a malicious link. The link then redirects them to a site asking for extremely sensitive data that can have critical consequences if entered.

Unfortunately, hackers don’t require that much personal information. Many attackers will fake W-2 information, such as income, while being careful that the amounts aren’t suspicious enough to be flagged. Anyone can be susceptible to tax fraud, and the only time a person finds out that they’ve been a victim is when their return gets subsequently rejected at filing.

It's also critical for preparers or tax payment companies to be extra vigilant when it comes to potential phishing and other social engineering attacks, such as phone calls about a stolen Social Security number or pending lawsuit. As an extra layer of security, providers can use a tax PIN as a secondary factor of authentication when filing returns. Those that have experienced fraud in the past automatically receive a PIN from the government.

When filing taxes, it’s important to use a trustworthy accounting firm or a well-known and secure tax software. And if one does use a tax software, users should be sure to doublecheck the URL to ensure they are on the appropriate site (e.g., turbotax.com, not turb0tax.com). If there are any doubts, it’s best not to file via that system. But the precautions are worth the trouble. Recovery from tax fraud is a long, arduous process that can easily take more than a year to recover from. A breach doesn’t just cost victims their money — it also costs precious time.