Tax refunds are often a financial boost for Americans, but they’ve increasingly become the target of scammers who can use your identity to recover whatever money is owed by Uncle Sam.
Last year, the IRS received 294,138 complaints of reported identity theft, the second most in its history. The most was 328,591 in 2021, which reflects the massive surge of cybercrime that spiked in the middle of the Covid-19 pandemic.
In order to process your tax return, the IRS asks for some personal information to verify your identity, including your home address and Social Security number. In an ideal world, no malicious actors would have that information. Unfortunately, there are more data breaches almost every year, and the online cybercrime ecosystem is rife with criminals who trade and sell Americans’ data.
While the Internal Revenue Service is getting better at stopping tax identity theft with its own internal filters, you’re much more likely to avoid becoming a victim if you take some security precautions into your own hands. That means filing your taxes quickly, signing up for the IRS IP PIN program and staying vigilant to avoid falling for scammers who falsely claim to work for the agency.
That means you should assume scammers who want to file a false tax return in your name already have all the information they need to do so, said Eva Velasquez, the CEO of the Identity Theft Resource Center, a nonprofit that helps victims of identity theft.
“With the state of data breaches, we should all be operating under the assumption that all the data necessary to file a fraudulent tax return in your name is out there,” Velasquez says.
Stop tax ID theft before it starts
Many victims only learn they’ve been scammed when they go to file their tax return and realize someone already did so in their name. That means that one of the best ways to stop fraudsters is to simply beat them to the punch and file as early as possible.
The other way to block scammers is to have the IRS send you a unique code, called an IP PIN. Similar to a two-factor authentication code, the IP PIN provides extra security by requiring a code only you should have access to.
Just because some would-be thieves may already have your personal information doesn’t mean you should make it any easier for them. Scammers have long claimed in emails, texts and phone calls to work for the IRS in order to trick people into giving out their personal information. There currently is a rise in a specific type of scam where callers will pretend to be working for a government agency, sometimes the IRS, and confuse the victim by saying they’re already experiencing identity theft, Velasquez said.
But there’s an easy way to recognize those scams: by policy, the IRS never initiates digital contact with taxpayers to ask for their personal information. Anyone who asks you for that information via text, email or social media and claims to be the IRS is lying.
The IRS also never asks for credit or debit card numbers on the phone. Even if a call appears to be coming from an official-seeming number, like the one on the IRS website, it’s easy for scammers to spoof the number they’re calling from. The IRS also exclusively accepts payment in U.S. dollars. It will also never insist you pay it via a gift card or cryptocurrency — the real agency won’t even accept those as payment.
If you’re still confused about whether someone you’re communicating with is really affiliated with the IRS, you can always call or ask the ITRC directly for free advice, Velasquez said.
If you are a victim
It’s much easier to stop tax ID theft before it happens than to recover from it. According to the Taxpayer Advocate Service, an IRS internal watchdog, as of 2023 it takes the agency an average of 19 months — more than a year and a half — to resolve identity theft cases. As of the end of September 2023, the agency still had a backlog of 484,000 of those cases, it found.
It doesn’t mean all hope is lost if someone does file a false return in your name. If that does happen, you should immediately report it to the government. The Federal Trade Commission offers a one-stop shop, identitytheft.gov, to help victims. It helps fill out the appropriate paperwork with the IRS, but also offers resources on other types of identity theft.
“If someone is experiencing tax identity theft, they could also unknowingly be experiencing other types,” says Colleen Tressler, a senior project manager at the FTC’s Division of Consumer and Business Education.
“We give recovery steps. We also explain other types of identity theft steps that people can take, for example if they found things on their credit report, how to start fraud alerts and credit freezes,” Tressler said.
