In 2014, 17.6 million Americans fell victim, and cybercriminals made off with $15.4 billion (download PDF ). And tax refund theft remains a lucrative piece of that business, despite the IRS' efforts to stamp it out.
How do hackers do it? In one scam, they filed bogus returns with information harvested from the IRS' own files or by using Social Security numbers. Then they waited for the direct-deposit refunds to flow in. Victims usually didn't know anything was wrong until the IRS refused to accept their tax returns.
Always use security software with firewall and anti-virus protections, as well as strong passwords. If you're using online software to file your taxes, make sure your password is secure and think about changing it annually.
Learn to recognize phishing emails, calls and texts from thieves posing as legitimate organizations, such as your bank, credit card company and even the IRS. The IRS will never try to contact you via phone or email. Additionally, don't click on links or download attachments from emails if you don't recognize the sender.
Know how the IRS works. The IRS will never
—ask you to pay by wire transfer or gift card
—ask for credit or debit numbers over the phone
—demand payment without giving you time to review the amount
—make arrest threats.
The best way to know you're really dealing with the IRS is to contact them directly through their site or their listed phone numbers.
Protect your personal data. Don't routinely carry your Social Security card, and make sure your tax records are secure.
If you think someone used your information to file a return, contact the IRS immediately. Specialists will help you file your tax return, receive any refund you're due, and protect your account from identity thieves in the future.
Thanks to technological enhancements, the IRS now receives warnings if a large number of returns come from a single computer address within a short period of time.
This allows the IRS time to recognize that more than one return has been filed for the same Social Security number. Previously, the IRS issued e-file refunds seven to 10 days after it received a return. The new target is 21 days.
Businesses had been required to issue wage and payment statements to workers by Feb. 1, but didn't need to file them with the IRS until June. Now both will be due by Jan. 31.
Intuit, which makes TurboTax, and H&R Block have agreed to share more information more promptly with the IRS about filings they consider suspicious.