Chapter 9: Identity Theft and Refund Fraud. 1 09: Identity Theft and Refund Fraud

Transcription

1 Page Chapter 9: Identity Theft and Refund Fraud 1

2 Learning Objectives Page Upon completion of this seminar, participants should be able to Recognize the threats that apply to practitioners. Describe how to respond to identity theft or tax refund fraud. Identify resources available to assist victims of identity theft. 2

3 Key Developments Page The Security Summit impacts the filing season. Page 136 Additional data elements have been added to business returns for the 2017 processing year. Page 136 The New Threat, Practitioners have become the preferred target of the fraudsters. Page Surviving a data breach. Page Putting in place safeguards from a breach. Page The steps to take when your system is breached. Page 138 The response plan of the IRS. Page

4 Key Developments Page What to expect from the fraudsters after a breach. Page 139 How can we help our clients who are breached. Page What the IRS response to our clients will be. Page The notices used by IRS in processing affected returns. Page The IRS IP PIN program assignment, including on tax return, and taxpayer timeline in the program. Page

5 Page 135 I. What is Identity Theft The current mess: For the first year since the IRS started tracking fraudulent returns the number of such returns has decreased for individual returns (1040) but problems have grown with business returns. 5

6 Page 135 What are the bad guys looking for to steal identities? 1. SSNs 2. DOBs I. What is Identity Theft 3. Logins in and other sites 4. Access to computer systems to install ransom ware. Any kind of data that can facilitate the filing of a return for the purposes of obtaining a false tax refund. 6

7 Page 139 I. What is Identity Theft The problems the IRS is facing: 1. Obtaining false tax refunds 2. False tax documents that are being created: W-2s 1099s Form 1065-K-1s Form 1120, 1120S, 1065 and False employment documents. An unrelenting assault on their computer systems to obtain confidential taxpayer data. 7

8 Page 135 II. The Security Summit To assist the IRS they have formed an industry partnership with organizations that have a stake in tax filing: 1. Tax Preparation and Software Firms 2. State Tax Administrators 3. Payroll and tax financial product processors. 8

9 Page 136-Updated Info II. The Security Summit Reviewing the content of the IRS Security Summit Home Page should be part of the firm routine. irs.gov/privacy-disclosure/security-summit Much of the current focus of IRS Security Summit has switched to practitioners as they have become the target of choice by the black web. 9

10 Page 136 II. The Security Summit For 2017 returns (2018 filing year) the IRS will add several data element requirements to Forms 1065, 1120, 1120S and The Name and SSN of the company official who is authorized to sign the return. 2. Payment Histories a. Were Estimate Payments Made b. The details of those payments Dates Amounts Payment Confirmation Numbers 10

11 Page 136 II. The Security Summit For 2017 returns (2018 filing year) the IRS will add several data element requirements to Forms 1065, 1120, 1120S and If there is a parent company identify with associated details. 4. Certain information associated with deductions claim (Currently not identified). 5. Filing History, identification of other returns filed (Shared Secrets). 11

12 III. The New Threat Attacks on the Practitioner Page 136 Advice from the IRS: The Level of Threat to the Practitioner has never been greater. The practitioner reaction to a breach: Emotional Melt Down Fight or Flight Surrender (Close up the Shop) 12

13 III. The New Threat Attacks on the Practitioner Page Survival when attacked: 1. Work through the issues of identity theft with the client in partnership. 2. Help the client place a credit freeze on their account. 3. Serve as a repository of forms and documents created/obtained. 4. Optional Offering credit monitoring 13

14 III. The New Threat Attacks on the Practitioner Page 137 D. What the participants have determined about practitioner thefts, thieves are well trained on our systems: 1. Upon gaining system access they quickly determine what to do to which returns. 2. Steal data on filed returns to commit filing fraud in a subsequent year. 3. Determine ex-clients for filing in current year outside of practitioner s systems. 14

15 III. The New Threat Attacks on the Practitioner Page 137 The nature and character of firms that survive a breach: a. An annual risk assessment. 15

16 III. The New Threat Attacks on the Practitioner Page 137 The nature and character of firms that survive a breach: b. Use of an external IT expert to access risks for the firm, use a CISA, Certified Information System Auditor. searchsecurity.techt arget.com/definitio n/certified- Information- Systems-Auditor- CISA 16

17 III. The New Threat Attacks on the Practitioner Page 137 The nature and character of firms that survive a breach: c. Risk training for staff. Most failures are based on a human error. d. Obtain adequate insurance coverage. Business Owners Policy Malpractice Policy Association Policy Stand Alone Policy 17

18 III. The New Threat Attacks on the Practitioner Page What would be the size of breach, IRS says average firm breach is around 500 active clients, with each incident numbering around 4,000 5,000 record files. Expect every record in the file to be accessed. Cost of breach will be larger than anticipated. 18

19 Tax Identity Theft has been Refocused Increasingly practitioners have been the victims of ID theft with the breach of their IT systems. By a show of hands: A.IRS insists on immediate reporting to the service by the practitioner. B.Will work with the practitioner to coordinate a response. C.Request that the practitioner provide a complete list of all taxpayers in their database. D.All of the above. 19

20 III. The New Threat Attacks on the Practitioner Page 138 The practitioner response: 1. Cancel the FEIN immediately. 2. Furnish an all inclusive list of all clients to IRS ASAP. 3. Get in touch with firms insurance carrier. Oops most firms do not have coverage. 4. Notify the attorney general s office in every state firm has filed any kind of return. 20

21 III. The New Threat Attacks on the Practitioner Page 138 Upon being notified of a breach by a practitioner, FYI a requirement of Publication 1345, the E-File requirements handbook. 21

22 III. The New Threat Attacks on the Practitioner Page 138 Publication 1345 requires several steps and responses by the practitioner in the event of a breach. When signing on for e-filing a practitioner promises to comply with all provisions of the Publication. 22

23 III. The New Threat Attacks on the Practitioner Page G. What will the IRS want to do? 1. Ask for a CI investigation, but lack of resources has greatly curtailed this activity. 2. Higher scrutiny of any client filing for at least one year, but likely two. 3. Letter 5747 asking for a validation of identity anytime a return is filed. 23

24 III. The New Threat Attacks on the Practitioner Page 139 The Outcome of the Theft, the Bad Guys will: 1. Attempt to obtain transcripts, of the practitioner also. 2. Obtain the practitioner s credit report. 3. Try to change the EFIN information. 4. Will change information associated with the PTIN. 24

25 Page 139 Looking through the Trash Dumpster diving is not a lost art, particular targets of thieves: Accounting Firms Law Firms IV. How Thieves Obtain Data Health Care Professionals Action Item - Install systems that facilitate the secure disposal of confidential documents. 25

26 Page 139 IV. How Thieves Obtain Data Thefts of Records If you looked around your office would you find: Piles of files after hours Unlocked file cabinets Unprotected computers Poor document destruction practices Because IRS is being trained to observe and report 26

27 Page 140 IV. How Thieves Obtain Data Attacks directed at practitioners. Phone calls to firms indicating they are from your software vendor. Communications masquerading as executives at client firms. Accessing online payroll data. 27

28 Page 141 VI. Steps for Victims A police report is a must to protect your rights. 28

29 Page 142 VI. Steps for Victims The FTC has checklists and requests that you report your theft for inclusion in their data base 29

30 Page 142 VI. Steps for Victims Pickup the phone and contact a credit reporting agency requesting a credit freeze on your account. 30

31 Page 143 The Credit Freeze: VI. Steps for Victims Costs vary from state to state but average $30 There is generally a fee for removal of $10 but some states do not allow this charge. A PIN will be issued allowing the user to unfreeze and refreeze their credit account. 31

32 Page 143-New VI. Steps for Victims The Equifax data breach: The Equifax breach which has grown to over 250 million individuals prompted many individuals to place a credit freeze on their account, however: Most attacks are likely to be imposter scams. IRS expects a rash of tax identity theft with the information obtained by the hackers. Spear phishing using data obtained on bank and brokerage accounts. 32

33 Page 143 Final words of wisdom: VI. Steps for Victims 7. Close accounts that were opened by the fraudulent users. 8. Opt out of unsolicited offers. 33

34 Page Opt out of unsolicited offers. VI. Steps for Victims 34

35 VII. Dealing with the IRS for Tax Account Fraud Page What does the IRS ask the taxpayer to do? 1. File Form 14039, however this is not always in the best interest of the taxpayer. a. IRS may place an IP PIN on the account which may last for one filing period or as long as FOREVER. b. Filing Form does not mean inclusion in the IP PIN program, IRS subjects the request to a 4 level threat ranking. 35

36 VII. Dealing with the IRS for Tax Account Fraud Page143-Update What does the IRS ask the taxpayer to do? 2. Respond to all notices as quickly as possible. 3. Continue to file and pay taxes, even if rejected by e-filing. 4. Review the most recent processes on irs.gov/identity-theft-fraud-scams/identityprotection 36

37 VII. Dealing with the IRS for Tax Account Fraud Page 143 What will the IRS do? 1. Confirm the identity theft profile of the return. 2. Code the taxpayers account indicating the processing of ID Theft investigation. 3. Reconcile the account to determine what is the taxpayer s actual information and what is fraudulent. 4. Place an ID Theft indicator (special processing) if the determination is made. 5. During the investigation the account will be on hold 37

38 VIII. Notices Used by the IRS For Identity Theft Page 143 IRS uses a collection of notices to correspond with taxpayers affected by identity fraud, some they disclose and others are only known as practitioners communicate with each other. To understand what IRS is looking for any notice go to irs.gov: In the search box enter Basic Tools for Tax Professionals 38

39 VIII. Notices Used by the IRS For Identity Theft Page 143 Type Here 39

40 VIII. Notices Used by the IRS For Identity Theft Page143 Type Here

41 VIII. Notices Used by the IRS For Identity Theft Page 144 Some demand a response and others to inform 41

42 VIII. Notices Used by the IRS For Identity Theft Page 144 While others are indicating a step in the process 42

43 Page 144 IX. Identity Protection Personal Identification Number (IP PIN) The IRS is using the IP PIN as a link to the SSN assuming that only the legitimate taxpayer will ever be in possession of that security number. The number will be delivered by Notice CP01A. Once in the IP PIN program the taxpayer must use an IP PIN to file their return for 1 year, 4 years or a lifetime. If the taxpayer fails to receive the above notice they should obtain a replacement number. 43

44 Page 144 IX. Identity Protection Personal Identification Number (IP PIN) When CP01A notices do not EXACTLY reflect the taxpayer s information. What should the taxpayer do? CALL to correct the account IMMEDIATELY. 44

45 Page 145 IX. Identity Protection Personal Identification Number (IP PIN) If the taxpayer does not receive or misplaces their IP PIN they can obtain a replacement through Secure Access at irs.gov/identity-theft-fraudscams/get-an-identity-protection-pin or call. 45

46 Page 145 IX. Identity Protection Personal Identification Number (IP PIN) Once assigned an IP PIN indicator the taxpayer account is locked and they must: Use an IP PIN when e-filing Use an IP PIN when paper filing Will receive a NEW IP PIN every year in late December or early January Can replace the number at the IP PIN online site at IRS (if they can register) If the cannot or choose not to register then call IRS at to obtain their IP PIN 46

47 X. Obtaining a Copy of the Fraudulent Returns Filed A helpful piece of information for the taxpayer is a copy of the fraudulent return(s). Why? Local law enforcement will use to pursue the case. BUT IRS will decline to release until the investigation is complete. Why? To insure the requester of the fraudulent returns is in fact the injured taxpayer. Page

48 X. Obtaining a Copy of the Fraudulent Returns Filed Page The IRS continues to insist that they not only are required to protect the identity of the injured taxpayer but that of the scammer. However, Chief Counsel s office says: The fraudulent return is a nullity, as it does not qualify as a return per IRC 6103 BUT still is subject to disclosure restrictions of IRC 6103(a). IRS 48