Everyone's at Risk - Combating the Increasing Threat of Identity Theft and Online Fraud. Capital of Texas Enrolled Agents CPE November 3, 2009

Transcription

1 Everyone's at Risk - Combating the Increasing Threat of Identity Theft and Online Fraud Capital of Texas Enrolled Agents CPE November 3, 2009

2 When was the first significant instance of identity theft in the United States?

3 Answer: 1938 In 1938 a wallet manufacturer promoted its product by showing how a social security card would fit into the wallets. The company used a secretary s Social Security card as the model. Even though the card was half the size of a real card and had the words specimen printed in red across the face, many purchasers of the wallet used the SSN as their own. By 1943 at least 5,755 had used the SSN and 12 people were still using the SSN as late as

4 What technique is used most often to commit identity theft? Dumpster diving Phishing Trojans Hacking 4

5 Answer: Dumpster Diving 5

6 Where can you find IRS identity theft prevention and victim assistance guidance? IRS.gov Publication 17 Tax Year tax packages All of the above 6

7 Answer: All of the above 7

8 Rising cases of data loss and identity theft loss have created a national problem affecting millions of individuals Scamming IRS pretty easy, felon says Convicted felon testifies at Senate Finance Committee Hearing that he was able to use stolen identifies to file phony Federal tax returns resulting in $47,000 in refunds USA Today, April 13, 2007 Identity Theft 911 Introduces New Data Breach Program for Growing Threat Business Wire, July 17, 2008 Data Leak in Britain Affects 25 Million The British government struggled Wednesday to explain its loss of computer disks containing detailed personal information on 25 million Britons, including an unknown number of bank account identifiers, in what analysts described as potentially the most significant privacy breach of the digital era. New York Times, November 22, 2007 * Head of the tax agency fired as a result of this incident Worker Often Took Data Home The Department of Veterans Affairs data analyst who lost 26.5 million veterans' personal information when his home was burglarized had routinely taken such data home since 2003, VA Inspector General George J. Opfer said yesterday. Washington Post, May 26,

9 The case of an identity thief Convicted felon Evangelos Soukas revealed how he defrauded the IRS and committed identity theft against U.S. taxpayers Soukas used personal information stolen from taxpayers by an entry-level employee at a cell phone company to file false tax returns and obtain fraudulent refunds Evangelos Soukas testifying before the Senate Finance Committee at a hearing in April 2007 He told the Senate Finance Committee that using stolen identities to apply for tax refunds was an easy way to make money quickly Soukas is serving a 7 ½-year federal prison sentence for identity fraud, filing false income tax returns, wire fraud, and mail fraud 9

10 Office of Privacy, Information Protection and Data Security (PIPDS) is focused on PII protection and employee awareness PIPDS Vision To preserve and enhance public confidence by advocating for the protection and proper use of identity information The Office of Privacy, Information Protection and Data Security (PIPDS) was established in July 2007 and supports four key program offices with distinct missions: Office of Privacy (OP) Mission: To promote the protection of individual privacy and integrate privacy into business practices, behaviors, and technology solutions Office of Identity Protection (IP) Mission: To identify risks and reduce vulnerabilities for identity theft and improve victim assistance Office of Incident Management (IM) Mission: To administer the data loss incident reporting and notification process and improve victim assistance Office of Online Fraud Detection & Prevention (OFDP) Mission: To reduce online fraud against the IRS and taxpayers 10

11 Protecting Personally Identifiable Information (PII) Personally Identifiable Information (PII) is sensitive information that, either alone or in combination with other information, can be used to uniquely identify, contact, or locate a person. Unauthorized disclosure of PII places individuals at serious risk for identity theft and invasion of privacy. PII includes names, as they can be used to uniquely identify an individual when combined with other identifiers. However, the names of Federal employees, as well as their office numbers and business phone numbers are all considered public record and are not PII when used in that capacity. Therefore, there is no need for employees to remove that information from the signature blocks on their e- mails. PII includes the personal information of taxpayers, employees, contractors, applicants and visitors to the IRS. Specific examples include, but are not limited to: - Bank account numbers - Social Security Numbers - Date and place of birth - Mother s maiden name - Biometric data (height, weight, eye color, fingerprints, etc.) 11

12 Identity Theft is an Increasing threat facing IRS and American taxpayers FTC estimates almost 10 million Americans identities are stolen each year Identity theft is a fraud committed, or attempted, using the identifying information of another person without authority Dumpster Diving: They rummage through trash looking for bills or other paper Skimming: They steal credit/debit card numbers by using a special storage device Phishing: They pretend to be financial institutions or companies and send spam or pop-up messages to get you to reveal your personal information Old-Fashioned Stealing: They steal wallets, purses and mail Each year victims spend an estimated $5 billion out of pocket and almost 300 million hours trying to restore their good names Victims may be denied credit, mortgages, jobs, and housing, and may even be wrongly arrested 12

13 IRS Response to Identity Theft The Office of Management and Budget directed IRS and all Federal agencies to address identity theft and develop a notification process related to data loss incidents The IRS focuses on three areas to address identity theft: Victim Assistance: Assist taxpayers with resolving tax issues that arise from identity theft as quickly as possible and with minimal disruption Outreach: Increase taxpayer awareness of identity theft through multiple communication channels and education efforts Prevention: Build a strong prevention program to significantly reduce incidents of identity theft and protect the American taxpayer The IRS has made significant progress in the area of identity protection this year. 13

14 Identity Theft can steal the show and impact your tax accounts Theft of taxpayer information can lead to refund crimes and other financial crimes What if an undocumented worker used your Social Security number in order to get a job? The employer would report W-2 wages earned using your information to the IRS so it might appear that you did not report all of your income on your legitimate return What if an identity thief filed a tax return with your Social Security Number in order to receive a refund? When you file your legitimate tax return, the IRS will believe that you have already filed and received your refund and that the legitimate return is a second copy or duplicate You may be prevented from filing electronically 14

15 Identity Protection Specialized Unit (IPSU) As part of the Service s strategy to reduce taxpayer burden caused by identity theft, the Identity Protection Specialized Unit opened October 1, 2008 to help resolve identity theft victims issues quickly and effectively Victims can call a dedicated toll-free number, , Monday Friday, 8:00 a.m. 8:00 p.m., (their local time). The unit provides individualized assistance, including: A single customer service representative to work with each identity theft victim to answer questions and resolve his or her issues A new and simplified process to verify taxpayer identity and identity theft A place for taxpayers to self-report identity theft before it impacts their tax accounts A place for taxpayers to self-report incidents where they may be at risk for identity theft because their personally identifiable information has been compromised (for example, stolen purse/wallet) The unit also assists taxpayers who have already had their tax accounts impacted by identity theft, but have not yet had their issues resolved. The unit will refer taxpayers to the IRS area that is working the identity theft issue and also collaborate with that area to monitor the case through resolution 15

16 The IRS recently implemented account indicators that mark taxpayer accounts to track identity theft Account Indicators were implemented that mark taxpayer accounts to track identity theft and prevent victims from encountering the same problems year after year and to protect taxpayers from future harm. Specific indicators have been developed to: Track taxpayers who currently have tax problems related to the identity theft Track taxpayers self-reporting identity theft to the IRS with no current tax problems related to the identity theft Assist in distinguishing legitimate returns from fraudulent returns submitted by identity thieves Track identity theft, refund crime and phishing victims Use of these indicators allows IRS to scrutinize all returns filed using these taxpayer s SSN. Beginning January 2009, returns filed using SSNs with these indicators go through a series of business rules to distinguish legitimate returns from false or fraudulent returns. Returns that do not pass the business rules will be deemed unpostable and removed from normal processing for further analysis. 16

17 The IRS will continue to provide taxpayers with information to increase their overall awareness of identity theft and to resolve tax related issues A link has been placed on the IRS homepage, keyword, Phishing, to direct taxpayers to information on online fraud and current Phishing schemes, as well as information on emerging trends and prevention strategies. keyword, Identify Theft - provides information about the IRS identity protection program and how to protect yourself and guidance on how to report possible tax related identity theft. In order to further help taxpayers and promote collaboration across the federal government, taxpayers are directed to the FTC s consumer education website, 17

18 IRS Incident Management Process Incident Management is the Incident Notification Process for taxpayers and employees potentially impacted by IRS data loss incidents. This process includes: Incident Intake and Risk Assessment Logs IRS incidents involving loss or theft of PII Risk assessment Is notification required? Advisory Committee review and approval of notification Victim notification Letters sent to potentially impacted individuals Credit monitoring services offered Referral Units staffed with specially-trained Customer Service Representatives to respond to questions from notified individual Follow up and Support Information on calls, letters and use of credit monitoring services is collected and analyze 18

19 Data Loss Incidents Data loss includes the loss, theft or inadvertent disclosure of any IRS sensitive or personal information. Examples of data loss incidents include: Lost or stolen blackberry on public transportation Stolen laptop from car or home Lost or destroyed shipment in the mail Fax PII to the wrong number 19

20 IRS Incident Reporting Process Within one hour of becoming aware of an inadvertent disclosure, loss or theft of PII (in electronic or paper form), you must report the incident to: 1. Your manager 2. The Computer Security Incident Response Center (CSIRC) using the online CSIRC incident reporting form at or by calling If the incident involves the loss or theft of an IT asset or hardcopy data, contact TIGTA at The timely reporting to CSIRC and TIGTA is critical so that any needed investigation can be initiated quickly, which can decrease/mitigate the possibility that the information will be compromised and used to perpetrate identity theft or other forms of fraud. PIPDS will follow up with managers and employees to obtain additional information about the incident. If appropriate PIPDS will send out notification letters, including an offer code for one free year of credit monitoring, to the impacted individuals. 20

21 Actions to take if you experience identity theft Contact your financial institutions and take appropriate action Contact credit bureaus to place a fraud alert and get free copies of credit reports Equifax: Experian: Trans Union: File a police report with local law enforcement Contact the Federal Trade Commission: Additional Resources and Contacts: Free Credit Reports annually: Taxpayer Advocate Assistance: IRS Identity Protection Specialized Unit:

22 Online Fraud Detection and Prevention As the IRS continues to modernize its infrastructure based on e-gov initiatives, with the objective of deploying more robust, interactive, Internet-based applications providing available and efficient self-service, any loss of taxpayer confidence in this electronic interaction undermines this strategy and its investments. The IRS Online Fraud Detection and Prevention office is in place to protect taxpayers who are using computers to conduct business with the IRS. This office works to reduce online fraud against the IRS and taxpayers by monitoring, identifying and taking down bogus sites and phishing scams. Phishing is the act of sending an to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft The IRS is a top target for phishing scams. Victims fall for the scheme because they want to comply with their tax obligations. Once they enter their personal information, the criminal has it and can use it for a variety of illegal means. The IRS does not initiate taxpayer communications through or request detailed personal information through . 22

23 IRS phishing statistics by year , ,137* * As of April 24,

24 Foreign hosted phishing sites targeting IRS Number of Sites Per Country Argentina Australia Brazil Bulgaria Canada China Denmark France Germany Hong Kong India Indonesia * Per Phishing Incident Tracking System thru March 31, Italy Japan Korea (South) Netherlands Poland Russian Federation Singapore Spain Switzerland Taiwan Thailand Ukraine 27 United Kingdom

25 How to Report a Phishing Scam Employees and taxpayers who suspect they have received a phishing are instructed to: Avoid opening any attachments contained in the or clicking on any links. forward the message or web site URL to the IRS at IRS uses the information, URLs and links in these suspicious s to trace the hosting Web site and alert authorities to help shut down the fraudulent sites. 25

26 Phishing in Action From: Date: 4/18/ :32:00 PM Subject: Get your 2008 Economic Stimulus Refund ( $1800 ) Over 130 million Americans will receive refunds as part of President Bush program to jumpstart the economy. Our records indicate that you are qualified to receive the 2008 Economic Stimulus Refund. The fastest and easiest way to receive your refund is by direct deposit to your checking/savings account. Please click on the link and fill out the form and submit before April 18th, 2008 to ensure that your refund will be processed as soon as possible. Submitting your form on April 18th, 2008 or later means that your refund will be delayed due to the volume of requests we anticipate for the Economic Stimulus Refund. To access Economic Stimulus Refund, please click here. Link pointed to: 26

27 Which webpage is fraudulent? Fraudulent Webpage 27

28 Which webpage is fraudulent? Genuine Webpage 28

29 How to Contact PIPDS Deborah Wolf, Director Internal Revenue Service Office of Privacy, Information Protection, and Data Security 1111 Constitution Ave. NW Washington, DC Main office Visit our Web page 29