Stay safe. Be Informed.

Tax ID fraudsters file early because they have a treasure trove of stolen personal information (names, dates of birth, Social Security numbers), and they’re eager to use that information to steal other people’s tax refunds. Tax identity theft is the use of someone else’s personal information to file a fraudulent tax return or claim tax benefits. This fraud is particularly pernicious because the legitimate taxpayer may have no way of knowing that fraud has been committed. The scam only works for returns that haven’t been filed by legitimate consumers, so fraudsters are highly motivated to file as early as possible. Often, the fraud will only be detected when a taxpayer receives a notice from the Internal Revenue Service (IRS) or state tax authorities of a problem with her return.

Tax identity theft was the single biggest type of identity theft complaints to the Federal Trade Commission in 2014. Conservative estimates put the cost of this fraud to the nation’s taxpayers at $5.2 billion annually.

Here’s how tax identity theft works: Most workers receive their W-2 forms from their employers by the end of January. Since many consumers wait until April to file, a scammer who has access to compromised personal information (such as a Social Security Number, full name, and street address) can take advantage of the delay to file in someone else’s name. Some tax ID thieves even specialize in using children’s identities to fraudulently claim them as dependents. Since the IRS tries to process refunds in as little as three weeks, the scammers receive their fraudulent refunds in the mail or electronically and quickly turn it into untraceable cash. The legitimate taxpayer often only finds out they’ve been a victim when the IRS refuses to process the real return because—according to its records—they’ve already filed a return.

How to spot tax identity fraud

Tax identity fraud is difficult to catch before the fraud occurs. However, consumers who fall victim to tax identity fraud often discover it in one of the following ways:

•  If someone else has already filed a tax return using your personal information (such as a Social Security Number), they may get your refund. When you later file your own return, the IRS will send you a notice letter indicating that your refund has already been sent out.
•  When someone else uses your Social Security Number to obtain employment, the employer will report those earnings to the IRS. When you file your tax return, you won’t include the identity thief’s earnings in your return. When the IRS notices the discrepancy, they will send you a letter stating that you’ve failed to declare all your income.
• If your income does not meet a certain threshold, you may not be required to file taxes. However, if someone else using your Social Security Number to obtain employment fails to file taxes, your account may end up in collections. A collections notice from the IRS may be a sign of tax identity theft.

If you receive one of these notices from the IRS or state tax authorities, contact the agency immediately. The IRS Identity Theft Protection Specialized Unit can be reached at 1-800-908-4490. A list of state tax authorities’ contact information is available from the Federation of Tax Administrators here.

Reducing your risk

Unfortunately, there is no foolproof way of avoiding tax identity fraud. Since Social Security Numbers and other personal information are so widely available on cyber black markets, chances are that scammers already have the information they need to commit tax identity fraud against many, if not most, American consumers.

However, there are steps that can be taken to reduce risk to the extent possible. These include:

• File your taxes as early as possible during tax season. Scammers depend on the fact that many taxpayers wait until late in tax-filing season to file. Filing early reduces the risk that a tax ID thief will be able to use your personal information to file fraudulently ahead of you.
• Review your credit report for any suspicious activity (such as lines of credit opened without your knowledge). Free credit reports for all three major credit reporting bureau can be obtained at annualcreditreport.com.
• Protect your personal information. When asked to provide a Social Security Number to a business or other entity, ask if there is another form of identification that can be used (such as a driver’s license ID number, phone number or mailing address). This will help slow the spread of the critically important SSN to potential ID thieves.
• Check your annual Social Security Administration earnings statement carefully. If there are earnings listed that you don’t recognize, someone else could be using your identity to obtain employment.
• Don’t give out personal information, such as your SSN, date of birth, or bank account information in response to unsolicited emails, postal mail, over the phone or via text message, social media or other platform.
• Install antivirus software and personal firewalls on your computer and make sure to install all operating system and browser patches promptly.
• Change passwords on online accounts regularly. Be sure to use different passwords on each account. If an online service (like email, social network, bank accounts, etc.) offers more secure technology, such as multi-factor authentication, turn it on.

What to do if you are a victim

Identity theft is a serious crime that can significantly and negatively affect your ability to obtain credit, get a job, or obtain medical care, just to name a few results. Recovering from tax identity theft is not easy, but it can be done through a combination of quick action and careful follow-up. The Internal Revenue Service and Federal Trade Commission recommend the following step-by-step process for addressing tax identity fraud.

1. Report the fraud by calling the IRS Identity Protection Specialized Unit at 1-800-908-4490 immediately. You will likely be asked to obtain a police report, fill out an IRS Theft Affidavit Form 14039 and send proof of your identity (such as copy of a Social Security Card, driver’s license, or passport).
2. File a complaint with the FTC at https://www.ftccomplaintassistant.gov. At the end of this process, you should receive an Identity Theft Affidavit and a complaint reference number. Save or print the Identity Theft Affidavit. Remember to record the date you filed your complaint. Consumers can also file a complaint by phone at 1-877-438-4338.
3. Go to your local police department to obtain a police report. Remember to bring a) a copy of the FTC Identity Theft Affidavit; b) any other proof of the theft (such as an IRS notice); c) a government-issued photo ID; d) proof of address (such as a rental agreement, pay stub, or utilities bill); and e) the FTC’s Memo to Law Enforcement (printable at the link). If your local police department is unable or unwilling to take your identity theft report, ask if you can file a “miscellaneous incidents” report. You can also try filing at a different police station, the local sheriff’s department, state police, or federal authority.
4. Contact one of the three major credit reporting bureaus and ask them to place a “fraud alert” on your credit report. A “fraud alert” placed with one credit reporting bureau should automatically be placed on your credit report with the other two bureaus. A fraud alert does not prevent identity thieves from misusing your identity, but it will result in credit reporting bureaus taking additional steps to verify a credit applicant’s information. These alerts generally expire after 90 days, so you may need to renew it periodically. Numbers to call are as follows:
   • Equifax.com – 1-800-525-6285
   • Experian.com – 1-888-397-3742
   • TransUnion.com– 1-800-680-7289
5. Resolving tax identity theft with state and federal tax authorities may require many months, or longer. While this process is ongoing, continue to file your taxes, even if you must do so by paper.
6. Tax identity theft may be a precursor to other forms of identity theft. Therefore, consumers who wish to take an additional security step may want to consider requesting a “security freeze” on their credit report from each of the three major credit reporting agencies. This step will make it impossible for identity thieves to open new lines of credit in your name. However, it will also prevent you from opening new lines of credit unless you contact the credit reporting agencies to temporarily (or permanently) lift the freeze. There may also be fees levied for placing, lifting, or removing a security freeze depending on the state you live in and whether or not you have proof that you are a victim of identity theft.
7. Additional information on spotting and avoiding identity theft is available from the Federal Trade Commission at www.ftc.gov/IDTheft. Taking Charge: What To Do If Your Identity Is Stolen is a free publication from the FTC that offers step-by-step guides, sample letters, and other information that can help you to recover from identity theft. It is available online at https://1.usa.gov/Seg8Oz.

NCL thanks Intuit for the unrestricted educational grant that helped make this guide possible.

Find Fraud Alerts related to this scam here.

Stay safe. Be Informed.

Medical identity theft occurs when a fraudster illegally obtains and uses a patient’s Personally Identifiable Information (PII), such as name, Social Security number, and/or medical insurance identity number, to fraudulently obtain or bill for medical goods or services. This kind of fraud also includes the unauthorized personal gain of insurance benefits, prescription drugs, employment, government benefits, or other financial gain acquired through the theft of another individual’s PII. Hackers have also been known to sell stolen health care records on the black market.

Health care data is increasingly becoming a top target for scammers and hackers in the United States and globally. According to Bitglass, one in three Americans were affected by health care breaches in 2015. The Department of Health and Human Services reported 253 health care breaches that affect 500 individuals or more with a combined loss of over 112 million records in 2015. A reason why fraudsters may be going after health care data more is because of its longer shelf life and rich potential for identity theft. Financial data has a finite lifespan and loses its worth as soon as the consumer notices the frauds and cancels their accounts or cards. However, health care data contains information that can’t be cancelled or changed as easily as a credit card. This information includes Social Security numbers, medical records, and prescription accounts.

Follow these tips to help protect yourself against medical identity theft:

• Review the Explanations of Benefits (EOB) statement or Medicare Summary Notice that your health plan sends after treatment. Immediately report any mistakes or unfamiliar charges, such as a doctor’s visit you did not make or prescriptions that you did not fill.
• Check in with your doctor(s) to ensure your medical records are accurate. Make sure the records contain your procedures, treatments, prescriptions, and other medical activities. If you notice inaccurate health details such as the wrong blood type, pre-existing conditions, or allergies, it may be a sign that an identity thief has accessed your records.
• Do not share your medical or insurance information with other individuals. Especially do not provide your medical information over the phone or via email unless you initiated the contact and have verified the entity you are contacting.
• Treat your medical identity with the same care and caution you do any of your other sensitive information, such as your financial credentials. Dispose or shred health documents you no longer need.
• Read the Privacy Policy on a website before you provide your Personally Identifiable Information. Find out why your Social Security number or insurance account numbers may be needed and how the website will keep it safe, or if it will be shared, and if so, with whom. (Websites with “https” in their URL are secure.)
• If you are unsure about sharing your personal information with someone who says they are from your health plan—DON’T. Directly contact the Member Services number on your ID card so you can be sure the person is a verified health representative.
• Be cautious when you get offers for “free” health services or products that require you to provide your personal health information. Often times, this is a scam targeted to steal your medical identity.
• Do not provide your medical information to someone who contacts you about a “recent breach.” This is a tactic scammers use to capitalize on actual data breaches to “phish” for additional personal information to steal your identity. Know that legitimate companies will never ask for your information through unsecured channels such as phone calls or emails.
• Do not be afraid to ask questions. Ask your health care provider about how your data is treated, protected, and shared. You have the right to find out with whom your insurance company and medical providers have shared your information with. You are entitled to one free copy of the “accounting of disclosures” every year from each of your providers.

If you have been a victim of medical ID theft, contact either Experian, Equifax, or TransUnion and have them place a fraud alert on your account. The credit reporting agency you contact is legally required to notify the other two agencies. A fraud alert will flag your account as a potential victim of fraud and that creditors should take extra steps to verify your identity before issuing credit. Be sure to monitor your credit reports on an ongoing basis. And be on the lookout for a confirmation letter from each bureau that your fraud alert has been processed. This is not a complete solution for medical ID theft, but it’s a precaution to take to look for medical collection notices.

Additional resources

Visit Global Anti-fraud Hub’s Identity theft section for more information.

You can also visit the FTC’s IdentityTheft.gov website to report any instances of fraud, including medical ID theft.

The Medical Identity Fraud Alliance has more information on how to avoid medical ID theft and more steps you can take if you area victim.

Find Fraud Alerts related to this scam here.

Stay safe. Be Informed.

If you know that your identity has been stolen as a result of a data breach, take these steps to contain the damage. More information on identity fraud can be found in our Data Breach HQ.

• File a complaint with the FTC with its online form or call 1-877-438-4338. They will create a FTC Identity Theft Affidavit for you that you will need throughout the rest of the process. Remember to print and save your affidavit for future reference because you will not be able to retrieve it from that page again.
• File a report with your local police department. Combine your FTC Identity Theft Affidavit with your police report for your Identity Theft Report. This will prove to businesses and financial institutions that your identity has been stolen.
• Call the fraud departments of the companies where you know identity theft occurred. Have them freeze or close your accounts. Change all your login information for these companies.
• Contact either Experian, Equifax, or TransUnion and have them place a fraud alert on your account. The credit reporting agency you contact is legally required to notify the other two agencies. A fraud alert will flag your account as a potential victim of fraud and that creditors should take extra steps to verify your identity before issuing credit. Be sure to monitor your credit reports on an ongoing basis. And be on the lookout for a confirmation letter from each bureau that your fraud alert has been processed.
• Get your free credit report from annualcreditreport.com or call 1-877-322-8228. If you have already ordered your one free credit report per year, you can pay to get your report immediately. Review your report as soon as possible and note fraudulent charges that you can report to the police and FTC.

After you have your Identity Theft Report, take the following steps:

• Find new accounts that you did not open and call the fraud department of each business to have them close your fraudulent accounts and remove any fraudulent charges. Ask for a letter from the business to confirm that you aren’t liable for the fraudulent charges, the fraudulent account is not yours, and that it was removed from your credit report. Use the FTC’s sample letter.
• Write to each of the credit bureaus (Experian, Equifax, TransUnion) to correct your credit report. Use the FTC’s sample letter and include your Identity Theft Report and proof of your identity. You have the legal right to have fraudulent activity voided from your credit report if your identity has been stolen, which is called blocking. Once the faulty information is blocked, it won’t affect your credit report and companies can’t try to collect debt from you.

Find Fraud Alerts related to this scam here.