identity theft

ADP W-2 data hacked in latest breach

By Bankrate

Westchester NY accountant Paul Herman of Herman & Company CPA’s is here for all your financial needs. Please contact us if you have questions, and to receive your free personal finance consultation!


Identity thieves have their hands on a new batch of personal and tax data after hacking the payroll outsourcing company ADP.

The information is from W-2 forms, the documents workers get from their employers in late January or early February so they can file their annual tax returns with the Internal Revenue Service and state tax departments.

Now crooks have all they need to beat those filers to the punch and submit fake 1040s claiming fraudulent tax refunds.

Personal data used to get into ADP

Krebs on Security website, which first reported the ADP breach, also obtained a copy of a letter that affected U.S. Bank employees received regarding the security issue.

Unauthorized access to the workers’ tax and employment data occurred, according to the U.S. Bank letter, “because ADP offered an external online portal that has been exploited.”

Basically, the crooks didn’t break into the payroll service provider’s site, but rather used workers’ confidential personal information that they had obtained from other sources to register as the workers at one of the firms using the ADP customer portal. Once connected, they simply viewed or downloaded the W-2s.

That same tactic of getting individuals’ information — names, birth dates and Social Security numbers — elsewhere and then breaking into a site with additional data was used by identity thieves who hacked the IRS’ Get Transcript online application. Around 724,000 taxpayer accounts ultimately were compromised.

Small, but possibly costly, breach

Both U.S. Bank and ADP said the actual number of affected employees was limited, but did not reveal exact numbers. ADP also told Krebs that the same fraud was used against “a very small subset” of ADP’s total customers this year.

Of course, the minuscule possibility means nothing if you’re in that small group that was hacked. Once your identity is stolen, you could face big problems.

Tax moves to combat ID theft

On the tax side, if you know or even just suspect that your ID has been stolen, the IRS recommends you send it Form 14039, Identity Theft Affidavit. This puts the agency on alert for your Social Security number and other information that could show up on a fake return.

If a criminal does file a fake return pretending to be you, file your real tax return on paper, attaching a copy of the Form 14039 with your legitimate filing. Also watch for any follow-up correspondence from the IRS about your real or possible fake returns and respond immediately.

Paul S. Herman CPA, a tax expert for individuals and businesses, is the founder of Herman & Company, CPA’s PC in White Plains, New York.  He provides guidance and strategies to improve clients’ financial well-being.


Congressman shares tax ID theft story


Westchester NY accountant Paul Herman of Herman & Company CPA’s is here for all your financial needs. Please contact us if you have questions, and to receive your free personal finance consultation!

By Bankrate

No one is safe from tax identity theft, not even the lawmakers who help write the country’s tax laws.

Another member of the House Ways and Means Committee has become a victim. During a hearing of the committee’s Oversight Subcommittee on April 19, Rep. Jim Renacci, R-Ohio, told his colleagues about having his identity stolen and a fake tax return filed in his name.

Rep. Jason Chaffetz, R-Utah, a former chair of the Ways and Means Oversight panel, also was a tax identity theft victim.

Fake return seeking ‘significant’ refund

This week Renacci shared his tax identity theft experience as part of a hearing on the just-completed filing season.

“Last May, I received a notice from the IRS stating that they had some questions for me about my 2014 tax return,” Renacci testified. “I found this troubling because I had not yet filed.”

Renacci contacted the IRS and learned that his personal information had been stolen and was used to e-file a fraudulent tax return. The filing, said Renacci, included a fake W-2 from the U.S. House of Representatives and claimed a significant refund.

The false return instructed the fraudulent refund be sent to a bank account outside the United States. Fortunately, the IRS spotted some red flags on the filing and didn’t issue the refund check.

E-filing makes ID theft easier

“As a taxpayer and tax preparer for almost 30 years, it is apparent to me that identity theft is real,” Renacci said.

And one of the conveniences of filing — submitting a return electronically — can also cause significant issues related to identify theft, he told the subcommittee.

“Let me be clear, I don’t want to return to paper returns and checks, but the ease of electronic filing and payments have exacerbated the problem. I know, now more than ever, we need additional safeguards to protect taxpayers,” said Renacci.

To address his and other tax identity theft victims’ concerns, Renacci has introduced the Stolen Identity Refund Fraud Prevention Act of 2015. During his testimony, he urged his fellow Ways and Means members to act on the bill.

IRS making progress against identity theft

IRS Commissioner John Koskinen also testified at the hearing, telling subcommittee members that his agency is making progress against tax identity theft and refund fraud.

“We have improved the filters that help us spot suspicious returns before they can be processed,” Koskinen said. “Using those filters, we stopped 1.4 million returns last year that were confirmed to have been filed by identity thieves.”

The filters helped the IRS prevent issuance of around $8.7 billion in fraudulent refunds, according to the commissioner.

The IRS also is working with tax ID theft victims. Last year, said Koskinen, the agency worked with affected taxpayers to close more than 700,000 fraud cases.

$119 million in fake refunds stopped

Koskinen also reiterated the efforts of the Security Summit, created last year to coordinate tax identity theft and fraud prevention efforts across state governments and the tax services industry.

“Our collaborative efforts are already showing concrete results this filing season,” Koskinen said. “Through mid-March, leads from industry partners directly resulted in the suspension of 27,000 returns on which a total of $119 million in refunds was claimed, up from 8,000 returns claiming $57 million during the same period last year.”

If you find yourself in the same situation as Renacci and other identity theft victims, don’t rely on just the efforts of the IRS and its tax industry partners. Secure your personal data as soon as you suspect or discover it’s been compromised.

Paul S. Herman CPA, a tax expert for individuals and businesses, is the founder of Herman & Company, CPA’s PC in White Plains, New York.  He provides guidance and strategies to improve clients’ financial well-being.

‘False’ fraud filters delay IRS tax refunds

Westchester NY accountant Paul Herman of Herman & Company CPA’s is here for all your financial needs. Please contact us if you have questions, and to receive your free personal finance consultation!

By Bankrate

taxes-blog-False-fraud-filters-delay-IRS-tax-refundsThe Internal Revenue Service is walking a thin line in trying to simultaneously screen for potentially fraudulent tax returns and issue refunds to rightful taxpayers. Sometimes, says the National Taxpayer Advocate, the tax agency crosses that line, forcing hundreds of thousands of legitimate taxpayers to wait for their refunds.

The problem, according to National Taxpayer Advocate Nina E. Olson in her 2015 annual report to Congress issued Jan. 6, is a growing rate of false positives in a key tax fraud filter used by the IRS in processing returns.The Pre-Refund Wage Verification Program, referred to as “income wage verification,” or IWV, in Olson’s report, allows the IRS to temporarily freeze an individual’s refund when it detects possible false wages and withholding. That in itself is not bad. But these refund holds, says Olson, are snaring more honest filers, whose legitimate refunds are substantially delayed.

18-week wait for refund

The Taxpayer Advocate Service’s analysis of 2014 tax year filings found that nearly 180,000 legitimate filers who had their returns flagged under the IRS’ Electronic Fraud Detection System had to wait on average nearly 18 weeks before they got their refunds.

Things got worse for filers in 2015, when the IRS moved potential identity theft returns identified by the electronic detection system to the Taxpayer Protection Program, or TPP, for processing. The TPP’s false positive rate jumped from 19.8% in calendar year 2014 to 36.2% in 2015.

Making matters worse, says Olson, is that many of the affected taxpayers were unable to contact the IRS to verify their identity. At one point during the peak of the 2015 filing season, only 1 out of 10 calls got through to an IRS representative, says Olson.

The IRS also increased the testing of another application to detect identity theft or fraud, the Return Review Program. This system experienced an increase of more than 500% in erroneous refund holds.

Taxpayer Advocate helps, but still takes time

Almost 37,000 taxpayers contacted the Taxpayer Advocate Service for help in resolving the holds on their refunds in the first 9 months of 2015, according to the report. That’s a nearly 15% increase over the prior year, making it the 2nd most common reason taxpayers came to the IRS’ internal watchdog office for help.

Even with the Advocate’s help, it took an average of more than 8 weeks for these wrongful refund holds to be resolved.

Olson acknowledges that any effective tax identity theft and refund fraud screening method will result in false positives, no matter how well designed. However, she says, the high false positive rates in all of the IRS’ fraud detection programs “are unnecessarily high.”

IRS not tracking false fraud positives

More worrisome, according to the report, is that the IRS does not track the false positive rates for the IWV program, meaning it cannot determine exactly which fraud filters are stopping legitimate refunds.

Also, says Olson, “The IRS doesn’t have adequate procedures to promptly review and adjust its fraud detection filters, rules and models.”

And taxpayers whose refunds are frozen cannot reach a real person to help them resolve the problem. If a taxpayer tries to get information from the agency’s automated online Where’s My Refund? program, the filer receives a generic message prompting a call to the IRS. Even if the taxpayer does reach an IRA representative, that agent doesn’t have access to the fraud detection histories and cannot give specific responses to taxpayer inquiries.

Olson’s conclusion: Despite certain improvements in balancing fraud detection and taxpayer rights, the IRS has a ways to go.

To avoid finding yourself facing a possible tax identity theft/fraudulent refund situation that puts your real refund on hold, keep an eye on your personal data.

Read more:
Follow us: @Bankrate on Twitter | Bankrate on Facebook

Any U.S. tax advice contained in the body of this website is not intended or written to be used, and cannot be used, by the recipient for the purpose of avoiding penalties that may be imposed under the Internal Revenue Code or applicable state or local tax law provisions.