We all know that identity thieves aren’t letting up in their efforts to steal your clients’ personal information so they can file fraudulent tax returns. If anything, they’re picking up the pace. But how can you know your tax prep office has been a target?

What are the signs of identity theft tax refund fraud?

Identity thieves work in the shadows, so the evidence of their malicious work isn’t always obvious. But it is there if you know what to look for.

While any one of these symptoms may—or may not—mean your computer systems have definitely been compromised, they are indicators that need to be investigated:

• Client e-filed returns rejected because client's Social Security number was already used on another return.

• More e-file acknowledgements received than returns the tax pro filed.
• Clients responded to emails the tax pro didn't send.
• Slow or unexpected computer or network responsiveness such as:
• Software or actions take longer to process than usual,
• Computer cursor moves or changes numbers without touching the mouse or keyboard,
• Unexpectedly locked out of a network or computer.

If you’ve had more than one of these indicators occur on your office system, it’s time to call a professional IT firm to confirm the root cause.

Client reports can help you spot identity theft

Your clients may also get an indicator that something is amiss. The Summit says you should be on the lookout for these warning signs:

• IRS Authentication letters (5071C, 6331C, 4883C, 5747C) even though they haven't filed a return.
• A refund even though they haven't filed a return.
• A tax transcript they didn't request.
• Emails or calls from the tax pro that they didn't initiate.
• A notice that someone created an IRS online account for the taxpayer without their consent.
• A notice the taxpayer wasn't expecting that:
• Someone accessed their IRS online account,
• The IRS disabled their online account,
• Balance due or other notices from the IRS that are not correct based on return filed or if a return had not been filed.

The upshot of all these indicators is that you, the tax professional, are the first line of defense against unlawful theft of your and your clients’ data.

When you see a pattern that doesn’t fit the circumstances, it’s time to investigate. Make sure you and your office have the best security possible, but don’t hesitate to get help if there’s a problem.

What should I do if I suspect data theft?

The first step toward recovery is to call the IRS, specifically the local IRS Stakeholder Liaison. They can notify IRS Criminal Investigation and other agency departments on your behalf. Do it IMMEDIATELY once data theft is confirmed; the IRS can move to block fraudulent returns in your clients’ names and can further assist you and your office staff.

Next, email the Federation of Tax Administrators for instructions on how to report information to your state and others where you e-file. Many times, states dictate that data breach information is reported to the state attorney general, and this may mean sending your information to multiple offices.

Once a data breach is identified, the IRS recommends tax pros identify and contact clients who may be affected by the breach and suggesting they acquire an IP PIN or, if necessary, file Form 14039, Identity Theft Affidavit.

Knowledge is power

The IRS website has a number of valuable resources available for tax professionals.

See Publication 5293, Data Security Resource Guide for Tax Professionals for an overview on avoiding data theft.

Help is also available from Publication 4557, Safeguarding Taxpayer Data, and from the Security Summit, a reminder about the importance of IP PINs.

Another vital piece of guidance comes from the National Institute of Standards and Technology, in Small Business Information Security: The Fundamentals.

Source: IR-2022-144