IRS "GET TRANSCRIPT" Hack worse than initially reported

Hacking of taxpayers' IRS accounts was worse than initially reported

IRS Statement On "Get Transcript."

IRS has announced that the "Get Transcript" hacking incident discovered last May was more widespread than initially thought and that approximately 390,000 additional taxpayer accounts were potentially accessed during the period from January 2014 through May 2015. The Treasury Inspector General for Tax Administration (TIGTA) conducted a 9-month long investigation looking back to the launch of the application in January of 2014 and discovered additional suspicious attempts to access taxpayer accounts using sensitive information already in the hands of criminals.

Background. In January of 2014, IRS launched the "Get Transcript" program on its website. This application allowed taxpayers to have the option of immediately viewing and downloading their tax transcript or having it mailed to their address. Taxpayers could view or order multiple years of transcript information. For the 2015 filing season, approximately 23 million transcripts were ordered. Since its launch in 2014, around 47 million transcripts have been ordered through the "Get Transcript" tool.

In May of 2015, IRS announced it had discovered that criminals, using taxpayer information stolen elsewhere, had been able to pass procedures to access the "Get Transcript" application. At that time, IRS identified approximately 114,000 taxpayers whose transcripts had been accessed and about another 111,000 taxpayers whose transcripts were targeted but not accessed.

In August of 2015, IRS announced it had identified another 220,000 taxpayers whose transcripts may have been accessed and an approximately 170,000 taxpayers whose transcripts were targeted but not accessed.

After IRS made its announcement, TIGTA investigators began their own review, covering from 2014 through May 2015. TIGTA investigators identified suspicious email addresses that made multiple attempts to access accounts. IRS noted that it was possible that some of those identified may be family members, tax return preparers or financial institutions using a single email address to attempt to access more than one account. However, in an abundance of caution, IRS will notify all taxpayers impacted.

The online viewing and download feature of "Get Transcript" has been unavailable since May 2015, and IRS is working to restore that part of the service in the near future with enhanced taxpayer-identity authentication protocols. Other transcript options remain available via IRS' website, with online requests being taken for mailed copies of transcripts. IRS reminds taxpayers to plan ahead if they need transcripts-it can typically take five to 10 days before the transcripts arrive in the mail.

IRS response. IRS is moving immediately to notify and help protect these additional taxpayers from tax-related identity theft, including through free identity theft protection services as well as Identity Protection PINs. Steps include:

• . . . Notifying by mail those taxpayers whose transcripts were accessed and those taxpayers whose transcripts were targeted but not accessed;
• . . . Informing taxpayers whose transcripts were accessed that they can request an Identity Protect PIN, which provides an additional layer of protection for the taxpayer's Social Security Number (SSN) on federal tax returns, by completing a Form 14039, Identity Theft Affidavit;
• . . . Offering taxpayers whose returns were accessed a free Equifax identity theft protection product for one year, and encouraging taxpayers to place a "fraud alert" on their credit accounts;
• . . . Placing extra scrutiny on tax returns that contain taxpayer SSNs; and
• . . . Placing special markers on these taxpayer accounts to advise IRS assistors that the caller is part of this event.

Other attacks on taxpayer information. In addition, only a week before this latest hacking announcement, IRS warned in IR 2016-28 , of a new surge in IRS email schemes during the 2016 tax season. Taxpayers are receiving fraudulent emails designed to look like official communications from IRS or others in the tax industry, including tax software companies. The phishing schemes asked taxpayers about a wide range of topics, including information related to refunds, filing status, confirming personal information, ordering transcripts and verifying PIN information. This personal tax information could be used to help file false tax returns.

When people clicked on these email links, they were taken to sites designed to imitate an official-looking website, such as IRS's website. The sites asked for SSNs and other personal information. In addition, the sites might carry malware, which could infect people's computers and allow criminals to access taxpayers' files or track their keystrokes to gain information.

In IR 2016-28 , IRS noted an increase in such phishing and malware schemes, including:

• There were 1,026 incidents reported in January, up from 254 from a year earlier.
• The trend continued in February, nearly doubling the reported number of incidents compared to a year ago. In all, 363 incidents were reported from Feb. 1-16, compared to the 201 incidents reported for the entire month of February 2015.
• This year's 1,389 incidents have already topped the 2014 yearly total of 1,361, and they are halfway to matching the 2015 total of 2,748.

Photo Credit to Networkworld.com