Identity thieves are filing fake federal returns using taxpayers' Social Security numbers and claiming tax refunds worth billions of dollars. The taxpayers only find out about it when their returns are rejected by the IRS because someone already received a refund using their identity.
That report says 641,052 taxpayers were affected by identity theft last year, more than double the year before. IRS resources haven't kept pace with the growing fraud, and cases sometimes take more than a year to resolve, the report says. Meanwhile, victims receive confusing information from the IRS and sometimes are asked repeatedly to prove their identity.
Inspector General J. Russell George testified before Congress this month that the IRS detected 940,000 fake returns for 2010 in which identity thieves attempted to gain $6.5 billion in refunds. And while the IRS catches a lot of fraud, he said, much goes undetected.
An audit of 2010 returns by the inspector general found about an additional 1.5 million returns with potentially fraudulent refunds worth more than $5.2 billion. If the problem isn't addressed, he said, the IRS could dish out about $26 billion in refunds to thieves over the next five years.
The IRS disputes that five-year projection, saying the inspector general doesn't take into account all the steps the agency is taking to fight fraud. But both sides agree that fraudulent returns filed by identity thieves is a serious problem.
Tax experts say thieves basically need just a name and legitimate Social Security number, which is far too easy to get these days.
Hospitals, doctor's offices, credit card issuers, cellphone companies, schools and all sorts of businesses collect Social Security numbers — even if they don't need them. All it takes is lax security — and there's plenty of that — or one unscrupulous employee, and thousands of Social Security numbers can wind up in the hands of criminals.
Once thieves have the numbers, they can make up W-2 information or use stolen data from employers to create fake returns, tax experts say. Fraudulent returns — filed early in the tax season — claim low incomes and high tax withholdings to inflate refunds. The money is deposited directly into a thief's bank account or onto a debit card.
The IRS is "just getting the refunds out right away," says Max Neil Highstein, a Lutherville accountant.
It's not until after the April tax deadline that the IRS begins to match returns with 1099 forms, W-2s and other information provided by third parties, which can expose the fraud, he says.
Highstein has had two tax clients with stolen identities this year.
One is Bill Niermann, 59, a retired insurance agent in Timonium. Niermann says he didn't know that someone from another state had stolen his Social Security number until Highstein told him that his electronically filed return had been rejected.
"I went into panic mode," he says.
Niermann filed an affidavit with the IRS attesting to the theft and sent in information to verify his identity. He also put a fraud alert on his credit reports, changed passwords on "everything that had a password," canceled his credit cards and opened new ones.
He says he's spent nearly his entire life in Maryland and wonders why that didn't trigger suspicions at the IRS when it received a return from another state with his Social Security number.
Niermann says the IRS will be sending him an Identity Protection Personal Identification Number to use when filing his return next year. In the meantime, he's still waiting for his 2011 refund.
"I'm due a $9,000 refund," he says. "God knows when I'll see it."
Sometimes the problem isn't just a delayed refund, but worse: the IRS coming after victims for money.
Jay DeVan, a Rockville accountant, says he's been working since March to clear up a case for a client whose information was used two years ago by a thief in Georgia to collect a $1,352 refund.
When the client later filed a return showing he owed taxes, the IRS assumed it was an amended return, DeVan says. The agency also concluded he must repay the $1,352 refund.
DeVan suspects the IRS sent letters to the thief's address in Georgia, so the Maryland client was unaware of any problem until the next year.
The next tax season the IRS kept the client's small refund. And then the IRS notified him that it was going to collect the rest of the unpaid taxes by seizing funds from his bank account, DeVan says.
DeVan says the IRS has been slow to respond, often failing to get back to him in the time promised.
The accountant adds that his client wants to file his 2011 return, but worries that the IRS will keep that refund, too, to cover taxes he doesn't owe.
"It's a Catch-22," DeVans says.
In testimony before Congress this month, IRS Deputy Commissioner Steven Miller said identity theft is the agency's top priority, so it has devoted more resources to catch fraudulent returns.
Last year, for instance, the agency beefed up identity theft filters to detect false returns before refunds go out, he said. As of a month ago those filters had stopped 325,000 questionable returns claiming $1.75 billion.
The IRS now uses a code to identify taxpayers who have died so their numbers cannot be used by thieves, Miller said. It has issued more than 250,000 identity protection numbers to ID theft victims to signal that they are the legitimate taxpayers when they file returns. And it will be implementing measures to resolve cases faster.
But "the IRS cannot stop all identity theft," Miller added.
Unfortunately, taxpayers have few ways to protect themselves.
You can guard your Social Security number and other personal information like they're state secrets. If a business or group asks for your Social Security number, suggest that it use a different identifier instead.
And file your return early — before a thief gets a chance to do so. But this option won't be available to taxpayers who must wait to get certain forms before filing or who have complicated returns.