The IRS' super-convenient Get Transcript online service has been suspended this week due to access irregularities in about 104,000 taxpayer accounst. We often recommend to clients that they recover missing W-2 and 1099s from the Get Transcript service, as it is common for these documents to be mishandled by employers and contractors or misplaced by taxpayers. Employers and contractors often refuse to provide copies. With the service down, we'll back to the way it was before--hounding the employers and contractors.
The IRS said that criminals used taxpayer-specific data acquired from non-IRS sources to gain unauthorized access to information on the tax accounts through the Get Transcript application. The data included Social Security information, birth dates and street addresses. Third parties gained enough information from outside sources before trying to access the IRS site, allowing them to clear a multi-step authentication process, including several personal verification questions that typically are only known by taxpayers themselves.
The matter is under review by the Treasury Inspector General for Tax Administration, along with the IRS’s Criminal Investigation unit, and the Get Transcript application has been shut down temporarily. The IRS said it would provide free credit monitoring services for the approximately 104,000 taxpayers whose accounts were accessed. In total, the IRS has identified 200,000 total attempts to access data and will be notifying all of these taxpayers about the incident.
“What we have is the latest more sophisticated manifestation of a form of identity theft in the sense that we’ve detected and determined that there was unauthorized access to our Get Transcript application,” IRS Commissioner John Koskinen said during a conference call with reporters Tuesday. “That unauthorized access ran from February to May. The Get Transcript application gets you previous filings of tax returns. To try to get through to get that transcript, the criminals had to already have stolen Social Security numbers, names, addresses, and other personal identifiers available and then they had to have enough personal information for each taxpayer to be able to get through the personal-related questions, the so-called ‘out of wallet questions.’”
Koskinen noted that the IRS had about 23 million successful downloads of the Get Transcript application during the filing season, and has identified that there were attempts by identity thieves to get access to the prior tax returns of about 200,000 taxpayers.
“About 100,000 were unsuccessful,” he added. “They could not work through the barriers that we had established, but unfortunately about 104,000 did get through and were able to access earlier tax returns. Those tax returns have basic tax information on them and are mostly used to file a better fraudulent tax return for a refund.”
Koskinen pointed out that the IRS’s filters have gotten increasingly sophisticated, and this year the IRS stopped nearly 3 million suspicious returns “at the door” rather than accepting them for filing and then followed up with taxpayers to authenticate them.
“But those filters depend upon anomalies, and so to the extent that a fraudulent return can look closely like a previously filed tax return, you have a better chance of getting through the filters,” he said. “We think—and we have a lot more analysis that we have to do—that a relatively small number of these incidents, where the 104,000 transcripts were available, turned themselves into refund frauds that were paid out this year, but our real concern is the 200,000 taxpayers. We think that all of them, even those where no-one accessed their earlier returns, need to receive a notice from us advising them of the fact that their Social Security numbers and personal information is in the hands of criminals. All of them will get that notice.”
With the 104,000 where access was gained to their returns, the IRS will provide them with credit-monitoring as well, he added, and for all 200,000 the IRS will mark them in its system to protect the taxpayers against anyone subsequently filing a false return, either this summer or next filing season before they file.
“We greatly regret that this additional information is available to criminals, although as I say it’s primarily attractive for them to file fraudulent refunds going forward,” said Koskinen. “We’ve taken the Get Transcript application down late last week and we won’t put it back up until we’re satisfied that we’ve improved the security.”
He pointed out that the IRS faces the challenge of making the security questions stringent enough so that fraudsters won’t get through, while still enabling legitimate taxpayers to be able to get the tax transcripts when they need them for mortgage applications and the like.
“For the 23 million people who successfully downloaded their transcripts, we have a balance there of making sure they can continue, properly authenticated, to have access to those transcripts without having to either get them in person or call us and have them mailed to them,” said Koskinen. “That’s the situation we are facing. It is clear, as our criminal investigators note, their estimate is 80 percent of the identity theft and refund fraud we’re dealing with is related to organized crime here and around the world, and this is just another example. These are extremely sophisticated criminals with access to a tremendous amount of data. I would stress that this in no way has anything to do with our basic tax-filing system, the data that we have that we collected from 150 million people this year. All of that is secure. This is a single application that you have to have a lot of information to be able to try to access.”
He pointed out that this is not technically a security breach, since the IRS’s basic information is still secured, but it’s a modified form of identity theft, giving the criminals enough data to impersonate the taxpayer.
We'll keep you posted when the Get Transcript service is restored.