5 ms·
I believe that this actually happened to me -- which tells me the 100,000 number is way too low. To be more precise: when we went to electronically file our 2
by bcantrill 11y ago
I believe that this actually happened to me -- which tells me the 100,000 number is way too low. To be more precise: when we went to electronically file our 2014 return, it was rejected because our return had already been filed (not by us, of course). I (like 80+ million others) am a victim of the Anthem breach, and I have assumed that my fraudulent return was part of that breach. (Regardless, I have opted into the identity protection that Anthem has provided as restitution to victims of the breach.[1])
As part of clearing this up with the IRS, I had to verify my own identity and validate that the return that we (physically) sent was the true and correct return. After a whopping 2+ hours on hold, I ran a grueling gauntlet of rather obscure questions that amount to some flimsy shared secrets I happen to have with the IRS. Once my identity was confirmed, I learned that the thieves had filed a 2014 AGI that exactly matched my 2013 AGI. The IRS representative told me that this was unusual (that is, that they normally they just make numbers up), and it's clearly stupid (my return was flagged and didn't pay out), but it obviously left me concerned that someone had somehow located my 2013 return. With this latest revelation, it's now clear that this could have easily happened via the IRS itself.
Assuming that my experience is indicative of a larger trend, I expect many more similar revelations as the IRS picks up the debris from the 2014 tax season -- and it wouldn't surprise me at all if the true target of the Anthem breach wasn't in fact the IRS: this crime is just too damn easy to pull off and get away with. The bright side of all this: things very clearly have to change, and I wouldn't be at all surprised if the IRS ends up issuing PINs to all e-filers this coming year.
[1] https://www.anthemfacts.com https://www.anthemfacts.com
- __z 11y agoSo the IRS has a form you can send in to put a fraud alert or some type with them so I guess they will give your tax return special attention to see if it is really you next time. Also - I'm confused - I have an e-file PIN. You don't?
- jjnoakes 11y agoYou can e-file without an IRS-issued e-file PIN. I know of at least one tax filing software program that uses only your previous year's AGI to verify your identity to the IRS. So having an e-file PIN, or even using an e-file PIN to e-file, does not imply that your tax return can't be e-filed by someone else who only has your previous year's AGI.
- clogston 11y agoIRS requires you to authenticate yourself via one of two mechanisms if you efile (regardless of who you do your taxes with): 1) Prior year AGI 2) Electronic filing PIN They can also issue a taxpayer a special Identity Protection PIN. If you're issued one of these you MUST use it. There are two groups of people that don't need to "authenticate" at all: 1) Anyone who didn't file the previous tax year 2) Anyone filing by mail
- mzs 11y agoIt's in the second paragraph of the article. They used a Get Transcript web form to get your prior year tax form from the info they had from the Anthem breach.
- ChuckMcM 11y agoWhich effectively confirmed what we already knew which is that the Anthem breach was made more damaging by the ease by which criminals can file a fake return for you.
- jtzhou 11y agoUnbelievable that the IRS would have this "Get Transcript" feature readily available via the web without any password, or better two-factor authentication. It's already been taken offline, but was up for a long time. Will there be punitive lawsuits against the IRS as there were for Target and likely will be for Anthem?
- smackfu 11y agoI think the hackers were attacking the initial sign-up, not already created accounts. So I don't see how you could use 2FA.