IRS Suspends Insecure ‘Get IP PIN’ Feature
Summary: The IRS suspended its online 'Get IP PIN' tool after KrebsOnSecurity reported that identity thieves were using it to file fraudulent refund claims ahead of legitimate taxpayers. The tool let recipients of the roughly 2.7 million mailed IP PINs retrieve a lost code by answering four Equifax knowledge-based authentication questions that the article says can be guessed or researched through free services such as Zillow and Facebook.
Key Takeaway: About 130,000 of the 2.7 million IP PIN holders used the online retrieval tool, and the IRS confirmed and stopped 800 fraudulent returns through February 2016 - a figure the article notes excludes fraud the agency may have missed, and one it has revised sharply upward in past incidents, including Get Transcript, which went from roughly 100,000 to more than 700,000 affected taxpayers.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026