Forest Global Training Partners

Cyber Risks · Krebs on Security

Thieves Nab IRS PINs to Hijack Tax Refunds

Summary: Identity thieves are using the IRS's Identity Protection PIN system to file fraudulent returns two years running, with CPA Becky Wittrock discovering a return filed under her name on Feb. 2, 2016, more than three weeks before she tried to e-file on Feb. 25. The six-digit IP PIN, mailed to some 2.7 million tax ID theft victims, can be retrieved from the IRS website by answering four easy-to-guess Equifax knowledge-based authentication questions that can be enumerated by random guessing or answered via services like Zillow and Facebook.

What you should know: The IRS's own Get Transcript feature exposed at least 724,000 citizens' tax data between January 2014 and May 2015, and the agency now requires IP PIN holders to clear the same flawed authentication to retrieve their PIN - so the control meant to stop repeat refund fraud runs through the channel that enabled it.

Read the original at Krebs on Security ↗

Topics
Fraud & Scams
Related