IRS: 330K Taxpayers Hit by ‘Get Transcript’ Scam
Summary: The IRS disclosed that identity thieves abused the "Get Transcript" feature on IRS.gov to pull sensitive tax data on more than 330,000 potential victims, up from the 110,000 it acknowledged in May 2015 after KrebsOnSecurity first raised alarms in March. The thieves used personal information from about 610,000 taxpayers to try to access old returns, succeeding on roughly 334,000, by answering four Equifax knowledge-based authentication questions that were navigated successfully more than half the times they were tried.
Bottom line: The same weak authentication still guards the IP PIN recovery feature, so the 330,000 people already notified may be exposed a second time through the IRS's own site. Static identifiers like a Social Security number and previous address are no longer secret, yet they remain the authenticator standing between a fraudster and a full tax transcript.
Read the original at Krebs on Security ↗
- Topics
- Fraud & Scams
- Related
- ArcticRAT Cybercrime Gang Profiles Victim Finances With AI Cyber Risks · Nov 13, 2026Three People Arrested for AI-Enhanced Impersonation Fraud Cyber Risks · Nov 11, 2026Medicare scam calls, texts and ads: What to watch for this Open Enrollment Cyber Risks · Oct 14, 2026