That took some work. The IRS disclosed yesterday that 104,000 taxpayer accounts have been compromised by identity thieves who did it the hard way. The Wall Street Journal reports:
The IRS said that to access the information, crooks had to clear a multistep authentication process that required prior personal knowledge about the taxpayer, including Social Security information, date of birth, tax filing status and street address before accessing IRS systems. The process also involved answering personal identity-verification questions, such as “What was your high school mascot?”
Mr. Koskinen, when asked how impostors obtained answers to these so-called “out-of-wallet” questions, suggested social media might have played a role.
“This is not a hack or data breach. These are impostors pretending to be someone who has enough information” to get more, said Mr. Koskinen, who said thieves might be using sophisticated programs to aggregate and mine data.
This is much more difficult than your standard ID theft, where all you need is a Social Security number to go with a name, and maybe a birth date. Getting through the IRS transcript access system requires a fair amount of data entry and outside information.
The breach will complicate filing for the 104,000 taxpayers whose data was accessed, and possibly for another 96,000 taxpayers whose records the thieves failed to breach. Tax Analysts reports ($link):
The IRS will provide credit monitoring and protection to the 104,000 victims at the agency’s expense, Koskinen said. Victims will also be given the IRS’s identity protection personal identification numbers so they are not targeted again, he said. All 200,000 of the taxpayers affected by the raid will be sent notification letters from the IRS and will have their accounts flagged on the agency’s core processing systems, he added.
The IRS has been losing the IT security wars for some time. It’s a shame, because the transcript service has been very useful for taxpayers needing return information for loans or to resolve IRS notices. I think the IRS will eventually have to delay refunds and processing so that it will be able to match third-party information — W-2s and 1099s — with returns before issuing refunds. The era of “rapid refunds” is coming to an end.
Lots of coverage of this. The TaxProf has a roundup. Other coverage:
William Perez, IRS Data Breach: Hackers Gain Access Through ‘Get Transcript’ Web App. “The IRS emphasized that taxpayers don’t need to do anything further. The agency will be sending letters to affected taxpayers explaining what to do next.”
TaxGrrrl, IRS Says Identity Thieves Accessed Tax Transcripts For More Than 100,000 Taxpayers “IRS was alerted to the problem when its monitoring systems noted an unusual amount of activity related to the [transcript] application.”
Russ Fox, IRS “Get Transcript” Application Hacked; 104,000 Tax Returns Illegally Accessed. ” It would be time consuming but entirely possible for a stranger who had my social security number and date of birth to answer all the other verification questions.”
Accounting Today, IRS Detects Massive Data Breach in ‘Get Transcript’ Application
J.D. Tucille, Details About 100,000 Taxpayer Accounts Stolen From IRS (Reason.com)
“[T]he vast databases held by the IRS, HHS, security agencies, etc, will be leaked on purpose, leaked because of bureaucrat sloppiness, or be hacked. The more they collect, the more that will eventually leak.” Chris Edwards, director of tax policy studies at the Cato Institute, predicted to me last year. That “eventually”—at least, the latest round of it—is now.
True, you won’t pay from your own pocket for the flights, hotel stay, chauffeur or meal with a future president. But the value of those things, like all prizes, is considered taxable by the Internal Revenue Service.
The winners can’t simply ignore the potential tax bill. The political contest organizers should send them, and the IRS, 1099 forms stating the value of the prize.
Well, that’s one tax problem I won’t be having, unless they start paying voters enormous amounts to talk to us. I will meet any candidate who will pay me $100,000 for 10 minutes of my time. Meet me at the Timbuktuu on the EMC Building skywalk.
Bob Vineyard, Bad Moon Rising (Insureblog). “Obamacare news isn’t good.”
David Brunori, Scalia is Right (Tax Analsyts Blog). “The dormant commerce clause is here to stay, with precedent and established expectations and all, but it would be nice if we just admitted that we made it up.”
James Kennedy,Pennsylvania Senate Considers Hiking Income and Sales Taxes (Tax Policy Blog). They’re pretty high already.
TaxProf, The IRS Scandal, Day 748
Howard Gleckman, Marco Rubio Wasn’t the Only One Who Cashed Out an IRA Last Year (TaxVox). “Substantial assets leak because people under age 59 ½ take early withdrawals or borrow against their IRAs or 401(k). And the problem raises an important and challenging policy question: Should the money in these accounts be available for non-retirement purposes?”
Leslie Book offers thoughful consideration of Warrren Buffet’s support for an expanded Earned Income Tax Credit (Procedurally Taxing). You should read the whole thing, I’ll highlight this part:
As Mr. Buffet knows, there is no such thing as a free lunch. Using the tax system to deliver benefits is no silver bullet when it comes to addressing inequality. To administer the tax system as we know it today is no easy task. When Congress asks the IRS to do more, there are costs to taxpayers and the system overall. As Congress considers whether to ratchet up EITC, it should do so with the absence of rhetoric. It should also consider the tools it wants to give IRS to combat errors as well as address what costs it wants to impose on claimants and third parties. The current system passes costs on others, many of which are hidden. As with lunch, someone has to pick up the tab.
Among the costs is the 20-25% improper payment rate. Another cost is the high hidden marginal tax rate caused by the phase-out of the credit as incomes increase — a combined federal and state rate that can exceed 50%. And there is a cost to an already-stressed tax system of administering a social program.
Sebastian Johnson, Some States Support Earned Income Tax Credits for Working Families, Others Fall Short. (Tax Justice Blog) A piece that is oblivious to the issues raised by Leslie Book.
News from the Profession. EY Law Continues to Not Threaten Law Firms By Poaching Lawyers (Caleb Newquist, Going Concern).