* * *
Today’s post is brought to you by the Sony W800/B 20.1 MP Digital Camera, currently the #1 bestselling point-and-shoot digital camera on Amazon. Advertisers make it possible for Digital Media Mom to bring you great content each day for free, so thanks for your support.
* * *
IRS Admits To A “Sophisticated” Theft Of Taxpayer Data
There’s been another IRS hack, and this one took place between February and May of this year. However, it wasn’t a hack in the traditional sense—the thieves already had the information they needed to login to the IRS site posing as the taxpayers’ whose accounts they accessed. This week, CNN Money reports:
A “sophisticated” organized crime syndicate used the IRS website to steal tax forms full of personal financial information on 104,000 taxpayers, the agency said Tuesday…Until the IRS discovered this latest data leak, its website provided a service called “Get Transcript.” It’s an easy way to download several years of tax forms for tasks like applying for a mortgage, or college financial aid.
Theft Not Limited To ‘Get Transcript’ Service Users
Note that while the data thieves used the IRS’s Get Transcript service to commit their crimes, it was not an attack on users of that service specifically. Remember, these criminals already had the social security numbers and other identifying details of the taxpayers whose records they stole. In its own report on the incident, dated 5/26/15, the IRS says:
In this sophisticated effort, third parties succeeded in clearing a multi-step authentication process that required prior personal knowledge about the taxpayer, including Social Security information, date of birth, tax filing status and street address before accessing IRS systems. The multi-layer process also requires an additional step, where applicants must correctly answer several personal identity verification questions that typically are only known by the taxpayer.
On the Get Transcript application, a further review by the IRS identified that these attempts were quite complex in nature and appear to have started in February and ran through mid-May. In all, about 200,000 attempts were made from questionable email domains, with more than 100,000 of those attempts successfully clearing authentication hurdles.
What Happens Now?
From the same IRS report quoted above:
In addition to disabling the Get Transcript application, the IRS has taken a number of immediate steps to protect taxpayers, including:
– Sending a letter to all of the approximately 200,000 taxpayers whose accounts had attempted unauthorized accesses, notifying them that third parties appear to have had access to taxpayer Social Security numbers and additional personal financial information from a non-IRS source before attempting to access the IRS transcript application. Although half of this group did not actually have their transcript account accessed because the third parties failed the authentication tests, the IRS is still taking an additional protective step to alert taxpayers. That’s because malicious actors acquired sensitive financial information from a source outside the IRS about these households that led to the attempts to access the transcript application.
– Offering free credit monitoring for the approximately 100,000 taxpayers whose Get Transcript accounts were accessed to ensure this information isn’t being used through other financial avenues. Taxpayers will receive specific instructions so they can sign up for the credit monitoring. The IRS emphasizes these outreach letters will not request any personal identification information from taxpayers. In addition, the IRS is marking the underlying taxpayer accounts on our core processing system to flag for potential identity theft to protect taxpayers going forward — both right now and in 2016.
These letters will be mailed out starting later this week and will include additional details for taxpayers about the credit monitoring and other steps. At this time, no action is needed by taxpayers outside these affected groups.
– – – – –
So, long story short: there’s not really anything potentially affected taxpayers can do at this point, other than wait to see if they receive one of those dreaded letters.
If you’re among the unlucky victims:
Immediately change all your online passwords, credit card PINs and online security questions/answers. If the thieves had enough information on you to access your tax records, you can’t know for certain they don’t also have your logins, PINs and security questions/answers for other sites.
Definitely take the IRS up on its offer of free credit monitoring because that letter is a sure sign your social security number, address, birthdate and other personal details that can be used for identity theft are already in the hands of criminals.
Contact the holders of all your credit card and financial accounts to inquire about adding additional security measures, such as limiting use above certain dollar limits, limiting the number of transactions per day, or even “locking” accounts such that they cannot be used at all unless you call in to the financial institution personally and request a temporary unlock or approval for a specific transaction.
Pay particular attention to any financial accounts you used to pay taxes or for receipt of refunds: remember, the thieves have those account numbers now. If you paid by credit card, report the card(s) you used as lost/stolen and order replacements.
Consider closing any accounts you don’t use regularly.
Finally, according to the CNN Money article linked above, “The IRS said…all 200,000 people who might be affected by this..will all be placed on a list of Americans whose tax profiles are more closely monitored next year.” If you’re one of those victims, you’ll want to take extra care to ensure next year’s return is complete and accurate. If you were considering taking any questionable deductions, next year is definitely NOT the time to experiment.
* * *
And now, a word from our sponsor…
Your smartphone may be fine for selfies and pictures you want to post to social media with a comment, but when wedding, graduation, vacation and other special event memories matter a little more, you’re going to want to use a full-featured digital camera like the affordable and highly-rated Sony W800/B 20.1 MP Digital Camera. This 4/5 star -rated camera is currently priced at just $78 (as of 5/27/15), yet it still offers 20.1 megapixel resolution, built-in flash, 5x optical zoom, Sony’s patented SteadyShot Image stabilization, panorama mode and a 720p HD Movie mode to capture full-motion video.
* * *
Fire Post of the Week: Where’s The Instant Video Chapter List On Fire TV?
* * *