This year's tax filing season has just begun, but already the IRS says it is seeing evidence that cybercriminals have begun filing fraudulent returns with information stolen from tax preparers' computer files.
What makes this scam so dangerous is that it doesn't raise the red flags the IRS has learned to watch for. The fake returns use the real names and Social Security numbers of real taxpayers and deposits the money in their actual bank accounts.
How it works
It works like this: a scammer obtains information about a taxpayer who is due a refund -- information that has been stolen from a tax preparer. He then completes the tax return and files it before the tax preparer gets around to doing it. The refund is then direct deposited into the taxpayer's bank account.
Next, a woman posing as a debt collector calls the taxpayer, tells them a refund was mistakenly deposited into their bank account, and then asks that the money be forwarded to her.
If the taxpayer complies, there is no way to retrieve the money. It was their actual tax refund, legally paid by the IRS, that they turned around and gave to a scammer.
The IRS is urging tax preparers to increase their security because this scam is only possible because someone was able to penetrate a tax professional's computer system, most likely though an email phishing scam.
Targeting tax professionals
As we reported back in October, scammers have breached cloud databases to steal information on financial services clients. Impersonating the tax professional's organization, they then contact the clients asking them to update tax information. As the IRS is now seeing, that information can be used to file a tax return.
"This scheme is likely just the first of many that will be identified this year as the IRS, state tax agencies, and tax industry continue to fight back against tax-related identity thieves," the IRS warned in a statement.
The tax agency says efforts to prevent taxpayer identity theft have been so effective in recent years that scammers have evolved their tactics to focus on tax professionals, where they can steal client data.
For consumers, beware of a "debt collector" calling to say money was deposited by mistake and asking that it be sent to them. If you get such a call, hang up and contact the IRS to let them know, then tell your tax preparer.
It most likely means your tax return has already been filed with the IRS and the refund issued. However, since the scammer filled out the return, it might not have been done correctly.