The recent flood of fraudulent tax returns—both state and federal—is the work of “a criminal gang, possibly working outside the country,” a leading cyber security expert told NBC News.
Haywood Talcove, CEO for government solutions at LexisNexis, believes the gang is using stolen user names and passwords to gain access to the accounts of people who use online tax preparation software.
“This is potentially the most serious breach of personally identifiable information in the history of our country,” Talcove said. “The tax form is the mother lode of personal information.”
Armed with this stolen information—Social Security number, date of birth, dependents, employer and adjusted gross income—the thieves can file bogus state and federal income tax returns. If they can file before you do and their fake return makes it through the system, they can steal a sizeable refund.
The IRS says that it is working with the software industry and with state tax officials to battle fraud. “Preventing and detecting identity theft and refund fraud remains a top priority for the IRS,” the agency said in a statement on Friday. It added that taxpayers should continue to file their tax returns as they normally would.
The vulnerability of online tax preparation services became apparent last week when the Utah Tax Commission and the Minnesota Department of Revenue found thousands of potentially fraudulent returns. Those returns were filed using TurboTax, the popular program made by Intuit.
Intuit temporarily stopped the transmission of e-filed state income tax returns on Friday while it investigated. It resumed processing state returns after announcing that it implemented additional verification measures, such as multi-factor authentication, a technology that has proven effective at preventing identity theft.
In a blog post on Friday, the company wrote that filing of federal returns was not affected. But on its Answer Exchange page (how did my TurboTax account get hacked into), a half-dozen customers reported fraud problems with their federal return. The company agrees that is the case.
“We’re absolutely aware that tax fraud is happening at the federal level as well, using compromised credentials,” Julie Miller, Intuit’s vice president of communications told NBC News. “This is a multi-front battle and we are going to fight it at both the state and federal level.”