How Thieves Get Your Tax Returns

Reforming refunds.

Photographer: Andrew Harrer/Bloomberg

Although tax day in the U.S. is still two months away, a few enterprising businessmen have been busy filing returns to the Internal Revenue Service. Unfortunately, their business is fraud.

TurboTax, the popular online tax-filing service, briefly stopped submitting returns to state authorities last week after a spike in suspicious filings. Taxpayers figured out there was a problem when they tried to file their returns and were informed they had already done so -- with someone else, presumably, on the receiving end of their refunds. (Shocking but true: Three out of four taxpayers got a refund from the IRS last year.) 

How the information was obtained, and why TurboTax seems to have been targeted, isn't yet clear. But in broad terms, this scam is familiar. And it doesn't exactly require a criminal mastermind.

With a name, birth date and Social Security number -- which cost as little as $3 per record on the black market -- thieves can fill out a phony tax form online, direct the refund to a post-office box or a burner debit card, and then enjoy their ill-gotten gains. All told, such fraud cost the IRS some $5.2 billion in 2013.

State tax authorities, which typically have less sophisticated defenses, now seem to be in the crosshairs of this scheme: Nineteen were affected by the TurboTax incident. They might consider emulating an IRS pilot program that offers taxpayers more protection by requiring a PIN to submit returns. Brad Smith of Intuit, the maker of TurboTax, also argues for more information sharing between the IRS, state authorities and vulnerable businesses. With appropriate privacy protections, that sounds promising: The IRS has already had some early success pooling information with state and local police.

Congress could also help. For one thing, it could refrain from gutting the IRS's budget, which has declined by $1 billion since 2010 even as the agency confronted a "huge spike" in identify thefts. Now a single case takes about 180 days to resolve. The IRS also needs more time. By law, the agency must send refunds within 45 days of the filing due date or pay interest to the taxpayer. Because it accepts individual returns beginning in January, yet usually doesn't receive corresponding forms from employers until July, the agency typically can't compare the two for verification before sending out refunds. That gives criminals a crucial window.

Requiring companies to file earlier -- and requiring more of them to file electronically -- would mitigate this fraud, in addition to reducing the agency's workload and cutting down on errors. Likewise, shifting the filing season, or simply allowing the IRS more time to issue returns, would be helpful.

These reforms would, of course, come with complications. But sending refunds out the door without fully validating them is an invitation to further criminality.

To contact the senior editor responsible for Bloomberg View’s editorials: David Shipley at davidshipley@bloomberg.net.