Surfing the SIRF: States are taking measures to keep taxpayers’ refunds afloat in a sea of identity theft
With Stolen Identity Refund Fraud on the rise, states are taking new approaches to help taxpayers stay ahead of the break or recover from a refund wipeout
Editor’s note: This article has been reviewed for changes following the passage of the 2017 Tax Cuts and Jobs Act. The information provided in this article was not affected by the 2017 TCJA.
Like a surfer evading overcrowded tourist surf spots, Stolen Identity Refund Fraud (SIRF) is migrating away from better-protected federal turf and heading to the local point breaks: state income tax refunds.
In 2015, state revenue agencies were flooded with stolen identity tax returns—so much so that they collaborated with the IRS and tax prep and software companies to implement a few quick fixes to better protect state and federal refunds for the 2016 tax season.
Taxpayers and tax professionals may have already noticed some of these efforts, such as requests for information from state-issued driver’s licenses or heavier password requirements and security questions within do-it-yourself tax prep software. But for some states, that wasn’t enough. Many went further to establish their own SIRF countermeasures.
What states are doing to protect taxpayers from SIRF
Like the IRS, state tax agencies are employing SIRF-prevention tactics before filing and targeting suspicious returns before issuing refunds. Many states are extending processing times during the 2016 filing season to allow for more filtering of potentially fraudulent returns before issuing refunds. Additionally, here are some specific measures that states are using to fight SIRF:
Identity verification letters
After taxpayers file their state returns but before they receive their refunds, they might receive a letter from their state revenue agency asking them to:
- Take an online quiz about themselves to verify their identity
- Go online and enter a PIN from the letter they received to confirm that they filed a return, or
- Submit copies of their driver’s license and other documents to the revenue agency to verify their identity
Receiving a letter like this will generally delay taxpayers’ refunds, but if taxpayers pass the quiz or enter the PIN promptly, the delay should be minimal, and ultimately, it will help ensure that refunds end up in legitimate taxpayers’ hands.
Mailing refund checks
Sometimes, a bogus tax return looks just like a real one, except for different direct deposit information. So, some states will mail taxpayers a check if their returns look suspect.
Holding all refunds until the state can verify wages
This is a relatively new tactic that Utah legislators first established, and Illinois and South Carolina quickly followed suit. The gist is that these three states will hold all refunds until March 1, at which point the revenue agencies will have received wage and withholding information from employers and compared it to the information on taxpayers’ returns.
Identity theft indicators on taxpayer accounts
Generally, an indicator on a taxpayer’s account means that states will closely review every return filed with the taxpayer’s Social Security Number (SSN). Some states go big and automatically delay the refund for weeks while they verify the return’s legitimacy. Other states go even bigger and require taxpayers with an indicator on their account to file a paper return.
Many states allow taxpayers to proactively request an indicator on their account. But before requesting an indicator, taxpayers should make sure they know exactly what that would mean for filing their state tax return and for any associated refunds.
Alerting taxpayers when a return is filed under their SSN
Alabama and Georgia are innovating new techniques for residents who set up taxpayer accounts with the state revenue agencies. Once taxpayers create an account, they can opt in to receive an alert if the state accepts a return filed with their SSN. If taxpayers receive an alert but haven’t filed yet, they can contact the agency, which will then stop the fraudulent return before issuing the refund.
These are just a few of the tactics that some state tax agencies are putting in place to better combat the rapid proliferation of SIRF. If taxpayers find out that they have already become a SIRF victim, there are several steps they should take.
How to recover from a tax identity theft wipeout
Like a big-wave surfer thrashed by a 25-footer, SIRF victims eventually have to come up for air and get back on the board. The IRS and Federal Trade Commission offer great resources to walk taxpayers through the process of mending their federal tax account and credit record, but state SIRF is less straightforward.
A state SIRF victim not only has to address identity theft and any resulting tax compliance issues in the states where he or she is required to file a return, but the taxpayer also has to worry about other states where a fraudster may try to file a bogus return using the taxpayer’s identity. If that happens, those other states will eventually contact the taxpayer, usually because of compliance issues resulting from the fraudulent return.
State revenue agencies provide various methods to report identity theft at the state level, from online fillable forms to fraud department phone lines. It’s a good idea for taxpayers to start by visiting their state revenue agency’s website and searching for identity theft. More likely than not, taxpayers will find instructions or a phone number to call. If all else fails, taxpayers should call the general customer service phone line.
Here are the generally recommended steps taxpayers should take when they find out that they’ve become victims of identity theft:
- File Form 14039, Identity Theft Affidavit, with the IRS.
- File a police report.
- File an identity theft report with the Federal Trade Commission.
- Check their credit reports for unauthorized activity.
- Request a freeze or fraud alert on their credit.
Depending on the state, taxpayers may also need to submit a paper tax return, documents verifying their identity, and a police report. Again, taxpayers should begin the state restoration process by visiting their state revenue agency’s website.
Coming out the other end of the pipeline
The proliferation of data breaches in recent years has exposed sensitive taxpayer information and left taxpayers vulnerable to a tax identity theft wipeout. However, using available preventative measures and following an informed plan of corrective action in the event of SIRF are important practices for taxpayers to protect their state and federal refunds. And with every tax season, the IRS, state revenue agencies, and the entire tax industry will continue working together to refine strategies to combat the rising tide of SIRF.
Editor's note: This article originally appeared in Accounting Today.