Here's a message you really don't want to receive from the Internal Revenue Service: Someone has already received your tax refund.
However, that's a reality for thousands of people each year. In 2018, the Federal Trade Commission received 38,967 reports of identity theft for tax fraud, a 38% decrease from the year before.
Fraudulent tax returns can be a headache, but they typically don't result in a taxpayer losing their refund. "It's probably going to be fine," says Bill Smith, a managing director for the accounting firm CBIZ MHM's National Tax Office, based in Bethesda, Maryland. However, that doesn't mean you'll be getting your refund quickly. Smith estimates that it takes the IRS about six months to investigate and issue a refund to the appropriate person in many of these cases.
Fortunately, you can avoid a delay in your refund by taking steps to prevent tax identity theft in the first place. Read on to learn how to keep your data safe, how to know when someone has filed a fraudulent tax return in your name and what steps to take if you become a victim.
[Read: How to File Back Taxes.]
How to Prevent Tax Identity Theft
There is nothing unique about how fraudsters steal personal information for tax fraud. "Usually it originates with a traditional identity theft scheme," says David Britton, vice president of industry solutions, global identity and fraud at global technology company Experian.
That means many of the best practices you should already be employing to keep your data safe will protect you against tax identity theft. These include the following six strategies:
-- Use strong passwords.
-- Watch out for scams.
-- Don't carry your Social Security card or number.
-- Send sensitive information over secure channels.
-- File as early as possible.
-- Only work with reputable tax preparers.
Use strong passwords. Strong passwords that combine letters, numbers and characters are now required on many websites. Even if they aren't mandatory, you should use them. "It's so important for people to protect themselves," says Ana del Cerro-Fals, principal in the tax and accounting department for the Miami office of accounting firm MBAF. Use a different strong password for every one of your financial accounts and opt in to two-factor authentication if offered. This option will require you to verify your login through a secondary method, such as entering a code sent via text.
Watch out for scams. Scam emails, texts and calls are often how fraudsters collect sensitive data. "A lot of identity theft starts with things like old-fashioned phishing attacks," Britton says. In these attacks, criminals may impersonate your bank or a trusted website and send fraud alerts or other notifications. When you respond to them, you may be asked to provide your Social Security number or password. These sorts of requests should be red flags. "If it doesn't feel right, it's probably not right," Britton says.
Sometimes criminals will pretend to be IRS agents, and an unsolicited call from the agency should be another tipoff that a scam is afoot. "The IRS doesn't contact you out of the blue," Smith says. "If you get an email from the IRS, it's not from the IRS." The agency uses postal mail for most communications and will never call or email to request financial information.
Don't carry your Social Security card or number. There is no reason to have your Social Security card or number with you at all times. If your wallet is stolen and it contains both your driver's license and Social Security number, a thief will have everything he or she needs to file a fraudulent tax return in your name.
Send sensitive information over secure channels. There are instances when you might need to give someone your Social Security number. For example, a tax preparer will need it to complete your return. However, sending it via an unsecured email or over the phone in a public location can be a mistake. "Be very careful when sending your Social Security number electronically," del Cerro-Fals says. She notes her firm has a portal where clients can log in to share sensitive data. This ensures it isn't sent in emails that could be intercepted by criminals.
File as early as possible. Scammers usually file returns as soon as tax filing opens, hoping to receive refunds before the real taxpayers report their fraud. However, if you get your return in first, the fraudulent filing can't be processed. "One of the best remedies is to file early," Britton says.
Only work with reputable tax preparers. Tax preparers have been both victims and perpetrators of scams. If you hire someone else to do your taxes, hire someone with good references and experience. You can check whether preparers hold credentials recognized by the IRS. While vetting preparers, ask what security measures they use to protect your data.
[Read: 10 Top Year-End Tax Tips]
How to Know if Someone Filed a Return in Your Name
If the IRS flags problems with your return, you'll get a letter before any refund is issued. That gives you the opportunity to tag the initial return as fraudulent and then file normally.
"They have systems to try to identify suspicious returns," explains Jeffrey Craig, principal and senior wealth advisor with the financial planning firm The Colony Group in Boston. If the IRS algorithms don't detect any anomalies and process the fraudulent return, you won't find out about it until you try to file your own return and have it rejected.
Of the two options, the second is most common. "By and large, for most people, it's the e-file rejection notice (that notifies taxpayers of a problem)," Smith says.
That notification won't provide specific information though. "They are not very detailed in their reasons," del Cerro-Fals says. Instead, the notification will indicate there was a problem with the Social Security number. Assuming you haven't transposed any numbers, it's likely that tax identity theft is the reason for the rejection.
What to Do if You're a Victim of Tax Identity Theft
If you do discover someone has filed a fraudulent tax return in your name, here are eight steps to take:
-- Complete a paper return.
-- File Form 14039.
-- File a police report.
-- File a report with the Federal Trade Commission.
-- Request a copy of the fraudulent return.
-- Check your credit reports and account statements.
-- Put a credit freeze on your accounts.
-- Get a PIN for tax filing.
Complete a paper return. "The fact that your e-filed return was rejected doesn't mean you don't have to file," Craig says. Be sure you submit a paper return, along with any required payment, by the filing deadline to avoid tax penalties or late fees.
File Form 14039. Fill out and attach Form 14039, Identity Theft Affidavit, with your paper return. If you receive a letter from the IRS or otherwise suspect you're the victim of ID theft, you can also complete and mail this form. Your case then goes to the Identity Theft Victim Assistance organization, which will request documentation proving your identity. That documentation can vary by case but may include copies of your driver's license, Social Security card or utility bills, del Cerro-Fals says.
File a police report. Next, file a police report with your local law enforcement agency. "The police probably aren't going to go out and find the culprit," Craig says. However, having a report might be useful to stop collection efforts if your identity is used to rack up debt as well.
Your fraud may also be part of a larger local fraud scheme. The more information the police have, the better chance they have of cracking the criminal enterprise. Depending on the size of your local police department, there may even be a division that deals with financial crimes or ID theft.
File a report with the Federal Trade Commission. While the FTC doesn't investigate identity theft cases, it does compile statistical information on the crimes and offer helpful information on its website for taxpayers who face this situation. Visit IdentityTheft.gov to file a report and receive a recovery plan.
Request a copy of the fraudulent return. Victims of identity theft are entitled to receive a copy of the fraudulent tax return filed with their Social Security number. "It's possible your child's Social Security number was compromised," Craig says. Requesting a copy of the return can help you determine what family information was used by the thief. Request the return using Form 4506-F.
Check your credit report and account statements. A fraudulent tax return may be only the tip of the iceberg. "Fraudsters tend to use stolen identity data for more than one purpose," Britton says. Make sure no one has charged anything to your credit card accounts, changed your address or otherwise done anything you did not authorize. Consider changing passwords to online accounts and deleting your credit card information from online shopping sites.
Put a credit freeze on your accounts. Call the three major credit bureaus -- Experian, TransUnion and Equifax -- and ask that your credit be frozen. That way, no one can request new credit in your name. Keep in mind that if you apply for a new cellphone or utility account, or otherwise agree to a credit check, you'll have to lift the freeze long enough for the check to be done.
Get a PIN for tax filing. You can add an extra layer of protection to your tax filing if you use an IRS-provided personal identification number. You can request a six-digit IP PIN if the IRS has invited you via mail to opt-in or if you filed your tax return from certain states, including Georgia and Florida, or if you filed in the District of Columbia. But once you get a PIN, you can't file without it. "Once you're in, you're in," Craig says. So be sure you're comfortable with the process of requesting a PIN and filing with it each year.
More From US News & World Report