Update: The IRS said Tuesday that cybercriminals obtained prior-year tax returns for over 100,000 U.S. households using information stolen from other sources, including Social Security numbers. An additional 100,000 attempts to access prior-year returns were blocked, the agency said. The IRS sent nearly $50 million in fraudulent refunds before detecting the scam, the NYT reports. In 2013, the agency paid $5.8 billion in falsely claimed refunds. The article below provides a guide for steps individuals can take to try and protect themselves from the risks of ID theft and tax fraud.
Yahoo Finance's Adam Samson contributed to this report
We live in an age of cyber-insecurity but I recently got a troubling reminder of the "old-fashioned" risk of identity theft when I received the following email from my accountant: "I am GREATLY concerned, your tax package arrived this morning and the envelope was completely opened when delivered to our office by the mailman. There were only 16 pages in the envelope and no W-2 or any other documents." (Emphasis his.)
Panic was my initial reaction to knowing my and my wife's W-2s, along with other sensitive and highly personal information, were floating around unchecked. We do have a LifeLock (LOCK) account which gave me some solace; I hurriedly checked to make sure our account was up to date (it wasn't). Still, that wasn't enough to stop the feeling that our financial security had been violated and our financial well-being was at grave risk.
Panic is an understandable but largely fruitless reaction. So after the initial shock subsided, I contacted colleagues and experts in the field to ask their advice. What follows is a compilation of the steps I've taken and some other recommendations, which I hope can serve as a useful tool for anyone who finds themselves in a similar predicament.
Here's what to do if your most important personal information is compromised or stolen.
Adam Levin, chairman and founder of Credit.com says FIRST, you should avoid mailing your tax documents.
"Generally any time around tax season that large envelopes go to accounting firms from consumers, there are people out there that are very interested in that mail," he says. "It’s literally the encyclopedia of your life and therefore instead of trusting it to the mail I suggest that you either bring it by hand or at the very least Federal Express it, make sure that it’s done quickly, efficiently, trackably and where there’s accountability."
Honestly, I'm not sure what the option is other than to mail our tax package. My wife owns her own business and we own an investment property so there's nothing "simple" about our return. Plus, it would be a pretty big file to send electronically (which has its own risks, right?). For the record, we did mail via USPS Priority Mail so had a tracking number and, ideally, some accountability. My wife called and was told the Post Office takes these matters very seriously; we were given a "case number" and told to expect follow up, which frankly has been a little lacking. To date, we've had exactly two pages that were missing mailed back to us.
"While this probably won’t be very comforting for you, the rest of the missing documents were likely too damaged to garner identifiable information to be returned," a USPS spokeswoman told me via email. "For what it’s worth, it’s not very common and our employees go above and beyond to get mail like this home when it does happen."
So without further ado, here's the checklist of concrete steps to take if your identity has been stolen or compromised.
Put a fraud alert on your credit file. This link will add it to your files at the three credit reporting firms, Equifax, Experian and TransUnion. You can also add the same alert to your file at an Innovis. You can also request a "freeze" on your credit file but will need to contact each firm individually; depending your state, there may be a small charge to place a freeze on your account, which can help prevent someone from opening a credit line in your name -- but will also stop you from getting one so make sure to lift the freeze if you're trying to get a loan or new credit card. (You can find a state-by-state breakdown of credit freeze rules here.)
Uncle Sam is here to help. The IRS has a comprehensive guide about what to do and recommends filing complaints with your local police and the Federal Trade Commission here.
The IRS also offers consumers a way to put an alert on your tax ID via this Identity Theft Affidavit. At least the IRS will theoretically be on the lookout for scams where crooks try to steal your tax refund.
Vigilance is the best defense. Finally, you can check your credit account frequently to make sure nothing fishy is going on, or sign up for a credit monitoring service such as AllClearID, IDT911 (which Levin co-founded) or ProtectMyID. Free monitoring can't hurt but "the sad truth is that most services offer little in the way of real preventative protection against the fastest-growing crime in America," writes security expert Brian Krebs.
I wouldn't wish identity theft on my worst enemy (you know who you are) and hopefully you'll never have to use any of these tools. But keep this post handy, just in case.
Aaron Task is Editor-at-Large of Yahoo Finance. You can follow him on Twitter at @aarontask or email him at firstname.lastname@example.org.