IRS Failed To Identify & Assist All Taxpayers Affected By “Get Transcript” Data Breach

VG49081NDDLast month, the IRS announced that they’d reopened the “Get Transcript” application with a more rigorous authentication process. The application was shut down in May of 2015 after the IRS discovered that identity thieves had hacked the system to access tax return information of around 724,000 taxpayers. At the time, the IRS announced it would notify all taxpayers whose accounts had been accessed and allow them to request an identity protection personal identification number (IP PIN), offer free credit report monitoring for a year and flag the accounts in order to more closely scrutinize returns.

TIGTA identified 355,262 taxpayers whose tax account information was successfully accessed but were not notified by the IRS. TIGTA also identified an additional 2,470 taxpayer accounts that were targeted by the breach that the IRS failed to identify.If you didn’t receive a notice that your account was affected by the breach, you can rest easy, right? Not so fast. The good news was quickly overshadowed by this week’s report from the Treasury Inspector General for Tax Administration (TIGTA) announcing that the IRS failed to identify and assist all affected taxpayers.

Of the hacked accounts identified by the IRS, 3,206 did not get flagged by the IRS for closer scrutiny. The IRS also failed to offer an IP PIN or free credit monitoring to 79,122 taxpayers who were identified as being affected by the breach.

TIGTA made eight recommendations to the IRS, including that it issue IP PINs to the 79,122 taxpayers whose personal identification was used to access the “Get Transcript” application. The IRS disagreed with that recommendation, but acknowledged the inconsistency in its IP PIN issuance policy and stated they would “consider this inconsistency in future IP PIN policy decisions.”

The IP PIN is a six-digit number that is issued to eligible taxpayers to help prevent the misuse of Social Security numbers on fraudulently filed returns. If a taxpayer has been issued an IP PIN, the number must be used on all e-filed returns. The e-filing system will reject any returns missing IP PINs and paper-filed returns will face delayed processing.

Many of my clients, concerned about identity theft, have asked about requesting an IP PIN as a proactive safeguard against fraudulent returns being filed using their Social Security numbers, but IP PINs are not available for everyone. You can only choose to receive an IP PIN if you receive a letter from the IRS inviting to you “opt-in” or if you filed a federal return in 2015 with an address in Georgia, Florida, or the District of Columbia.

The IP PIN request tool was temporarily suspended in March of this year while the IRS reviewed the application and strengthened its security features. Taxpayers who have lost or misplaced their number can call the IRS and request that the number be mailed to their address of record. If the taxpayer has moved since January 1, 2016, they’ll have to file a paper return.

In its announcement for the relaunch of the Get Transcript application, the IRS indicated that the enhanced authentication process would provide a foundation for additional self-help tools in the future, so perhaps a relaunch of the online IP PIN tool is on the horizon.

This post originally appeared on Forbes.

Image: Wiebe


Leave a Reply