If the idea of filing your income taxes electronically makes you uneasy, this is not going to come as good news. If you have filed your federal taxes, or you're getting ready to, you may have heard that the IRS has been beefing up its efforts to keep you safe. That's a great thing.
In fact, a few months ago, the IRS held a Security Summit to advise taxpayers and tax preparers to stay safe. In the months since then, they've been issuing alerts to taxpayers with the tagline, "Taxes. Security. Together. We all have a role to play in protecting your data."
One of those ways is the IRS's Identity Protection PIN (personal identification number). The IRS recently ranked ID theft as No. 1 on its Dirty Dozen list of tax scams.
The IP PIN is a timely idea, and a good one. A year ago, the IRS was hacked, with 724,000 taxpayer IDs compromised.
The way the IRS's IP PIN works is, they invite you to sign up for one, if your ID has been stolen. According to the IRS: "An IP PIN helps the IRS verify a taxpayer's identity and accept their electronic or paper tax return. When you have an IP PIN, it prevents someone else from filing a tax return with your SSN."
Unfortunately, the IRS's IP PIN has been hacked. The IP PIN is a six-digit code that you include on your tax returns.
In at least one case, the IRS's identity protection system has been hacked, according to a cybersecurity expert. A South Dakota woman, who had been issued an IP PIN by the IRS in 2014, said it was fraudulently used to file a 2016 tax return.
In other words, someone stole her IP PIN and filed a federal tax return, to collect a tax refund. It's not clear how the cybercriminal stole her IP PIN.
However, it's likely the person was able to answer security questions needed to retrieve it. Those knowledge-based authentication (KBA) questions, like "What street did you live on," are easy for some people to answer, especially if they know you or have stolen your ID.