IRS data breach: What the IRS is doing and steps taxpayers can take.
Scope of the scam was small. About 23 million taxpayers used the IRS online Get Transcript application this past filing season. IRS says there were 200,000 attempts to gain access to Get Transcript, and 100,000 of these succeeded. It stressed that the scammers did not gain access to other applications, such as Where's My Refund.
What IRS is doing. IRS has temporarily shut down the online version of its Get Transcript service, but it says transcripts may still be ordered using the Get Transcript by Mail service. To use the latter service, taxpayers need Social Security number (SSN) or Individual Tax Identification Number (ITIN), date of birth, and address from their latest tax return.
As for taxpayers that were affected by the scam, IRS says it is taking several steps, including marking the accounts of affected taxpayers on its core tax account system to protect them against identity theft if someone else tries to file a tax return in their name, both right now and in 2016. IRS is also sending letters to affected taxpayers with additional information and offering credit monitoring to those whose transcript information was accessed.
IRS also urged taxpayers not to call to see if they will be getting a letter, as phone lines remain extremely busy due to staffing limitations and personnel won't have access to additional information. Affected taxpayers will be receiving a letter directly advising them about the attempted or successful unauthorized access to their transcript and how to activate the protections IRS is offering them.
In the past, IRS hasn't notified victims of scammers and didn't release copies of fraudulent returns once individuals discovered they had been victimized. In response to a request made by Senator Kelly Ayotte (R-NH), IRS Commissioner Koskinen last week wrote her to say IRS has changed its policy. It will issue a procedure that will enable victims to receive, upon request, redacted copies of fraudulent returns filed in their name and SSN.
What taxpayers can do. IRS gives the common sense advice that individuals should think twice before posting publicly personal or financial information on social media or the Internet. (It's been reported that scammers can troll through vast amounts of information online, assemble the pertinent data, and then use it to impersonate taxpayers.) IRS also says individuals should also make sure their computers are up to date with the latest security software.