6 ways to keep your tax data secure

December 19, 2024 9:30 AM

If there's a sucker born every minute, the birthrate of scammers seems to keep pace.

"Abundant scams and rip-offs being seen by the IRS and the Security Summit partners include ever-evolving and increasingly sophisticated phishing emails and related attacks," the partners in the Security Summit initiative announced at the kickoff of the recent National Tax Security Awareness Week. The group includes the Internal Revenue Service, states, the tax industry and tax pros. (Summit members have launched a related group, the Coalition Against Scam and Scheme Threats.)

Throughout the week, they shared the latest ways crooks are attacking — and how tax pros can defend themselves and their clients.

The basics: Simple but effective

Everybody should take simple — and frequently overlooked — steps to protect their important financial and tax information: Set security software to automatically update; back up files; use strong passwords and multifactor authentication; and encrypt all devices.

Businesses are also encouraged to keep EIN information current and use Form 14039-B to proactively report potential identity theft if they receive an unexpected rejection notice for a filed return, get a notice about a return or W-2 they never filed or get a notice about a balance due when one isn't owed.

Have a plan for that

One hand stopping dominoes falling -- risk concept

Monster Ztudio - stock.adobe.com

This year, the IRS has received more than 250 reports of data breach incidents from tax professionals affecting some 200,000 clients. (Tax pros now need to report a security event affecting 500 or more people to the Federal Trade Commission in no more than 30 days.)

Practitioners are urged to review the newly updated Written Information Security Plan. Tax pros are required by federal law to have written plans identifying foreseeable data security risks and safeguards and to have an action plan in case of a security breach. A Tax Pro Account is also a secure application that enables tax pros to act on a client's behalf.

Special delivery

Eugen Wais/EwaStudio - Fotolia

The week's tips began with a warning appropriate for Cyber Monday: Approach holiday shopping with caution because scammers are also shopping — for their next victim's personal info.

A common example involves victims getting a text or email purporting to come from a company or business saying a delivery can't be made, along with a link to click to reschedule. The link is a form of phishing to steal personal info or download malware.

Don't shop on unsecured public Wi-Fi in places like malls and restaurants. Protect devices of family members who may not be technologically savvy and make sure anti-virus software can block malware.

Teach someone to phish

Ivelin Radkov/Ivelin Radkov - Fotolia

Phishing emails or SMS/texts (known as "smishing") trick a recipient into clicking on a suspicious link, filling out information or downloading malware.

Spear phishing, rather than emailing large groups, targets specific victims and delivers a more realistic email known as a "lure." Whaling attacks resemble spear phishing except they generally target leaders or other execs. Clone phishing is a newer type of phishing that clones a real email message and resends it to the original recipient pretending to be the original sender; the new message has either an attachment with malware or a link to steal information.

Good examples of bad advice

ByteDance Ltd.'s TikTok app button, reflected in a mirror, is arranged for a photograph on a smartphone in Sydney, New South Wales, Australia, on Monday, Sept. 14, 2020. Oracle Corp. is the winning bidder for a deal with TikToks U.S. operations, people familiar with the talks said, after main rival Microsoft Corp. announced its offer for the video app was rejected. Photographer: Brent Lewin/Bloomberg

Brent Lewin/Bloomberg

Scams and plain bad advice have escalated on social media, including scams ranging from the Fuel Tax Credit to "pig-butchering" schemes that involve investments in fake crypto. Crime drives some of the producers of misleading content on social media; others, believe it or not, merely want attention and clicks and don't care what happens to readers.

Widespread bunk also includes a "self-employment tax credit" supposedly worth up to $32,000 but simply preaches misuse of a Form 7202; filing a Schedule H based on phony sick and family medical leave wages; self-composed W-2s; and suggested deductions that equal the entire year's wages.

Safety in numbers

Picasa/JohnKwan - Fotolia

Taxpayers should safeguard their returns with an Identity Protection Personal Identification Number before the 2025 tax season. The unique six-digit number is available to anyone with a Social Security number or an ITIN, is set up using an IRS Online Account, and is only valid for a year.

(Parents or guardians with custody of minor children and other dependents can secure IP PINs on their behalf but have to fill out a paper Form 15227.)