IRS warns of new scam involving erroneous tax refunds

The Internal Revenue Service warned taxpayers Tuesday to beware of a quickly proliferating scam involving erroneous tax refunds being deposited in their bank accounts, after a data breach on their tax preparers' computers gives them access to sensitive client information.

The IRS also provided taxpayers with a step-by-step explanation for how they can return the funds and avoid falling prey to the scammers.

The new alert follows up on a Security Summit alert that came out earlier this month warning tax professionals about phishing emails that can download malware onto computers if they are clicked (see IRS sees new filing season scam hitting tax pros). The IRS released the extra warning Tuesday about the new scheme after learning that more tax practitioners’ computer files have been breached. On top of that, the number of potential taxpayer victims jumped from a few hundred to several thousand in only a few days. The IRS’s Criminal Investigation division is continuing to investigate the expanding scope and breadth of this scheme.

Basically this is a new twist on an old scam, the IRS noted. After the cybercriminals steal client data from tax professionals and file fraudulent tax returns, they use the taxpayers' real bank accounts for the deposit. Thieves then employ various tactics to reclaim the refund from taxpayers.

The scam is continuing to evolve in new versions. In one version, the criminals impersonate debt collection agency officials acting on behalf of the IRS. They contact taxpayers to tell them a tax refund was deposited in error and ask taxpayers to send the money to their collection agency.

In another version, the taxpayer who received the erroneous refund receive an automated phone call with a recorded voice saying he is from the IRS and threatens the taxpayer with criminal fraud charges, an arrest warrant and a “blacklisting” of their Social Security Number. The recorded voice provides the taxpayer with a case number and a phone number to call to give back the mistaken refund.

The IRS repeated its warning from last week for tax professionals to increase the security of their sensitive client tax and financial files. The IRS is also asking taxpayers to follow the established procedures for returning an erroneous refund to the Service. The IRS wants taxpayers to discuss the issue with their financial institutions because there may be a need to close bank accounts. Taxpayers who get erroneous refunds also should contact their tax preparers immediately.

As this is now peak season for filing returns, taxpayers who file electronically could find their tax return has been rejected because another return with their Social Security number is already on file. If that happens, taxpayers should follow the steps detailed in the Taxpayer Guide to Identity Theft. Taxpayers who can’t file electronically should mail a paper tax return along with Form 14039, Identity Theft Affidavit, telling the IRS they were victims of a tax preparer data breach. Taxpayers who receive the refunds should follow the steps in Tax Topic Number 161 - Returning an Erroneous Refund. It includes the mailing addresses in case they to return paper checks to the IRS. By law, the IRS noted, interest may accrue on erroneous refunds.

Andrew Harrer/Bloomberg