Tax-related fraud more than doubled in 2020 compared to 2019, according to John Gilmore, head of research at private security firm DeleteMe.
Between 2016 and 2019 the trend had been declining, according to Gilmore. "There are 'boom years' where fraud rings relaunch mass scams, often prompted by special provisions or credits which may create opportunities for high success rates," he said. "These include the Child Tax Credit, COVID-related health care deductibles and the PPP. In December 2022, the new California Middle Class Tax Refund Inflation Relief Program was immediately targeted. Cards were either skimmed, or someone inside an organization breached data related to card recipients."
Although most believed there would be less fraud in the coming year than in previous years, Gilmore believes, based on early reporting, that the final numbers will be as bad or actually worse compared to previous years: "The Social Security number has become obsolete as a secure form of identification. The vast majority of Americans have had their SSN exposed. Every day and every month there have been massive data breaches of [personal identifiable information] that can be used to commit fraud."
"A full year's data has not yet been released for 2022 but an [Information Sharing and Analysis Center] report indicates a higher rate of attempted tax fraud than 2021," he said. "Children born in 2021 can be attractive targets for ID theft because last year's stimulus payments did not include a baby born in 2021, and there's a $1,400 recovery rebate remaining on the table. Also, a backlog of 20 million returns was creating opportunities for scammers."
Attempts to improve on the weakness of the SSN with text-message-based two-factor authentication have failed, according to Gilmore. "The government is facing fraud at scale and doesn't have identity verification tools to deal with the issue. It used to be that forms had to be filled manually and information cross-referenced from multiple sources. Paper forms had to be signed. Automation has made the low hit-rate of fraud more economically favorable for the fraudsters."
The Internal Revenue Service says that tax-related identity theft has evolved into "a major enterprise by well-funded, technically sophisticated national and international criminal syndicates."
Fraud organizations have professionalized and become technologically sophisticated and can now execute what used to be individual fraud using breached data sets and online PII to file thousands of fraudulent returns simultaneously, with bots — scripts that search for specific PII, fill in blanks, and can submit forms.
"The industry is also more vertically integrated, with specialists who each do OSINT [open-source intelligence gathering], packaging and selling of data, execution, and refund washing and debit card transfers," Gilmore said.
PII is now completely insecure, he indicated: "You can get databases with up-to-date information on hundreds of millions of Americans for pennies. What you can't get from breached data, you can get from scraping and social engineering sites. Scammers actively farm it from people daily with fake credit alerts and offers of cheap car insurance, and organizations are targeted for having weak Form W-2 security."
Gilmore said that DeleteMe's customer base tripled during the pandemic, with half of new clients seeking PII protection as a result of attempted or successful fraud attempts. The company removes clients' PII and "shrinks" their digital footprint. "Most sources are obligated to remove personal information on request, but the procedure is complicated and confusing. It would take the normal person hours of work to go through 40 different sites and complete the process of requesting removal," he said.
Solutions to the problem generally make it more complicated for individual users and generate pushback, according to Gilmore. For example, the elderly complain that complicating the system makes it harder for them to use. Biometric information can be hacked, and is criticized as generating disparate results for different ethnic groups.
"There are two choices," Gilmore concluded. "Continue the fraud, or agree on a solution that will improve on the problem associated with obsolete Social Security numbers."
