Tax preparers should look out for these signs that a criminal stole information

Notice: Historical Content


This is an archival or historical document and may not reflect current law, policies or procedures.

IRS Tax Tip 2018-152, October 1, 2018

Tax professionals should be alert to the subtle signs of data theft. The IRS and its Security Summit partners note that there are many cases where preparers are victims of theft and don’t even know it.

Cybercriminals often leave very few signs of their intrusion. A tax preparer might not even realize that the cybercriminal stole client data until a fraudulent tax return was filed with the information, and their client becomes an ID theft victim. This is one more reason tax professionals should use strong security protections to prevent data theft from occurring.

Here are some warning signs that a preparer’s office may have experienced a data theft:

  • Client e-filed returns that were filed electronically begin to be rejected by the IRS. The reason given is that someone already filed a tax return with the same Social Security number.
     
  • Clients who haven’t filed tax returns begin to receive taxpayer authentication letters from the IRS. These letters include the 5071C, 4883C and 5747C.
     
  • Clients who haven’t filed tax returns receive refunds.
     
  • Clients receive tax transcripts that they did not request.
     
  • Clients who created an IRS online services account receive an IRS notice that their account was accessed. They might also receive an IRS email saying their account has been disabled.
     
  • Clients unexpectedly receive an IRS notice that an online account was created in their names.
     
  • The number of returns filed with the tax professional’s Electronic Filing Identification Number exceeds their number of clients.
     
  • Tax professionals or clients are responding to emails that the firm did not send or does not remember sending.
     
  • Network computers are running slower than normal.
     
  • Computer cursors moving or changing numbers without someone touching the keyboard.
     
  • Network computers lock out employees.

The IRS and its partners in the Security Summit are alerting tax preparers about the signs of an ID theft as part of the Tax Security 101 awareness initiative. The goal is to provide tax professionals with the basic information they need to better protect taxpayer data and to help prevent the filing of fraudulent tax returns.

More information

Subscribe to IRS Tax Tips