FS-2016-4, January 2016 The Internal Revenue Service, the states and the tax industry have taken new steps for 2016 to protect you and help reduce the risk of identity theft affecting your tax returns this filing season. It’s no secret that identity theft of all kinds is persistent, time consuming and frustrating. When criminals steal your personal data (especially your name and Social Security number) they can use that information to file a fraudulent tax return. That’s referred to as tax-related identity theft. Real progress has been made, but more must be done. Tax-related identity theft today isn’t what it was even a few years ago — think “dumpster-diving” for personal records or thefts of such records from stores, doctors and other offices. Increasingly, sophisticated and organized syndicates are committing these crimes in high-volumes of stolen records through data breaches and database intrusions. As the criminals evolve, so must we. That’s why the IRS, states and tax industry are committed to working together to combat tax-related identity theft and refund fraud. This group, called the Security Summit, has announced stronger protections for taxpayers and the nation’s tax system that will go into effect for the 2016 tax season. The Security Summit designed these protections to reduce the chances that you’ll become the victim of tax-related identity theft. For details about new safeguards for 2016, see Fact Sheet 2015-23. You state tax agency may also have changes specific to your location. Review your state’s tax agency website for additional details. What’s changing for you? The new measures attack tax-related identity theft from multiple sides. Many changes will be invisible to you but invaluable to the IRS, states and tax industry in protecting you. Here are some important changes you may see: There will be new security requirements when you’re preparing your taxes online, especially when you sign in to your tax software account, to better protect your tax software account and personal information. Some state returns may ask for additional identity information, such as your driver’s license number, to make sure it’s really you. The IRS will still process nine out of 10 federal refunds within 21 days. States have their own refund processing timeframes that will vary, and some states may make additional reviews to ensure refunds are being issued properly. We need your help While we’re working to strengthen tax-filing security, we’re also asking taxpayers to take steps to help protect their information as part of our Taxes.Security.Together. campaign. A few highlights: Always use security software with firewall and anti-virus protections. Make sure the security software is always turned on and can automatically update. Encrypt sensitive files such as tax records you store on your computer. Use strong passwords. Learn to recognize and avoid phishing emails, threatening calls and texts from thieves posing as legitimate organizations such as your bank, credit card companies and even the IRS. Do not click on links or download attachments from unknown or suspicious emails. Protect your personal data. Don’t routinely carry your Social Security card, and make sure your tax records are secure. Treat your personal information like you do your cash; don’t leave it lying around. For these and other tips, see Publication 4524 PDF, Security Awareness for Taxpayers, available at IRS.gov. Frequently Asked Questions for Taxpayers How will the new safeguards affect me? Our goal is to verify your identity and the validity of your return before the return is accepted for processing. The 2016 safeguards are aimed at those of you who prepare your own federal and state tax returns using tax software. The IRS, the states and tax industry will be sharing and analyzing data that will help us spot identity theft returns. There are multiple safeguards being put in place that don’t require you to do anything. We will do it all behind the scenes. You may experience some minor inconvenience in the way of an additional step or two, which are for your protection. For example, you will likely see new password requirements when you access your tax software account. This is to help prevent identity thieves from stealing your password and taking over the tax software account. Additionally, we are trying new approaches. Some states may ask for driver’s license numbers as an additional authentication step. You do not need a driver’s license to file your federal return. Why do I have to create a new password for my tax software account? To ensure that only you can access your tax software account, additional security has been added when you log in or create an account for tax software. New password requirements will help you create a strong password, the first line of defense in protecting your tax software account. You must have a minimum password of 8 digits, including alphanumeric and special characters. You will also be prompted to answer three security questions that can be used to verify your identity when you sign in. New lock-out features will be in place, limiting the time and attempts to access your tax software account. Software also will verify your email address. Some in industry will use out-of-band verification for email addresses, which is sending an email or text with a PIN to the customer — a common practice used throughout the financial sector. Do I need a driver’s license number to file a return? You do not need a driver’s license number to file a federal return. Some states may request your driver’s license number for state tax returns because they have the ability to match state records and help confirm your identity. This is one more layer of protection against identity thieves. State tax software will prompt you for your driver’s license number if it is requested by the state. You also can review state revenue department websites for information. Why am I being asked for my driver’s license number? In an effort to better protect you from identity thieves, some states will be trying new approaches. Some states may ask for additional identification information, such as your driver’s license number, when you are preparing your state tax return. This will be another layer of protection because identity thieves may already have your name and Social Security number, but perhaps not your driver’s license number. States requesting this information have the ability to match driver’s license information and other identifying records to help confirm your identity. You do not need a driver’s license number to file your federal tax return. How will these safeguards affect my refund? Although you may file your federal and state tax returns at the same time, they are processed separately. The tax software sorts the returns and sends the federal return to the IRS and the state return to the proper revenue agency. This is why you receive your federal and state refunds separately and at different times. The IRS will issue nine out of 10 federal refunds within 21 days. You can easily track your federal refund at IRS.gov by using the Where’s My Refund? tool. Like the IRS, states are doing more to verify identities before issuing state refunds. In some cases, states may take extra time to ensure that you, not an identity thief, will receive a state refund. In some states, under certain circumstances, taxpayers who request direct deposit of a state refund will receive a paper check in the mail. Timeframes for state refunds will vary. For details, check your state tax agency’s website. What do I do if I think I am already a victim of identity theft? Here are some warning signs of identity theft at the federal level: More than one tax return was filed using your SSN. You owe additional tax, have had a refund offset, or have had collection actions taken against you for a year you did not file a tax return. IRS records indicate you received wages from an employer unknown to you. There are a variety of ways you may learn you are a victim and your response depends on whether the IRS tells you that you may be a victim or you tell the IRS. You may receive a letter from the IRS asking about a suspicious return with your SSN and asking you to verify your identity at IDVerify.irs.gov. All you need to do is follow IDVerify.irs.gov directions and report whether or not you filed the return. If you believe that you are a victim because your tax return rejected when e-filed because of a duplicate SSN (and you know there are no errors), you can submit Form 14039, Identity Theft Affidavit. Learn more at www.IRS.gov/identityprotection. What information are you sharing about me? Federal law has strong protections in place to protect personal tax information. The IRS, states and tax industry all follow this practice, and this new effort will protect taxpayers even more. Tax software providers are sharing with the IRS general tax return information and other data elements from the tax software that indicate potential fraudulent patterns occurring during return preparation. This is one more way the IRS, the states and the tax industry can identify fraudulent tax returns that thieves file using your name and SSN. Will sharing this data put my information at risk? No. As part of the Security Summit, all participants agreed to use the National Institute of Standards and Technology (NIST) cybersecurity framework, the highest standards for cybersecurity technology. The IRS, states and most tax industry firms already met the NIST standards but now all software companies will adhere to it. Also, the information sharing is not related to the audit process. The IRS and states are looking for patterns indicating the return may be fraudulent and filed by an identity thief. What if I have already been the victim of tax-related identity theft and use an Identity Protection Personal Identification Number (IP PIN)? An IP PIN is a 6-digit number assigned to eligible taxpayers to help prevent the misuse of their Social Security Number on fraudulent federal income tax returns. Once the IRS sends you an IP PIN, you must use it to confirm your identity on your current tax return and any delinquent returns filed during the calendar year. The IRS will send you a new IP PIN by postal mail prior to the start of the filing season. Continue to use your IP PIN to file any Forms 1040, 1040A, 1040EZ or 1040PR/SS, during the current calendar year. This includes any delinquent returns filed during the year. The IRS will provide you with a new IP PIN every year before the start of the tax season. Only use your most current IP PIN when filing your return. Because of an error, the IP PIN notices dated Jan. 4, 2016 will say 2014 but the number is valid for the 2015 tax year. Why is there a new code on my Form W-2? This tax season, the IRS is testing a Form W-2 verification code to validate information return authenticity. The “verification code” box will appear on approximately 70 million Forms W-2, but the 16-digit code will appear on about 2 percent of those forms. The test, which is for electronic returns only, will not affect refunds or tax filing for this season. Taxes. Security. Together. All of us have a role to play. To learn about additional steps you can take to protect your personal and financial data, visit Tax Security Together or Identity Protection, as well as: IRS Fact Sheet 2016-1: IRS, States and Tax Industry Combat Identity Theft and Refund Fraud on Many Fronts IRS Fact Sheet 2016-2: IRS, States and Tax Industry Urge Taxpayers to Join the Effort to Combat Identity Theft IRS Identity Theft Victim Assistance: How it Works
