Why identity thieves are targeting your tax return

By Liz Weston

LOS ANGELES (Reuters) - Avoiding tax software will not prevent your refund from being stolen, and neither will anything else, say security and tax experts.

"There's really nothing you can do to protect yourself. It's depressing," said fraud expert Avivah Litan, vice president and analyst for Gartner Research. "This is the type of fraud I worry about."

The Federal Bureau of Investigation is investigating how fraudulent returns were filed in 19 states through TurboTax software, the Wall Street Journal reported on Wednesday. TurboTax maker Intuit Inc temporarily stopped transmitting state returns last week after noticing attempts to use fraudulent identification information.

The company said it does not believe the fraud resulted from a security breach of its systems and that the stolen information must have come from another source.

"Intuit has not been notified, nor are we aware, that we are the target of an FBI investigation," Intuit spokeswoman Julie Miller said in an email to Reuters.

With all the recent database breaches and hacks, there are plenty of sources for all the information that thieves would need to create bogus tax returns and steal people's refunds, Litan said. Social Security numbers, answers to security challenge questions and other private information on millions of people is up for grabs.

"We know that these have been stolen and sold," Litan said. Court Ventures, a public records aggregator now owned by Experian, unwittingly sold information to identity thieves from a database containing more than 200 million records that included Social Security numbers. Another 80 million customers and employees had their Social Security numbers and other private information exposed in the recent breach of health insurer Anthem Inc. Hackers are also targeting accounting and law firms to mine personal information, Litan said.

Once thieves have a Social Security number, creating phony W-2s is not that hard, she said: "You can get everything you need from LinkedIn and Facebook."

The IRS paid $5.2 billion in fraudulent tax refunds during the 2013 tax season while preventing another $24.2 billion from being paid, according to the U.S. Government Accountability Office.

Victims often wait months and sometimes even years to have their refunds restored, said tax preparer Laurie Ziegler of Saukville, Wisconsin, who has helped people victimized by refund fraud. Cuts in IRS funding and staff levels mean victims are likely to wait even longer this year, she said.

STATE RETURNS TARGETED

Even so, the federal agency has better fraud detection systems in place than most states, which likely explains why thieves are flooding some states with bogus returns, Litan said.

Ohio intercepted 58,000 fraudulent returns worth a combined $257 million in six months of 2014, a sharp rise from the 10,000 fraudulent returns asking for $8 million the year before, according to a Dayton Daily News investigation. The state is now sending about half of its electronic filers to an online quiz designed to verify identity.

Minnesota and Pennsylvania are among the states that have temporarily stopped processing returns because of suspected fraud.

Abandoning electronic filing in favor of paper forms is not the answer, said Ziegler, who is secretary and treasurer of the National Association of Enrolled Agents. Sending forms through the mail is not secure, and will not prevent you from becoming a victim when thieves have ready access to your private information from other sources.

Ziegler became a reluctant expert on identity theft after a babysitter stole her Social Security number and other private financial information to set up credit accounts in Ziegler's name. Since then, she has advised clients and others who have been the victims of tax refund fraud, including one of her enrolled agent colleagues.

Tax professionals have better access to IRS help than taxpayers, Ziegler said, as well as experience navigating its systems.

Once someone is a victim of tax return theft, the IRS issues them a personal identification number every year to help verify their identity, she said.

The only way to reduce the chances of refund theft is to "beat the criminal to the punch" by filing early, said Bob Sullivan, author of "Your Evil Twin: Behind the Identity Theft Epidemic."

"The other thing is to be aware it might happen," Sullivan said. "Any glitches in e-filing are a sign something could be wrong."

(Follow us @ReutersMoney or at http://www.reuters.com/finance/personal-finance; Additional reporting by Amrutha Gayathri in Bengaluru; Editing by Lauren Young and Jonathan Oatis)