If you receive an unexpected deposit from the IRS into your bank account in the next few weeks, don’t celebrate. You are likely a victim of a nasty, ingenious new form of ID theft designed by criminals to evade updated IRS security protections. In other words, in this cat and mouse game, you are the cheese.
It’s tax season, which means it’s tax ID theft season. This year, there is a crazy new twist that consumers need to watch out for. Potential victims see unexpected “refunds” from the IRS deposited into their accounts, then are contacted by someone claiming to be from the IRS who says the deposit was in error and demands money be returned.
The IRS issued a warning about it earlier this month, asking tax preparers to be particularly alert.
“Only a few days into the filing season, the IRS has already identified a new scam that began with cybercriminals stealing data from several tax practitioners’ computers and filing fraudulent tax returns,” the IRS wrote.
The scam is stunningly believable because the money really does arrive in the target victim’s bank account, and really does come from the IRS. Of course, consumers who “return” the funds are asked to do so using a method that is irreversible, and the IRS funds *are* reversible, so victims really do lose money.
Depositing funds into a target victim’s checking account seems like a very roundabout way to steal money, but here’s why it makes sense.
Since tax ID theft became a national scourge several years ago, the IRS has admirably been adding multiple layers of security to its process. One of these layers targets the would-be criminal’s final step after filing a fraudulent tax return: transmitting refund money from the U.S. Treasury to an account the criminal controls. In the past, an ID thief might ask for a check to be mailed directly to them (overseas, even!), or the funds loaded onto a checking account controlled by the criminals that has no obvious connection to the taxpayer. Those kinds of transfers raise red flags, for obvious reasons. So to evade those fraud triggers, criminals now file fraudulent returns and ask that the money be sent to the “rightful” taxpayer, which raises no such suspicion. Then, after the money is sent, they contact the consumer and trick her or him into sending the money — effectively turning the victim into a money mule.
After stealing client data from tax professionals and filing fraudulent tax returns, these criminals use the taxpayers’ real bank accounts for the deposit,” the IRS warned. “Thieves are then using various tactics to reclaim the refund from the taxpayers, and their versions of the scam may continue to evolve.”
In another flavor of the scam, criminals use a third party’s checking account to accomplish much the same thing. They fill out a tax return for victim A, then have the refund sent to victim B’s bank. That’s still less suspicious than having the money sent overseas.
“It’s possible that the scammers are combing the information from multiple victims when perpetrating this fraud,” said Eva Velazquez, president of the Identity Theft Resource Center. “Scammers can use the identity credentials of one individual to file the fraudulent tax return, and the banking and contact information belonging to a different individual.”
The main message here: Tax ID theft was very lucrative for a long time, and criminals aren’t going to give up this line of work without a fight. So expect more creative twists and turns to this scam as time goes on. Your best defense is to file your taxes as early as you can — before a criminal files them for you — and maintain a healthy skepticism about any IRS-related activity in your financial life. More from Velasquez:
“Consumers should always go to the known source of truth when they receive unexpected communication, even if they recognize the entity. When a consumer receives a call, email, or text they should not assume the person at the other end is telling the truth, they need to independently verify. If someone calls you and states they are with the IRS or representing the IRS, stop that communication immediately call the IRS directly using a phone number from the IRS website, (not the one on the caller ID). ”
If you’ve read this far, perhaps you’d like to support what I do. That’s easy. Buy something from my NEW LIBRARY AND E-COMMERCE PAGE, click on an advertisement, or just share the story.
Just curious: is there an obligation to return the money, or do we get to keep the funds? If we get a bogus deposit, should we proactively call the real IRS about returning it? Or wait for the fake IRS to contact us and laugh in their face and then call the real IRS?