Becoming a victim of income tax identity theft is very distressing.  Identity thieves file federal or state income tax returns in your name and using your Social Security number along with a counterfeit W-2 in order to claim a fraudulent refund.  According to the IRS, it paid out 5.8 billion dollars in 2013 to income tax identity thieves.  Often, it is not until the victim of income tax identity theft later files his or her own legitimate income tax return after the identity thief has filed one using the victim’s information that the IRS becomes aware that a crime has occurred.  It then takes, on average, 278 days before the IRS is able to investigate individual instances of income tax identity theft and return to the victimized taxpayer, his or her legitimate refund.

In an effort to reduce the chance that victims of income tax identity theft will not be victimized again, the IRS will issue, upon demand, an Identity Protection PIN, which is a six digit PIN to be used by the previously victimized taxpayer when filing his or her federal income tax return to insure that the income tax return filed is not from an identity thief.  Unfortunately, as recently reported by KrebsOnSecurity, the Identity Protection PIN program has been hacked by identity thieves due to the failure of the IRS to use a strong authentication protocol when someone tries to retrieve their PIN from the IRS.  Presently all that the person attempting to get the PIN has to do is answer four personal information questions, the answers to which can be easily obtained through various online sources including the victim’s Facebook page and other social media.  It was this same authentication vulnerability that led to the theft of personal information of 724,000 people through the IRS’ Get Transcript program.  This failure of the IRS to better protect people who have already been victims of identity theft is disappointing.


If you are one of the 2.7 million people who have an Identity Protection PIN, you should be aware that due to the vulnerabilities of the IRS’ authentication protocol, you are not as protected from becoming a repeat victim of income tax identity theft as you might have thought.  Therefore it is important to file your income tax return as early as possible in order to beat a potential income tax identity thief to the punch.  In fact, filing early is the best defense against income tax identity theft for everyone regardless of whether you have previously been a victim of income tax identity theft.