how bad is income tax identity theft