Tax refund payment fraudsters are targeting HR and payroll

Register now

A new season, and a new twist on a familiar fraud pattern is once again upon us as identity thieves look at tax season as a potentially lucrative time to boost their collection rates.

In 2015, after several years of upward trends, the incident rates of stolen identity refund fraud (SIRF) hit an all-time high with more than 700,000 consumers reporting that someone else had filed their taxes to secure their refunds. These refund schemes were most often aimed at the elderly, but even younger taxpayers and other victims were unaware of the fraud until they discovered that their taxes had already been filed.

For the 2019 tax filing season, the number of SIRF cases has dropped well below a quarter of a million victims. Due in large part to coordination between the IRS, state governments and private tax preparers and software companies, that number has continued to drop over the past three years.
These days, however, SIRF has become far more sophisticated with attacks targeting tax professionals, human resource departments and even payroll offices. These thieves come in search of W-2 forms and other documents that will allow fraudsters to file legitimate-looking tax returns on behalf of the victims.

In past tax fraud schemes, the scammers filed large numbers of falsified tax returns to maximize their profits. It was a numbers game in which they filled their “pipelines” with hundreds or even thousands of fraudulent returns from identity-theft victims. Just a 10% success rate from this vast number of filings netted fraudsters hundreds of thousands and even millions of dollars in some cases.

This year’s fraud schemes continue to show that fraudsters are often posing as agents of the IRS, calling or emailing their victims to demand they pay the phantom taxes owed immediately and over the phone. Usually the victim is threatened with jail or loss of their home or other assets. In many cases the fraudsters have spoofed the IRS caller ID to convince the victim of the authenticity of their call.

These, as we know, are not legitimate demands and with the advent of real-time payments, the velocity of the cases has now increased. The ability of banks to detect such payments and protect their victims has become far more difficult.

So, what are the hallmarks of these frauds?

The current frauds look more like a variation on a couple of long-used fraud schemes with attack vectors such as stolen or manipulated identities, business email compromise and identity takeover taking center stage. These combinations of typologies are just another variation on a theme. Other tax fraud-related scenarios include return preparer fraud where unscrupulous tax preparers steal information, inflate returns and divert refunds to their own accounts.

The primary targets of the current IRS schemes are older adults. According to the Consumer Financial Protection Bureau, targeted consumers for such schemes can be as young as 50, but one-third of all elder financial exploitation victims are 80 or older. These fraud attacks, according to the IRS, prey on people through phone and email. Once they have identified a victim, the fraudsters will continue to try to extract multiple payments as the fraudsters extort their victim.

Detection of these typologies by financial institutions often includes looking for large payments that appear to be out of the ordinary for a particular customer. Making it even more difficult for the consumer, the requested payments from the fraudsters are sometimes directed to prepaid cards. In those cases, funds may then be used for a large retail purchase for multiple gift cards. Victims can also be asked to transfer money via a transfer agent to pay their IRS bill.

The payments usually go undiscovered until the victim receives an official letter of notification from the IRS. This process may take several months, but by then the criminal has disappeared with the refund. As the truth is eventually discovered, the realization causes difficulties for all the legitimate parties connected to the transaction, especially as the victim sets to correct his tax records with the government and possibly address personal bank losses.

The common theme of these SIRF frauds remains identity theft. Fraudsters have not abandoned these types of fraud quite yet, but numbers do seem to be dropping as more checks and balances in the fraud system do their jobs.

Even so, as the tax filing season winds down, and real tax refunds start to dwindle, everyone still needs to remain on high alert as IRS “collections” fraud continues.

Let’s remember this as we move past April 15. It may be a good idea to warn customers, tax preparers and others affiliated with the tax preparation community that a new season of attempted fraud is likely to follow long after the official tax filing deadline passes.

For reprint and licensing requests for this article, click here.
Payment fraud Risk Payroll IRS ISO and agent