IRS can do more to protect against tax fraudsters, watchdog says

A government watchdog has said that the Internal Revenue Service could do more to prevent tax fraud if it invested more money in ensuring that the identities of taxpayers are properly verified.

From the IRS’s own data, fraudsters scammed the agency out of at least $1.6 billion in tax refunds during the 2016 tax season that belonged to taxpayers. That’s a drop in the ocean to the $383 billion paid out in legitimate tax returns. But the new report by the Government Accountability Office said that the IRS still has a way to go to prevent further fraudulent activity.

“While IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes,” said the report. “As a result, IRS may not identify current or emerging threats to the tax system.”

In other words, the IRS can’t always guarantee that it’s you calling up about your tax affairs or logging in to the website.

That’s a problem because around tax season, scammers obtain tax returns or filings — through leaks or breaches — and use that information to impersonate taxpayers. By filing fake tax returns before the legitimate taxpayer does, the scammer can collect the fraudulently obtained return.

These breaches aren’t helping matters, said IRS chief information officer Gina Garza at a House committee hearing on Thursday. Indeed, the IRS had to clean up after its own data breach last year, in which 100,000 taxpayers had their tax information stolen — just two years after a separate IRS breach affected 300,000 taxpayers.

Although the government watchdog said that the IRS has made some steps to improve its taxpayer verification efforts, the agency “does not have clear plans and timelines” to implement guidance provided by the National Institute of Standards and Technology that would properly authenticate taxpayers.

One of the ideas was to notify taxpayers when a tax return had been filed in their name, which would help get ahead of scammers trying to cash in on fraudulent returns. But the watchdog said that the IRS hasn’t found the funding to roll out notifications.

Some of the measures could still take between six months and three years to complete, the report said, leaving millions of taxpayers to defend themselves against the ongoing threat of tax fraud.

The IRS accepted all of GAO’s 11 recommendations. IRS spokesperson Cecilia Barreda declined to comment further.