Get Your Taxes Done but Don't Get Scammed in the Process

There’s just a few days left before this year’s deadline to file your income taxes, and security experts say procrastinators should beware. They need to take care that they don’t fall for tax-related scams and other attempts to steal their refunds and personal information.

For most of the country, this year’s federal income tax deadline falls on April 15. Residents of Massachusetts and Maine have until April 17 because of holidays in their states. The more you wait till the last minute, the more likely you are to fall victim to some kind of tax-related cybercrime.

“For folks who may be scrambling and feel pressure to move quickly, I recommend that they don’t let that pressure cause them to make quick decisions,” said Eva Velasquez, president and CEO of the Identity Theft Resource Center, a nonprofit group that helps victims of identity theft. 

She added that last-minute filers should still take the time to do their homework when doing things like selecting a tax preparer or tax preparation software. Something as simple as clicking on a dubious link or unwittingly inputting your personal information into a scam website could put a filer at risk for financial fraud or identity theft.

Unsolicited offers of help filing taxes, especially those promising big refunds, should be met with skepticism.

But spotting scammers is getting increasingly harder, thanks to artificial intelligence technology, which makes it easier for cybercriminals to send out sophisticated scams at a previously unseen scale, said Vijay Balasubramaniyan, CEO of Pindrop Security, which focuses on AI technology.

“Tax season is a stressful time for all,” Balasubramaniyan said. “Add AI and deepfakes into the equation and it’s easy to get overwhelmed by all the potential threats.”

Sherrod DeGrippo, director of threat intelligence strategy at Microsoft, said scammers are creating fake websites — some that impersonate well-known tax prep and financial services companies — to try to trick filers into uploading their tax return information.

They also often try to impersonate the IRS. Phishing emails, texts and even phone calls designed to look like they’re from the IRS, or an IRS agent, are a common sight this time of year. They might threaten jail time or big fines if the targeted person doesn’t pay what the cybercriminals might claim are back or overdue taxes.

The IRS only uses the U.S. Postal Service to reach people. Any other method of communication is a sure sign of a scam.

“The IRS will never send you an email to initiate contact,” DeGrippo said. “Nor will they use text messages or any kind of social media account to contact you.”  

The IRS also doesn’t take payments in the form of cryptocurrency or gift cards, making requests for back taxes in those forms obvious signs of a scam too.

Here are a few tips from the IRS and others for staying alert.

File early: OK, the ship may have already sort of sailed on this one, but the earlier you file, the less time cybercriminals have to use your identity to commit fraud. Don’t forget, if you need more time. you can file for an extension. Better to do that and give yourself some breathing room rather than rush and fall for tax-themed fraud, DeGrippo said. 

Watch out for phishing and smishing: The IRS won’t send unsolicited emails or texts. Skip the links and attachments and go straight to the IRS or the applicable state and city websites. In general, don’t reply to emails or texts sent from unknown sources, Balasubramaniyan says. And definitely don’t open attachments from people you don’t know or send them your personal information like your Social Security number or tax ID.

Get a PIN: File this tip under things to remember for next year. Taxpayers who can validate their identities with the IRS can obtain an identity protection PIN, a six-digit code that prevents a cybercriminal from filing a fraudulent tax return with your Social Security number.

Fight back against fraud: If you discover someone has filed a tax return in your name, complete a paper return and include form 14039 (Identity Theft Affidavit). Report the fraud to local law enforcement and the Federal Trade Commission. Monitor your credit reports and account statements and contact the three major credit bureaus to ask for a freeze so that no one can request new credit in your name.

Always use good passwords and 2FA: These are both a must for any account related to your tax returns and documents. Make sure you’re using good antivirus software and that it, along with your operating system, is up to date. While you’re at it, back up your tax information to a removable drive or encrypted cloud storage. Paper copies and drives should be securely stored.

Know who you’re dealing with: If you’re self-filing online, make sure you’re using a reputable service. If you hire someone to do it for you, make sure they’re who they say they are. Velasquez recommends checking credentials and qualifications using the IRS Directory of Federal Tax Return Preparers. Be especially careful when submitting documents. Encrypted email isn’t enough. Any decent tax professional or service will use a secure portal, she said.

Shred everything: Tax documents that are no longer needed must be properly destroyed. Dumpster diving still happens. Don’t be tempted to toss them in the trash and don’t put them in the recycling.