It’s that time of year again – tax season. Hopefully, you’ll get a nice refund. As you work with your accountant or submit your return through do-it-yourself software, what happens if you learn that a return has already been filed under your name and your refund has been stolen?

Tax-return fraud has become such a significant problem that the government has coined a term for it: Stolen Identity Refund Fraud (SIRF), and the Internal Revenue Service (IRS) has a team of more than 3,000 people designated to handle fraudulent tax filings. According to an article published by LifeLock, employment or tax-related fraud accounts for 34% of the six types of identity theft. A recent article in Forbes indicates that cybercriminals are “ramping up their attempts to steal information through tax filings and preparers.” According to the Government Accountability Office (GAO), “The IRS estimated online robbers attempted to steal at least $12.2 billion, if not more, through identity theft tax refund fraud in 2016. IRS vigilance thwarted most of those attempts, but the fakers got away with at least $1.6 billion.” Cybercrime experts anticipate this type of crime will not only persist but expand.

Cybercriminals often pose as the IRS, a tax-filing agency, or other tax-related organization to steal personal information through phishing, which is an attempt to steal personal information through email, smishing (SMS/text phishing), vishing (voice phishing) phone calls, or fake mailings. Beware of any unexpected communications that request personal information such as your Social Security number, banking information, or other personal data.

This type of crime does not discriminate. While criminals target banking and other highly compensated professions, they also go after patients in hospitals and residents in nursing homes, victimizing the elderly, sick, and their grieving families when they are most vulnerable. They work early in the year before you have received the documents required to submit returns. By the time you realize that you’re a victim, the criminals have disappeared with your money.

It is always important to protect your personal information, but heightened diligence is critical during tax season. Learn to recognize the most common social engineering schemes and follow these helpful tips both at work and at home:

1. Protect Personal and Financial Records: Do not carry your Social Security card in your wallet or purse and only provide the number if it is necessary. Secure personal information at home and protect personal computers with anti-spam and anti-virus software. Routinely change passwords for online accounts.
2. Don’t Fall for Scams: Criminals often try to impersonate banks, credit card companies, and even the IRS hoping to steal personal data. Review all communications carefully. NOTE: The IRS will not call a taxpayer threatening a lawsuit, arrest, or demand immediate payment.
   1. If you receive an email claiming to be from the IRS that requests personal information, immediately forward it to phishing@irs.gov, then delete the message without clicking any links or responding.
   2. If you receive an email or telephone call claiming to be from the IRS, call the IRS directly at 800-829-1040 to confirm the legitimacy of the request, especially if the message is threatening or demands immediate payment.
3. Report Tax-Related ID Theft: If you learn that someone has filed a tax return using your Social Security number, take the following actions:
   1. File a tax return by paper and pay any taxes owed.
   2. File an IRS Form 14039, Identity Theft Affidavit. Print the form and mail or fax it according to the instructions. Include it with the paper tax return and/or attach a police report describing the theft if available.
   3. File a report with the Federal Trade Commission using the FTC Complaint Assistant.
   4. Contact Social Security Administration and type in “identity theft” in the search box.
   5. Contact financial institutions to report the alleged identity theft.
   6. Contact one of the three credit bureaus so they can place a fraud alert or credit freeze on the affected account.
   7. Check with the applicable state tax agency to see if there are additional steps to take at the state level.
4. IRS Letters. If the IRS identifies a suspicious tax return with a taxpayer’s stolen Social Security number, that taxpayer may receive a letter asking them to verify their identity by calling a special number or visiting an IRS Taxpayer Assistance Center.
5. IP PIN. If a taxpayer is a confirmed ID theft victim, the IRS may issue them an IP PIN. The IP PIN is a unique six-digit number that the taxpayer uses to e-file their tax return. Each year, they will receive an IRS letter with a new IP PIN.
6. Report Suspicious Activity. If you suspect or know of an individual or business that is committing tax fraud, visit IRS.gov and follow the instructions on How to Report Suspected Tax Fraud Activity.