The Internal Revenue Service is fighting a new flare-up in the ever-expanding tax identity theft wildfire.
On Monday, March 7, the agency suspended use of its online tool that allows taxpayers to retrieve a lost or forgotten Identity Protection Personal Identification Number, or IP PIN.
Most of these special 6-digit identification numbers are issued by the IRS to individuals who’ve had their identities stolen. However, folks also can get an IP PIN if they fear their personal information might be compromised and used by crooks to obtain a fraudulent tax refund.
In fact, just last week the IRS suggested folks apply for an IP PIN if their tax information might have been exposed in the expanding hack of the agency’s Get Transcript online tool.
The use of the IP PIN on a tax return lets the IRS know that the return is from a legitimate taxpayer and not from an identity thief filing a fake refund claim.
Now, however, concerns about the security of the IP PIN retrieval tool have prompted the IRS to temporarily take that option offline.
Limited ID theft possibilities
“As part of its ongoing security review, the Internal Revenue Service temporarily suspended the Identity Protection PIN tool on IRS.gov,” the agency said in a statement. “The IRS is conducting a further review of the application that allows taxpayers to retrieve their IP PINs online and is looking at further strengthening the security features on the tool.”
Statistically, the threat of cyber criminals getting an IP PIN is not that great.
Most taxpayers who get these added filing identity security numbers — which, by the way, are delivered via snail mail — never use the online tool. IP PIN recipients only need to go online if they’ve lost or forgotten their special filing identification numbers.
The IRS says that of the 2.7 million IP PINs issued for the current filing season, only about 5% of those taxpayers, or approximately 130,000, have used the online tool to retrieve their IP PINs.
If you have an IP PIN, the IRS says go ahead and use it to file your tax return. If, however, you’ve lost or can’t remember your IP PIN, you will need to call the IRS to verify your identity and have the IRS resend your added tax-filing ID number by mail.
Series of IRS hacks
Although the number of possible tax identity theft issues related to IP PIN online retrieval is small, the IRS isn’t taking any chances in the wake of other recent attacks to its systems.
In addition to the Get Transcript hack, the IRS also is investigating a recent automated attack on its Electronic Filing PIN, or e-filing PIN, application on IRS.gov.
Identity thieves used personal data they had stolen elsewhere to try to generate e-filing PINs that the IRS believes would have been used to electronically file fake tax returns.
In the attempted e-filing PIN hack, which the IRS is still investigating in conjunction with the Treasury Inspector General for Tax Administration and its Security Summit partners, the IRS says no personal taxpayer data was compromised or disclosed.
Any time your personal information is threatened, you should check your credit report for any suspicious activity. Free tools to help you monitor possible identity theft concerns are available at myBankrate.com.