Are Anti-Fraud Measures Putting Taxpayers at Risk?

It’s tax season, and that means tax scams are in full swing. Earlier this week, we wrote about the latest incarnations of the IRS phone scam. Today, we want to offer a warning about a potential new tax related scam.

This year several states, including Alabama, Georgia, Indiana, Ohio, and Wisconsin, are introducing a new program intended to detect possible tax fraud. As returns are being processed, any that show a certain level of risk will be flagged for further verification. Those taxpayers will receive a letter in the mail, asking them to take an ID Confirmation Quiz online or by phone.


Most of these states have teamed up with Lexis Nexis to create short 4 question identity quizzes based on information provided by public records. These questions can range from simple past address verification to more obscure questions like the “What year did your son sell his car?” or “What was the purchase price of the home you bought 20 years ago?”

Ohio says these quizzes have helped the state intercept thousands of fraudulent returns seeking to steal more than $270 million in refunds last year, compared to $8-10 million in recent years. While those efforts are to be applauded, are these quizzes putting some taxpayers at an even higher fraud risk?

Screen Shot 2015-03-02 at 2.32.04 PMThere are several problems with these identification efforts. First, we know that Knowledge Based Authentication (KBAs) are not the most effective method of authentication. “(I) can imagine these questions are hard for legit users to answer and easy for some criminals who have stolen personal data along the way, ” said Avivah Litan, a fraud expert at Gartner. Already there are reports that up to 10% of Ohioans asked to complete the KBA quiz are failing.

Second, these quizzes and the accompanying media and web presence meant to reassure taxpayers that the requests are legitimate may have the unintended consequence of encouraging fraudsters. How long will it be until fraudsters begin targeting residents of these states, claiming to be with the Department of Revenue as a ploy to steal identifying information? These fraudsters can now direct victims to the state websites to help convince them that the questions are legitimate.

The third potential issue comes from the influx of incoming calls to the state tax departments. Taxpayers are being asked to call special phone numbers to complete the quiz, or to discuss next steps if they fail an online quiz. In addition, taxpayers who are unfamiliar with the identification efforts, and are (rightly) worried that it might be a scam, are calling. According to the Salt Lake Tribune, recent identity quizzes prompted 40,000 calls to the Ohio tax department in a single morning.

This significant amount of incoming calls means that states need to be proactively looking for “Misdial Trap” fraudsters. In this scheme, con-men would buy phone numbers that are confusingly similar to that of the tax departments, in hopes that people accidentally call. Fraudsters could then impersonate the state departments, and collect identification information that way.

What steps should taxpayers take to protect themselves from possible fraud attempts? All taxpayers should check with your state and understand the ways that they might contact you with an ID verification quiz. Most states, as well as the IRS, will only contact you through certified mail. If you are contacted to verify your identity over the phone or email, it is a scam.

If you suspect you are speaking to a fraudster on the phone, hang up, and call the tax department’s main line. Be careful to only call phone numbers listed on official websites, and dial the number correctly.