IRS stimulus check: Scammers could steal coronavirus relief checks using portal, direct deposit identity theft. How to avoid

Subscribe to Outbreak, a daily roundup of stories on the coronavirus pandemic and its impact on global business, delivered free to your inbox.

The Internal Revenue Service is bracing for another kind of epidemic—scammers trying to get their hands on the $1,200 payments being sent out to millions of Americans to bolster the economy.

The payments, plus an additional $500 for each child, have begun hitting bank accounts this week, opening a wide avenue of opportunities for scams, identity theft and low-tech crimes such as stealing checks from mailboxes.

“Right now, due to how vulnerable the population is, it’s really prime picking for fraudsters to come out in full force,” Donna Parent, the chief marketing officer at Sontiq, a identity theft protection company, said. The Federal Trade Commission “is reporting more than $13 million in fraud loss due to COVID-19—that’s only going to exponentially increase with stimulus payment scams.”

The Internal Revenue Service and the Treasury Inspector General for Tax Administration, the agency’s watchdog, have already issued several warnings that scammers are posing as the IRS to try to get personal information from payment recipients that they can then use to steal the money. The inspector general is asking people to report any suspicious activity.

“Unsuspecting victims”

“I understand scammers are already contacting innocent Americans by impersonating IRS or Treasury Department officials, offering so-called COVID-19-related assistance that requires the sharing of personal financial information,” Senate Finance Committee Chairman Chuck Grassley wrote in a letter to the inspector general earlier this month. “These scammers then use that information to steal from their unsuspecting victims.”

The $1,200 payments are available to those earning less than $75,000 as an individual, including recipients of Social Security, disability and veterans benefits. Those earning above that threshold and up to $99,000 get a smaller payment.

People in that population, including the elderly, those with less education and those who aren’t tech savvy are the most likely to fall victim to some of these scams, and are also the most likely to need the money, said Vanita Pandey, the head of strategy at Arkose Labs, a company that detects and prevents online fraud.

The coronavirus outbreak means that a lot of people who weren’t familiar with the internet are now using apps to communicate with family and friends or ordering groceries online, giving scammers ample opportunity to find easy targets, Pandey said.

“IRS Criminal Investigation is actively working to combat scam artists trying to exploit Economic Impact Payments,” the agency said in a statement Tuesday. “So far, the scams CI has already seen look to prey on vulnerable taxpayers who are unaware of how the payments will reach them. IRS CI is prioritizing these types of investigations to help protect taxpayers and the tax system.”

There’s some commonsense moves that check recipients can take to protect their personal data as well as their payments. Avoid clicking on links sent in email or text messages that appear to be from the IRS. The IRS said it won’t contact people by telephone, email, social media or text message to ask for personal information.

The IRS is using tax return information from 2018 and 2019 to send the payments. For those who have direct deposit information on file from a tax refund in one of those years, the IRS will send the money directly to their bank accounts.

People who didn’t file a tax return in either year should submit their bank account or address information IRS as soon as possible to prevent a criminal from submitting incorrect information to divert payments. Social Security beneficiaries will automatically receive their payments, though those who just started receiving benefits will need to send their information to the IRS.

That portal could give scammers an opening to hijack payments, because the website requires personal information—such as Social Security numbers—that is available for sale for on the dark web after being compromised in security breaches at government agencies and private organizations, said Mike Chapple, a former computer scientist with the National Security Agency.

“Exploiting this loophole isn’t rocket science,” Chapple, now an information technology, analytics and operations professor at the University of Notre Dame, said. “A criminal could purchase identity information on the dark web and then use it to falsely claim stimulus payments, directing the funding to their own bank account.”

The Treasury Department said Wednesday that those receiving Supplemental Security Income will automatically receive their payments to their bank accounts, direct express debit card or by paper check, just as they typically receive their benefit payments.

However, people who get Social Security or disability payments who have dependent children will likely need to upload their information to the IRS to get the additional $500 per child.

Online portal

The agency opened online portal Wednesday that will let people update their direct deposit or mailing address and, eventually, let recipients see the status of their payment and the day it is scheduled to be mailed or deposited. The IRS will also mail notifications to recipients about two weeks after their payment has been sent that will also include instructions about how to report that a payment hasn’t arrived.

The U.S. Postal Service also offers an a heads up to people about what’s coming in the mail that day. Users can sign up online to get an “Informed Delivery” email about what is coming in the mail later that day. That can let mailed check recipients to know to be diligent in checking the mail so payments aren’t stolen.

It’s hard to know yet just how much fraud risk there is with the stimulus payments. After Hurricane Katrina, about 10% of government payments were fraudulent, Kim Sutherland, a vice president at LexisNexis Risk Solutions, said.

Theft “epidemic”

Identity theft has plagued the IRS in recent years, so much so the Treasury Inspector General for Tax Administration called it an “epidemic” in congressional testimony. Scammers have been able to steal taxpayer information and file fraudulent tax returns to illicitly get refunds. The agency has greatly reduced the prevalence of stolen tax refunds by upgrading detection systems.

“The potential for fraud is present, but it is not substantially different from what IRS needs to deal with every tax filing season,” said Jack Smalligan, a former Office of Management and Budget official who is now a senior policy fellow at the Urban Institute. “The IRS has an elaborate process to identify scams, particularly high-volume scammers.”

Still, thieves are able to adapt their schemes, said Marcus Christian, a former top attorney in the U.S. Attorney’s Office for the Southern District of Florida. Government agencies are much more adept at detecting and preventing fraud, but the stimulus checks present an unprecedented opening for scams, he said.

“Fraud isn’t going to be reduced to zero,” said Christian, who is now a partner at law firm Mayer Brown. “There is some balancing of interests here: Get these out quickly to taxpayers, which will result in some fraud, and some taxpayers may have to go through an onerous burden to get rightful payment.”