Coping with the IRS (or Any Entity) Data Breach
Data thieves; they have hit us where we shop, how we receive health care benefits, and now, they have found their way into our tax returns. The recent breach reported by the Internal Revenue Service is unnerving when you consider how much personal data is included on the return of not only the tax filer, but other family members as well. Various government agencies have published information to help you guard against identity theft, as well as aid you if you fall victim to this growing crime. This article will summarize recommendations from creditable authorities and websites on what to do (or not to do) right now if you receive a letter from the IRS (or other entity) that your data appears to have been stolen. Documents that you can print containing additional information can be found at the end of this article.
FIRST CRITICAL FACT: The IRS (or your bank or credit card company) will not contact you by email to report a fraud alert. This data breach has already spun off additional fraud attempts of people posing as the IRS by both email and telephone. If the IRS believes your data has been compromised, they will send you a letter in the mail. Never provide information over the phone to someone who has called you no matter how professional they sound, especially if they ask you to provide confirmation of your identity. Emails suggesting you have a problem with an account are even more likely to be fraudulent — never click on a link that is imbedded in these emails. If the email worries you, find different ways to contact that company to investigate the issue.
PLACE A FRAUD ALERT: Call one of the nationwide credit reporting companies, (Equifax 1‑800‑525‑6285, Experian 1‑888‑397‑3742, TransUnion 1‑800‑680‑7289) and ask for a fraud alert to be placed on your credit report. The company you call must contact the other two so they can all put fraud alerts on your files. An initial fraud alert is good for 90 days and does not prevent lenders or other third parties from accessing your credit files; but it does require them to take additional steps to verify that you have authorized the activity on your account. If they perform this extra due diligence and believe it to be credible, they still have the ability to open new lines of credit.
REVIEW YOUR CREDIT REPORT: As dictated by law, everyone is entitled to review your credit report annually. Since there are three credit bureaus, you can review your report once every four months by using a different one each time. If you want to see all of them at once, go to www.annualcreditreport.com or call 1-877-322- 8228. Later, there may be a small fee to do an additional review within the same year, but in cases where fraud or identity theft is a concern, fee discounts and waivers may be offered. Monitoring your credit reports may be helpful if someone tries to open new lines of credit using your information, but it doesn’t necessarily stop them from succeeding.
CONSIDER PLACING A CREDIT (AKA SECURITY) FREEZE: A security freeze prohibits, with certain specific exceptions, the credit reporting agency from releasing your credit report or any information from it without your expressed authorization. Since most businesses won’t extend credit without reviewing credit history, this should stop credit from being issued to anyone but you. Once a “freeze” is in place, if you need to pursue legitimate applications for credit you can “thaw” your credit report by using a personal identification number or PIN (issued by the credit reporting agencies). Freezing your credit files has no impact whatsoever on your existing lines of credit, such as your current credit cards; you can continue to use them as you regularly would even when your credit is frozen.
Freezes are free to victims of identity theft who have filed their case with a law enforcement agency, but non‑victims are subject to fees when freezing and thawing their credit files. In Wisconsin, each action of placing, removing, or temporarily lifting the freeze will cost $10. It is imperative that you freeze your credit with all three bureaus in writing (a PDF with instructions is included below).
IF YOU ARE A VICTIM: If you do find fraudulent activity, you need to create an Identity Theft Report. An Identity Theft Report is comprised of two documents; a filed complaint with the Federal Trade Commission (FTC) and a police report from your local police department. First, complete a fraud complaint with the FTC by going to www.ftc.gov/complaint or calling 1‑877‑438‑4338. Following your complaint filing you will be provided with an FTC Affidavit, which you need to give to the local police in order to file a police report. Combining your FTC Affidavit and your local police report gives you an Identity Theft Report.
Unfortunately, identity theft cases continue to increase as thieves find new ways to steal information that can be used in a variety of fraud schemes. Even in death we don’t appear to be protected; families have discovered multiple lines of credit being opened using their loved ones’ identity following a published obituary and death notice because too much personal information, such as the exact birth date, was included. In order to keep you more informed, we have provided printable PDF handouts produced by the Federal Trade Commission so you can protect your identity or react to a personal data breach.
Additional Printable Resources:
FTC Booklet – Taking Charge of Identity Theft
FTC Action Item Checklist for Identity Theft
FTC Brochure – Safeguarding Child Identity
WI Credit Report Security Freeze Instructions
FTC Mini Brochure – Reacting to Identity Theft