The Federal Bureau of Investigation (FBI) is looking into the cause of a spike in fraudulent tax returns filed using Intuit's TurboTax tax preparation software, according to a report by the Wall Street Journal.
Citing an unnamed source, the newspaper yesterday (subscription required) said that the FBI had started an investigation to determine whether the fake returns were generated from information acquired through a data breach, perhaps from Intuit, or whether the returns were created using information obtained elsewhere.
Last week, Intuit suspended transmission of state tax returns for about 24 hours after numerous state collection agencies reported higher-than-usual numbers of phony filings.
At the time, Intuit said it believed the fraud did not stem from a security breach of its network, and that the information used by criminals was obtained elsewhere. The company did not reply to questions today.
The FBI's probe is meant to determine whether that's true.
TurboTax users have reported fraudulent federal as well as state returns, but not surprisingly have no idea how the fraudsters obtained the information necessary to mimic them.
"This year someone has already filed taxes on my wife's SSN [Social Security number] so I can't e-file," wrote someone identified as "cssmith17" on Intuit's support discussion forum.
"IRS [Internal Revenue Service] rejected my 2014 filing due to same reason, only mine is because they are saying my son (dependent) has already filed," reported "designvegas" on Sunday. "He is disabled. Please be aware of fraud on federal taxes as well."
The Utah State Tax Commission, like up to 18 other states' collection agencies, has seen a significant increase in fraudulent tax returns so far this year, with some uncovered only when taxpayers reported that a return had already been filed in their name.
Utah's fraudulent return rate is "a lot higher" this year than in the past, said a commission spokesman today, declining to share numbers. "We know that criminals are getting the information somehow, whether from the software vendor or the Internet," the spokesman said, but he wasn't able to specify the source. He said that the commission's network had not been breached.
Tax fraud is a huge problem: The IRS estimated that it paid out $5.2 billion in identity-theft-related refunds last year, but also claimed it had stymied attempts to grab another $24.2 billion.
"I'm glad it's finally coming to the forefront," said Avivah Litan of Gartner, pointing to the IRS's admission but betting that the number is likely much higher than the agency's estimate. "They're taking it seriously [because] the amount of money stolen from consumers through fraudulent returns dwarfs that from credit card fraud."
Sign up for CIO Asia eNewsletters.