Click to edit Master title style Fighting Back Against. Identity Theft and Online Fraud. Click to edit Master text styles Second level Third level

Transcription

1 Click to edit Master title Fighting Back Against Click to edit Master text s Presented by Fifth Office levelof Privacy, Information Protection & Data Security Identity Theft and Online Fraud 1

2 Click Privacy to edit at Master the IRStitle Security and privacy of taxpayer information is a priority for the IRS. Through this, we maintain public trust in tax administration. Our mission is to Ensure security of IRS systems and proper Click to edit Master text s Fourth protection level of personal information Prevent Fifth level and detect cyber and other threats/vulnerabilities Educate on protecting information 2

3 Identity Theft is a Persistent Threat Click to the to edit American Master Taxpayer title #1 consumer complaint reported to the Federal Trade Click Commission to edit Master for 11 years text in s a row, accounting for 19% of all complaints. Javelin s Second Identity level Fraud Survey estimates 8.1 million victims of identity theft in the U.S. in 2010, Third at a level cost of $37 billion. Incidents related to government benefits are the most Fourth common level form, more complex and require more time and money to detect and resolve. Average Fifth level victim spends 141 hours and $2,104 out of pocket to resolve. Sources: FTC Consumer Sentinel Network Data Book, March 2011; Javelin Strategy 2011 Identity Fraud Survey Report, February 2011; Identity Theft Resource Center, Identity Theft: The Aftermath

4 Committed to Resolving Taxpayer Identity Theft My overall goal as the IRS Commissioner is that when a taxpayer contacts us with an issue or concern, we have in place a seamless process that gets the issue resolved promptly. From the perspective of an identity theft victim, that means when the taxpayer calls the IRS that they reach someone who is knowledgeable on the issue and who is able to take care of the problem quickly and permanently. Douglas H. Shulman, Commissioner, IRS Senate Finance Committee April 10, 2008

5 Identity Theft Can Impact Taxes Click to edit Master title Scenario 1: Refund-Related Crime Identity thief uses a stolen SSN to file forged tax return and obtain a refund early in the filing season. Owner of the SSN will be unaware until he files and the IRS discovers two returns filed using the same SSN. If an electronic return is rejected, it may be because an identity thief has already filed a fraudulent return. Click to edit Master text s Fifth level Scenario 2: Employment-Related Crime Identity thief uses a stolen SSN to obtain employment. The IRS will receive a W-2 or a Form 1099 from the employer reporting income on the account of the rightful owner of the SSN. 5

6 What is the IRS Doing? Click to edit Master title Placing identity theft indicators on taxpayer accounts to track and manage identity theft incidents. Click to edit Master text s Notifying taxpayers when they are victims of identity Second theft impacting level their tax account. Assisting Third taxpayers level who are victims of identity theft. The Identity Protection Specialized Unit was Fourth established level as the central point of contact for taxpayers Fifth level who had their identity stolen. Using business filters to analyze returns filed on identity theft victim accounts designed to accept legitimate returns and reject false returns. 6

7 Identity Theft Indicators Click to edit Master title What do the identity theft indicators do? They Click prevent to edit victims Master from text facing sthe same problems every year. Identify and track tax related identity theft Fourth problems. level Distinguish legitimate from fraudulent returns Fifth level Measure the problem, monitor victims accounts and develop processes to resolve problems. 7

8 Identity Theft Indicators Click to edit Master title What else do the identity theft indicators do? Reflect Click different to edit types Master of text identity s theft Refund-related identity theft. Employment-related identity theft. No filing requirement. Lost Fifth my level wallet. 8

9 Taxpayer Accounts Click Marked to edit with Master Indicators title Number of taxpayers accounts marked with an identity Click to theft edit indicator Master text has significantly s increased over the last three years. Fifth level 9

10 Notifying Identity Theft Victims Click to edit Master title When the IRS places an identity theft indicator Click to on edit a victim s Master account, text s a notification letter is sent to them. Notification letter provides the following: Third Information level on the incident Fourth Statement level that the taxpayers account has Fifth been level reviewed, adjusted and resolved Additional information on how to protect themselves Toll free number to contact the IRS if victims have questions or concerns 10

11 Identity Protection Click Specialized to edit Master Unit title The IPSU is staffed with specialists in tax-related identity theft. IPSU staff assist callers in resolving identity theft issues. Available , Monday Friday, 8 AM 8 PM local time, for taxpayers to talk to IPSU staff when their tax account is affected Click to edit Master text s by identity theft Fifth level Taxpayers can self-report they are victims of identity theft before it impacts their tax account Taxpayers can submit documentation to substantiate their identity and verify they are a victim of identity theft using the IRS identity theft affidavit (IRS Form 14039) 11

12 Tax Return Review Click to edit Master title Identity theft indicators direct tax returns through a series of filters. Click Tax returns to edit filed Master using text the s victim s Second SSN pass level through filters to ensure only Third legitimate level returns are processed Questionable returns are reviewed to Fourth determine level legitimacy, and rejected if Fifth fraudulent level 12

13 Committed to Protecting Click to edit Master title Taxpayer Privacy The Click IRS to is reducing edit Master the use text of s Social Security numbers to protect the privacy of taxpayers. Test Two Dimensional (2D) Barcoding technology Fourth level to encode the SSN on taxpayer Fifth level notices. Pilot in mid-2011 masks the SSN on 13 notices, impacting 11 million outgoing notices. 13

14 Identity Theft Resources Click to edit Master title Go to IRS.gov, keyword identity theft IRS works closely with other organizations: Click Federal to edit Trade Master Commission text s the lead Federal agency on identity theft. You can Second file an identity level theft complaint online with them. Third OnGuard levelonline Joint government Fourth site maintained level by FTC, IRS, the Social Security Administration and others to Fifth help consumers level with identity theft issues. Identity Theft Resource Center Nonprofit, national organization dedicated exclusively to understanding and prevention of identity theft. 14

15 What is the Mission of Click to edit Master title Office of Online Fraud and Data Protection? Click to edit Master text s To Second reduce level online fraud against the IRS and Third taxpayers level by working closely with public, private and international stakeholders. Fifth level 15

16 What Click does to OFDP edit Master investigate? title Sites that Falsely purport to be the IRS Falsely Click purport to edit to Master be an text authorized sagent or Second partner of level the IRS Falsely Third assert level to conduct business on behalf of the IRS Falsely Fourth claim level to be an authorized Electronic Fifth level Return Originator (ERO) for the purposes of fraudulently obtaining tax return information, and/or Unlawfully display or misuse IRS logos in violation of Title 31, U.S.C,

17 Why Click is to OFDP edit Master doing this? title The manner in which the IRS handles phishing Click to is edit a key Master factor text in the s continued success Second of e-gov level initiatives. As the Third IRS level continues to modernize its infrastructure, Fourth levelany loss of taxpayer confidence Fifth level undermines this strategy and its investments. 17

18 Click OFDP to Responsibilities edit Master title Online Scams (Occur entirely online) IRS-related phishing websites and Click malware to edit Master text s Fake e-file/unauthorized e-file sites Second Misrepresentation level online: misuse of IRS Third logo and level e-file provider graphic Offline Fourth Scams level ( Online receipt, offline response ) Fifth Vishing level (voice + phishing) Investment scams Advance Fee Fraud ( Funds Transfer, Lottery) 18

19 How Click does to edit OFDP Master mitigate? title OFDP contacts registrar, registrant, hosting Click to provider, edit Master free text s provider, or the Second telecommunications level provider to have: Third Domains level de-registered Fourth Content level removed Fifth level addresses suspended Fax numbers disabled 19

20 OFDP summary stats: Click to edit Master title Phishing, vishing and Click to edit Master text s Fifth level Phishing Vishing 20

21 Phishing Click to edit Master title Fake IRS websites advertised through e- mails that include links to malicious URLs and/or Click attachments to edit Master text s Phishtank Second listed level the IRS as #5 in their list of targeted brands for calendar year Beginning in September 2009 and into 2010 a large-scale, Fourth level botnet-driven malware campaign (Avalanche/Zeus) targeted the IRS Fifth as well level as financial institutions = ~4000 incidents, 2009 = ~5000 (~4100 were botnetrelated) 21

22 IRS Click phishing to edit statistics: Master title Click to edit Master text s Fifth level 22

23 Phishing website: Click to edit Master title Click to edit Master text s Fifth level This is a typical IRS phishing webpage. The form asks visitors to provide credit card information and other PII so they can have refund deposited to their credit card account. OFDP observed an incident where a victim apparently intended to get multiple refunds and gave the scammers five credit card numbers. 23

24 Fraudulent/unauthorized Click to edit Master title e-file Sites appear to be legitimate e-file sites, but Click they to harvest edit Master a victim s text s tax information File Second victim s level return, then collect refund Third Problem levelwas all but eliminated in Fourth 2009 level To date no new incidents have Fifth been level identified 24

25 Click to edit Master title Click to edit Master text s Fifth level 25

26 Click Misrepresentation to edit Master title Companies that display an e-file logo and are Click not to registered edit Master e-filers text s Group Second pages level created on Facebook purporting Third level to be affiliated with the IRS Fifth level 26

27 Fraudulent Click to edit IRS Master Facebook title site Click to edit Master text s Fifth level 27

28 Click to Vishing edit Master title Recipients include individuals in the U.S. and abroad. Click to edit Master text s Approximately a month OFDP Second has disabled level some 400 numbers since Third early level2009 Sent one of two ways: direct fax or via e- mail Fourth level W8-BEN Fifth level most popular IRS form faked 28

29 IRS Click vishing to edit statistics: Master title Click to edit Master text s Fifth level 29

30 Click to edit Master title Click to edit Master text s Fifth level 30

31 APWG Fax Cover Sheet Click to edit Master title OFDP worked Click to edit Master text with s APWG to develop this fax cover sheet. Individuals are provided URLs to submit Fifth level complaints that feed FTC s Consumer Sentinel portal. Source: 31

32 Click to edit scams Master title Upwards of 30 a month OFDP has disabled more than 400 Click to edit Master text s addresses since 06/2009 known government authorities Fifth level OFDP began tracking the number and types of incidents after identifying scams that used the name of Treasury Secretary and other well- Our tracking evolved into counting any vishing or other scam using addresses linked to the IRS/Treasury 32

33 IRS Click to edit statistics: Master title Click to edit Master text s Fifth level 33

34 Funds Click to Transfer edit Master / Lottery title Basic advance fee scam Click to edit Master text s Conducted via using different IRS bureaus Second level Perpetrators use free service providers to constantly refresh this scam Fifth level 34

35 Funds Transfer / Lottery Click to edit Master title Attempting to confuse potential Click to edit Master text s victims and Fifth level stay below radar of IRS detection methods, scamsters use the name Inland Revenue Service. 35

36 Click Investment to edit Master scams title Elaborate scams with multiple elements (such Click as to fake edit government Master text officers s and websites) High loss ratio per victim ($2000- $300,000) Third level Exclusively foreign victims OFDP Fifth works level with IRS TIGTA/CI, SEC, and overseas partners to investigate 36

37 Sample of an investment scam Click to edit Master title Click to edit Master text s Fifth level 37

38 Click to Operations edit Master title 24x7 monitoring of Internet for fraudulent sites Works with researchers / industry / government groups to increase detection and response Click to edit Master text s capabilities Fifth level Incident Tracking of mailbox, phishing@irs.gov, for reports of websites, e- mails, and/or phone numbers involved in IRSrelated phishing Every incident is tracked until completion 38

39 Click to Prevention edit Master title Through a series of internal and external communications OFDP provides resources for individuals to avoid becoming identity theft victims, e.g., IRS.gov, Onguardonline.gov. Working with other Federal agencies through ID Theft Enforcement Working Group, Cyber Fraud Working Group, International BOTNET Click to edit Master text s Task Force, and others. Fifth level Advises compromised website owners to use the APWG redirect message and telcos to use the APWG Fax Coversheet. 39

40 Click to edit Master title Click to edit Master text s Fifth level 40 Source:

41 Click to Education edit Master title Go to IRS.gov and type the Search term Phishing. Click to edit In the Master search text results, s select Phishing Second and level Scams If/Then table for recipients of suspicious IRS Third communication level and other phishing attempts Easy Fifth to follow leveltable to determine how to route suspicious communications claiming to be from the IRS 41

42 PIPDS Click to Contact edit Master Information title Rebecca Chiaramida, Director Click to edit Master Privacy, text s Information Protection & Data Security Internal Revenue Service 1111 Fifth Constitution level Avenue NW, IR-7052 Washington, D.C Privacy@irs.gov 42