November 6, 2015

A data breach is the intentional or unintentional release or theft of secure information. It can be the improper disposal of personally identifiable information in the trash or a sophisticated cyber-attack on corporate computers by criminals. It can affect companies large or small.  The one common link is the victim, the person whose identity, financial or personal information has been compromised.

data-breachWhat You Should Know About Data Breaches

Tax-related identity theft is when someone uses your Social Security number to file a false tax return claiming a fraudulent refund. Your tax account is most at risk if the data breach involves both your SSN and financial data, such as wages.

The Internal Revenue Service is committed to working with taxpayers to ensure that all tax accounts remain secure.  The IRS stops the vast majority of fraudulent tax returns.  If fraud is suspected, the IRS will contact you via mail with instructions.  However, some unfortunate taxpayers may discover they have been victimized by a data breach when they attempt to file electronically and have their returns rejected by the IRS as duplicates.

It’s important to note that not every data breach results in identity theft, and not every identity theft is tax-related identity theft.  Data breaches involving just credit card numbers, health records without SSNs or even driver’s  license numbers, while certainly serious, will not affect your federal or state tax return.

What to Do If You Are the Victim of a Data Breach

Determine what type of Personally Identifiable Information (PII) has been lost or stolen. It is important to know what kind of information has been stolen so you can take the appropriate steps. For example, a stolen credit card number will not affect your IRS tax account.  Regardless of the nature of the breach, you should stay in touch with the company that lost your data. Companies sometimes offer special services, such as credit monitoring services, to assist victims. In addition, you should take the following steps recommended by the Federal Trade Commission.

  • File a police report
  • File a complaint with the FTC
  • Notify at least one of the three major credit bureaus in writing — Equifax, Experian and TransUnion —  (preferably all three) to place a fraud alert on your credit file
  • Close any accounts opened without your permission

If you received IRS correspondence or your e-file tax return was rejected as a duplicate, take these additional steps with the IRS:

  • Submit an IRS Form 14039, Identity Theft Affidavit
  • File your tax return (most likely by paper) and attach Form 14039
  • Watch for any follow-up correspondence from the IRS and respond quickly.

Who Should File Form 14039?

Form 14039 — Identity Theft Affidavit should be used if your Social Security number has been compromised and IRS has informed you that you may be a victim of identity theft tax fraud or your e-file return was rejected as a duplicate. The fillable form is available at IRS.gov. Follow the instructions exactly. You can fax or mail it or submit it with your paper tax return if you have been prevented from filing because someone else has already filed a return using your SSN. You only need to file the form once. After the form is processed, you will receive a special number to use in place of your Social Security number to file your federal income tax returns.  This number can be used with electronic filing — but should only be used with your federal tax returns, not with your state tax returns.