State stops millions in fraudulent tax refunds

It’s tax season, which means it’s prime time for hackers looking to collect refunds owed to other individuals.

Hamrick

In 2017 alone, the Internal Revenue Service reported that it caught $6 billion in fraudulent tax returns.

“The threats are absolutely getting worse, because they’re more complex and more numerous,” said Mark Hamrick, senior economic analyst at Bankrate.com. “The IRS, I’m sure, would say they’re doing a lot, but they could always do more.”

Thanks to a fraud-prevention program the Indiana Department of Revenue implemented in 2014, those imposters don’t seem to be targeting Hoosiers as much anymore.

Indiana’s Identity Protection and Fraud Prevention Program has stopped the state from paying more than $111 million in refunds for more than 61,000 fraudulent tax returns. The system uses an algorithm to flag suspicious returns and an identity-confirmation quiz to protect legitimate taxpayers.

Krupp

“That is money that would have gone out the door that we have stopped,” Department of Revenue Commissioner Adam Krupp said. “Now we’re preventing that from happening, and everybody recognizes Indiana in this particular space as being one of the leading agencies in the country at stopping tax-return fraud and attempted identification theft.”

Eva Velasquez, CEO and president of San Diego-based Identity Theft Resource Center, said she’s been aware of Indiana’s program for several years and called it “almost a model process.” She said, given Indiana’s size, saving more than $111 million over a four-year period is significant.

“This is a very good way to do this,” she said. “They are essentially doing what we need to do on a grander scale.”

But despite the progress, experts say fraud won’t be eliminated, because hackers are constantly evolving.

Velasquez

Hamrick said technology has made it easier for criminals to find addresses, phone numbers and other personal data that make fraud more possible.

“The good news is, we’re all connected,” he said. “The bad news is, we’re all connected.”

But Krupp sees technology as a huge benefit to fraud detection, despite the negative consequences.

“Before the technology was available to us, it was hit and miss,” he said. “If an employee was going through a paper return … you’d have to rely on the ability to spot something.”

The department now collects data on all tax returns, regardless of whether they are filed electronically or on paper, and runs it through an algorithm that searches for suspicious activity.

“It’s made our job a lot easier to identify and stop the activity from happening because these analytics and the algorithms run 24-7-365,” Krupp said.

If the system flags a return, the state can send the individual a notification to complete an identity-confirmation quiz, which can be finished in a few minutes.

If the taxpayer passes the quiz, the tax return is immediately processed. If the person fails the quiz, the return goes through another round of review with someone who works on the department’s fraud-prevention team.

“We’re trying to help you and confirm that you actually did file a tax return,” Krupp said. “A lot of people appreciate that. But, as you can imagine, a lot of people get angry and frustrated at that, even though we’re trying to help them.”

Velasquez said it’s important for any system to use both technology and manpower so legitimate returns aren’t rejected because of rigid programming. She also suggested these programs include multiple layers of identity confirmation, like the identity quiz Indiana is using.

In the first year of Indiana’s program, which was overseen by former Department of Revenue Commissioner Mike Alley, the state saved $88 million in refunds that would have been issued based on fraudulent tax returns.

That dropped significantly in 2015 to $14 million and is at $1.3 million so far this year.

Krupp said that means the program is working.

“People see that and say, ‘So you’re preventing a lot less?’” Krupp said. Instead, it’s “because we’ve deterred people and pushed them away…. Indiana is not easy to steal from anymore.”

Velasquez said Indiana has likely pushed criminals to other states where fraud is easier, but the hackers definitely remain.

“It’s like squeezing a balloon,” Velasquez said. “If there are other states that don’t have anything in place or minimal things in place, then, yes, the thieves will migrate there.”

Some fraud does still sneak through in Indiana, although it’s somewhat unclear how much because it’s caught only when taxpayers notify the state they’re having trouble filing their returns. Usually, that’s because fraudsters have already filed returns in their names.

Also, the Indiana Department of Revenue didn’t start tracking the successful fraud attempts until last year, when it says $73,000 worth of fraudulent returns beat the system. This year, $3,000 in fraudulent refunds has been detected so far.

The department estimated that $20 million to $30 million in fraudulent payments were made in 2014, as the new system was being implemented.

“There’s always going to be some that make it through that we’ll never know about,” Krupp said. “Our objective is to minimize that as much as possible. No system is perfect.”

And the department is constantly tweaking the analytics, he said, so it’s not wrongly delaying returns from legitimate filers.

This year, the department expects to reduce the number of identity-confirmation quizzes it issues to about 150,000, compared to 267,000 in 2017.

“We want to make sure we’re catching the bad actors and through that process we’re not frustrating 150,000 Hoosiers that should have gotten their refund sooner,” Krupp said.

So far, he said, the program hasn’t delayed the processing of legitimate tax refunds. The state tries to average 14 days or less, and Krupp said the department is averaging slightly better than that so far this year.

That’s not the case in some states, including New York, where the Department of Taxation and Finance has described the longer time frame to issue refunds as “the new norm” because of fraud and identity-theft measures introduced last year.

And nationwide, the impact of tax-return fraud is only expected to get worse.

The IRS has already alerted taxpayers about a new scam, in which someone files a fraudulent return but has the refund sent to the legitimate taxpayer’s bank account. The fraudster then calls the taxpayer and says the money must be returned—but to the fraudster rather than the IRS or the state.

“That’s an effort to defeat some of those flag analytics,” Velasquez said. “They are always going to come up with clever new ways to exploit those vulnerabilities.”•