IRS says thieves stole tax info from 100,000 • Hacker News Board

Re: IRS says thieves stole tax info from 100,000

#11

Post by protomyth » Tue, May 26, 2015, 9:07 PM UTC

zaroth wrote: post #5

Krebs wrote about this in March: http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before... He has some good advice; claim your account before someone else does.

"Kasper said the detective learned that money was deposited into her account, and that she sent the money out to locations in Nigeria via Western Union wire transfer, keeping some as a profit, and apparently never suspecting that she might be doing something illegal."

I am having a really tough time believing she never suspected she was doing something illegal.

Re: IRS says thieves stole tax info from 100,000

#12

Post by [deleted] » Tue, May 26, 2015, 9:07 PM UTC

[deleted]

Re: IRS says thieves stole tax info from 100,000

#13

Post by r00fus » Tue, May 26, 2015, 9:10 PM UTC

dragontamer wrote: post #7

seanp2k2 wrote: post #4

Earlier quoted context omitted.

This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.

USPS is rumored to be working on such a system actually. http://securekey.com/press-releases/securekey-technologies-w... SecureKey IIRC is used by Canada. USPS is in a unique position in that they have a ton of employees literally who can verify mailing addresses by brute force. Every day (except holidays). Rain, Snow or shine. Having USPS in charge of the US's future "online identity" would be a good way of transfor…

This is/should be the main offering of the USPS - secure identity location verification.

It's too bad their hands are so tied by Congress (and a malicious one at that - having to pay pension fund 75 years early)... they might have made this move a decade or so earlier.

Re: IRS says thieves stole tax info from 100,000

#14

Post by scrollaway » Tue, May 26, 2015, 9:16 PM UTC

bitJericho wrote: post #8

seanp2k2 wrote: post #4

Earlier quoted context omitted.

This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.

The SSN was never designed or intended to be an ID number for anything but social security.

As a french citizen, and on behalf of everybody I know who doesn't live in the US (and some that do), the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous.

Re: IRS says thieves stole tax info from 100,000

#15

Post by [deleted] » Tue, May 26, 2015, 9:24 PM UTC

dragontamer wrote: post #7

seanp2k2 wrote: post #4

Earlier quoted context omitted.

This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.

USPS is rumored to be working on such a system actually. http://securekey.com/press-releases/securekey-technologies-w... SecureKey IIRC is used by Canada. USPS is in a unique position in that they have a ton of employees literally who can verify mailing addresses by brute force. Every day (except holidays). Rain, Snow or shine. Having USPS in charge of the US's future "online identity" would be a good way of transfor…

[deleted]

Re: IRS says thieves stole tax info from 100,000

#16

Post by iak8god » Tue, May 26, 2015, 9:26 PM UTC

scrollaway wrote: post #14

bitJericho wrote: post #8

Earlier quoted context omitted.

The SSN was never designed or intended to be an ID number for anything but social security.

As a french citizen, and on behalf of everybody I know who doesn't live in the US (and some that do), the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous.

> the idea that knowing somebody's SSN basically puts you in control of their life and gives you the ability to ruin it is unbelievably ridiculous

Especially since they get passed all around like that's not the case by employers, insurers, creditors, etc, etc.

Re: IRS says thieves stole tax info from 100,000

#17

Post by vinhboy » Tue, May 26, 2015, 9:28 PM UTC

I'll never understand why our politicians continue to cut funding to the one organization that could help the government save AND make more money.

Not to mention save all of us from the headache of things like this.

Re: IRS says thieves stole tax info from 100,000

#18

Post by jws » Tue, May 26, 2015, 9:28 PM UTC

seanp2k2 wrote: post #4

byoung2 wrote: post #2

The IRS said the thieves accessed a system called “Get Transcript.” In order to access the information, the thieves cleared a security screen that required knowledge about the taxpayer, including Social Security number, date of birth, tax filing status and street address. Do we know if the system was compromised, or if the thieves just had access to the personal information of those taxpayers?

This happened to a few people I work with. 100k seems low. They found out by the IRS rejecting their return as they had "already filed". You'd think we'd have a better system by now than a short-ish unique number which never changes during your lifetime as the key for much of your financial / credit-related authorization.

This isn't about the normal theft of someone's tax refund by fraudulently filing a tax return. This about the IRS itself divulging the sensitive data required to fraudulently file tax returns. Someone tried about 200k times and got about 100k sets of people's tax histories.

In the more mundane act of fraudulently bypassing the IRS's trivial security to steal a tax return… thieves got me, probably as a result of Anthem's inadequate security. The thieves didn't even have the courtesy to pay what I owed! I say you file my tax return, you take your chances.

The maddening part, aside from the scramble when the April 14th filing from the tax people failed, is that no one in law enforcement is the slightest bit interested in enforcing the law.

Re: IRS says thieves stole tax info from 100,000

#19

Post by pki » Tue, May 26, 2015, 9:30 PM UTC

protomyth wrote: post #11

zaroth wrote: post #5

Krebs wrote about this in March: http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before... He has some good advice; claim your account before someone else does.

"Kasper said the detective learned that money was deposited into her account, and that she sent the money out to locations in Nigeria via Western Union wire transfer, keeping some as a profit, and apparently never suspecting that she might be doing something illegal." I am having a really tough time believing she never suspected she was doing something illegal.

to be fair, a lot of these money mules advertise as 'legitimate jobs' and stuff, targetting the less-smart people generally..

Re: IRS says thieves stole tax info from 100,000

#20

Post by bcantrill » Tue, May 26, 2015, 9:33 PM UTC

I believe that this actually happened to me -- which tells me the 100,000 number is way too low. To be more precise: when we went to electronically file our 2014 return, it was rejected because our return had already been filed (not by us, of course). I (like 80+ million others) am a victim of the Anthem breach, and I have assumed that my fraudulent return was part of that breach. (Regardless, I have opted into the identity protection that Anthem has provided as restitution to victims of the breach.[1])

As part of clearing this up with the IRS, I had to verify my own identity and validate that the return that we (physically) sent was the true and correct return. After a whopping 2+ hours on hold, I ran a grueling gauntlet of rather obscure questions that amount to some flimsy shared secrets I happen to have with the IRS. Once my identity was confirmed, I learned that the thieves had filed a 2014 AGI that exactly matched my 2013 AGI. The IRS representative told me that this was unusual (that is, that they normally they just make numbers up), and it's clearly stupid (my return was flagged and didn't pay out), but it obviously left me concerned that someone had somehow located my 2013 return. With this latest revelation, it's now clear that this could have easily happened via the IRS itself.

Assuming that my experience is indicative of a larger trend, I expect many more similar revelations as the IRS picks up the debris from the 2014 tax season -- and it wouldn't surprise me at all if the true target of the Anthem breach wasn't in fact the IRS: this crime is just too damn easy to pull off and get away with. The bright side of all this: things very clearly have to change, and I wouldn't be at all surprised if the IRS ends up issuing PINs to all e-filers this coming year.

[1] https://www.anthemfacts.com