Security
The IRS has suspended the online tool used to retrieve Identity Protection (IP) PINs, a six-digit number needed by victims of tax refund fraud to file their taxes electronically, after reports that the system suffered the same security weakness that allowed hackers to trick the “Get Transcript” tool into giving up taxpayer information last year.
Concerns about the tool were put into the spotlight last week after journalist Brian Krebs wrote about a South Dakota woman, Becky Wittrock, who said fraudulent tax returns were filed in her name two years in a row, and that the phony filing this year included her stolen IP PIN. That PIN was meant to add a layer of security to prevent this exact type of problem.
IRS Statement on IP PIN
As part of its ongoing security review, the Internal Revenue Service temporarily suspended the Identity Protection (IP) PIN tool on IRS.gov. The IRS is conducting a further review of the application, which allows taxpayers to retrieve their IP PINs online and is looking at further strengthening the security features on the tool.
Taxpayers who have been issued an IP PIN should continue to file their tax returns as they normally would. The online tool is primarily used by taxpayers who have lost their IP PINs and need to retrieve their numbers. Most taxpayers receive their IP PIN via mail and never use the online tool.
Guidance for taxpayers using an IP PIN
The IP PIN is a six-digit number that provides an additional layer of protection for taxpayers who have been or could become victims of tax-related identity theft. Taxpayers who receive an IP PIN must use it on electronic and paper returns in order for the returns to be accepted for processing.
The IRS offers the following guidance following the removal of the online option:
- Lost or misplaced IP PIN letters. Taxpayers who are IP PIN holders but who lost their CP01A letters containing the IP PIN will need to call the IRS. If they can verify their identity, they will be mailed their IP PIN. If they have moved since Jan. 1, 2016, they must file a paper tax return, which will receive additional scrutiny and take longer to process because we don’t normally accept these returns without an IP PIN.
- Florida, Georgia and District of Columbia participants. Taxpayers who live in Florida, Georgia or the District of Columbia and who already have retrieved an IP PIN should include it on their tax returns. Taxpayers in those locations who have not retrieved an IP PIN will be unable to access the tool at this time but may file their tax return as normal.
- Other taxpayers. Taxpayers who filed a Form 14039 citing non-tax identity theft issues (Box 2) and who already have retrieved an IP PIN should include it on their tax returns.
