Transcription performed by LeahTranscribes[FULL TRANSCRIPT]
JACK: Internal Revenue Service is the American tax collection agency and guess how much money they collect every year from American taxpayers.
COMM’R: We collect three trillion dollars a year in a voluntary compliance system.
JACK: [MUSIC] That’s the IRS Commissioner himself. Three trillion dollars is a lot of money that travels through the IRS’s fingers and something I’ve learned over the years is that if that kind of money is going through an organization, it’s going to attract criminals and hackers like a hound dog attracts fleas. A lot has to be done to protect the IRS from attackers. There are problems; first of all, the budget is shrinking. Again, here’s the commissioner from 2015.
COMM’R: The IRS is now at its lowest level of funding since 2008. If you adjust for inflation our budget is now comparable to where we were in 1998. While our budget has been shrinking however, the taxpayer base has grown by millions. But after five years of budget cuts and a hiring freeze that has lasted for four years, people need to understand that the IRS is going to have to do less with less. It means that both enforcement and tax payer service will suffer.
JACK: From 2010 to 2015 the budget had gone down by 20%. You can already start to guess what kind of impact this may have on an organization.
COMM’R: Between 2010 and 2014 the IRS lost over 13,000 employees. We expect to lose another 3,000 more or less through attrition by the end of this year. We have only 650 employees out of 87,000 who are twenty-five or younger.
JACK: 87,000 employees and only 650 of them are under twenty-five? That’s like, less than 1%. Huh. Combine the dwindling staff and the budget cuts with aging equipment and computers and you can start to see that this could become a serious problem, and a problem for the IRS is a dream come true for hackers.
JACK (INTRO): [INTRO MUSIC] These are true stories from the dark side of the internet. I’m Jack Rhysider. This is Darknet Diaries. [INTRO MUSIC ENDS]
JACK: 2015 was a year full of data breaches. Starting the year off were two big breaches from healthcare providers. In February, Anthem announced that eighty million patient records were stolen. [MUSIC] Discovered around the same time was Premera Blue Cross and they found that possibly the same actors were in their network and admitted to a breach of eleven million patient records. So just in the first quarter of 2015 we saw almost one hundred million patient records get pinched by hackers. They didn’t actually steal medical records; instead they grabbed stuff like names, birthdays, medical IDs, social security numbers, street addresses, e-mail addresses, employee information, and income data. People weren’t sure what it could be used for and who’s doing this and why.
Was it just being sold on the dark market for a quick Bitcoin? Was this information collected as part of a multi-stage attack? In what ways could this information be valuable to hackers? How can you make money if you know someone’s name, address, social security number, and stuff like that? I’ll let you think about that for a minute. Let’s talk about the IRS. For my non-American listeners, the Internal Revenue Service is the US government agency that collects taxes. Most US citizens and businesses have to report their income to the IRS every year and pay taxes based on how much money they made. The IRS has to process hundreds of millions of tax forms a year. It’s an archaic and overly-complicated system. Basically us Americans pay a percentage of the money we make to the government so they can pay off national debts for military, social security, medical care for the elderly, and stuff like that.
The US government needs a lot of our money. On average they take about 14% of our paychecks. If you made $67,000 dollars a year, they want $9,000 of that. But here’s the thing; American’s don’t save up $9,000 to give it to them every year. We simply ask our employers to take out that money from our paycheck before we even get it. That way it’s all paid up and stuff. But we don’t always know how much to pay and sometimes we underpay and come tax time we have to pay a little bit more. But what a lot of people actually do is overpay and then the IRS gives us back the money we didn’t need to pay. This can sometimes be a nice-sized tax return, thousands of dollars. This process of tax filing is all super complicated and traditionally the IRS has handled all of this through paper forms. If you wanted to see your old tax records you had to fill out the IRS form 4506 and pay $50 and you can get your old tax record sent to you in the mail.
But in the last decade they’ve been moving to electronic filings where you can do the whole thing through the website, irs.gov. In January 2014 they made a new feature to irs.gov website called Get Transcript. [MUSIC] This would allow you to see your tax records from last year in case [00:05:00] you wanted to use them to help submit for this year. It was a fantastic feature and right away millions of Americans were using it to look up their tax forms from last year. Normally when you sign up for a bank account or medical provider you’re put through a sign-up process which often includes setting up a password and then some account recovery questions such as where you met your spouse or what high school you went to. The irs.gov website is different. They use something called instant KBA, or knowledge-based authentication.
This is a series of questions they ask that only you would know the answer to, like what your mortgage payment is and where you bought your car. It’s called instant KBA because they already have the answers on their side. This is a little different than a bank account where when they ask you the question, they don’t know the answer and you put the answer and then they save that for next time. With instant KBA they already know what high school you went to from your credit records. The IRS partners with one of the big credit reporting companies like EquiFax to learn more about you. Through this the IRS knows what streets you previously lived on and what credit cards you currently have and stuff like that. When you want to use the Get Transcript feature of the irs.gov website you’re asked a series of questions like this, questions only you would know the answer to which proves who you are and then they show you your old tax records.
But can you maybe guess at what a few problems are with this instant KBA? Well first of all, the IRS says 22% of people cannot answer the questions correctly themselves. Do you remember your phone number you had ten years ago or the address you had in college? Maybe, but when you’re seventy will you? Here’s another problem with instant KBA; you can’t opt out of it. The IRS and EquiFax have collected and stored this information about you that you didn’t give them authorization to keep. It can become a privacy issue. In fact NIST, a government-ran standards board, comments on this specifically, saying “It is inappropriate to involuntarily expose the privacy of unknown citizens of an instant KBA authentication scheme unless the risk is close to zero.” Another big issue with this knowledge-based authentication relies on knowing secret information about you.
As our data becomes more exposed to the world through breaches, this secret information is no longer secret. [MUSIC] Let’s go back to 2014 when this Get Transcript service was first introduced to the irs.gov website. Let’s say we wanted to get our old transcripts. First off, the site asks the following: name, social security number, address. Now historically your social security number is private and only a few people would know it but as data breaches happen, it’s becoming not as private anymore. Name and address are not that hard to figure out so these first questions could easily be defeated with anyone knowing this about you. At this point they make you sign up with an e-mail address and they send you an e-mail for next steps. Then you’re presented with four multiple choice instant KBA questions. Here’s a few samples.
Please select the county of the address you provided. Well, obviously you can look that up on any map, so that’s easy. Next question. According to our records, you previously lived in…insert town. Please select the street which you resided on in that town. Well, it’s a multiple choice question so you can look at the answers and rule out any streets that don’t exist in that town and then you’d have a fairly high chance of getting the answer right. Please select the city you previously resided in. Well, if the hacker had any data on you from previous breaches then this is probably included. Or heck, the answer might even be in the previous question. According to our records, you graduated from which of the following high schools? Well, have you been on Facebook lately? Pretty much everyone is on there and they all love to write what high school they went to so this is usually pretty easy to find. That’s it.
If you answer those questions correctly you get the historic tax records for that person. If you really look at it, because it’s multiple choice questions, we have a shot at getting all the questions right without even having breached data, just by Googling a person and where they used to live and stuff. This Get Transcript option at the irs.gov website was used by millions of people in 2014 and then again in 2015. It was a great feature but you may have noticed by now that the authentication method maybe wasn’t that secure. Let’s go to February 2015, same month that the Anthem breach was discovered. A guy named Michael Kasper goes to file his taxes. He fills out all the forms electronically and hits Submit but something’s wrong. The IRS’s website is telling him he’s already submitted his taxes but that’s impossible. He hasn’t submitted it yet. He calls the help line and you know what? I’ll let him tell the story.
MICHAEL: On Monday morning I called the IRS and they confirmed my identity by asking tax history-related questions and showed me that a deposit was being made the same day that I was calling into somebody’s account, but that it was too late to stop it at that point.
JACK: The IRS just told him that someone else filed a tax return in his name and a check was sent to that person. It had already been deposited. The IRS wasn’t able to tell him anything else like how much the check was worth, what bank it was deposited, or anything like that. The IRS can’t disclose this because of privacy.
MICHAEL: I was frustrated by that. [00:10:00] That’s when I tried the Get Transcript function on the IRS website to see if I could get a transcript and found out someone else had already registered their e-mail address with my social security number.
JACK: It appeared someone had already gone through the steps of doing a Get Transcript under Michael’s tax records and made an account as him. At this point Michael didn’t know what to think. He wondered if he got hacked or if someone stole his wallet or identity, or what had happened. Is it his fault this is happening? Over and over Michael had asked for more information about who filled out his taxes but the IRS was refusing to give any information. The law clearly states the IRS cannot share tax information with anyone and he wasn’t able to log into the IRS website and do the Get Transcript function because someone else already registered as his name. He felt stuck but he came up with a new plan. He figured out if you fill out the IRS form 4506 and include $50 they’ll send you a physical copy of your tax return.
MICHAEL: I found out I could get a photocopy for $50. They had been telling me I couldn’t get the information but if I paid $50 I could get it. So March 17th, I got a photocopy of the return which is when I found out that whoever filed had seen my 2013 return because the information was almost identical.
JACK: This was freaky. He was starting to put the pieces together now. Someone definitely did the Get Transcript process on irs.gov website, got a copy of his old tax return, and submitted a new one for this year. He looked at the tax return someone else submitted and they got a refund for $8,936. This was money the IRS owed Michael yet they sent it to this other person. Michael looked closer at his tax return…
MICHAEL: And saw the bank account number.
JACK: Michael is a smart guy, an engineer even, and wasn’t getting any help from the IRS and he was getting angry, angry that someone else stole his money from him. He decided to try to figure this out on his own.
MICHAEL: But I contacted the bank in Pennsylvania. They confirmed a deposit was made. I guess the metadata in the deposit actually showed my name and my social security going into someone else’s checking account. They told me the location, Williamsport, Pennsylvania where all the money was withdrawn. I contacted the local police there.
JACK: [MUSIC] The police called him back right away and wanted to know more. They opened up a case and began investigating who deposited the check. On that same day, Michael got a letter.
MICHAEL: I got a letter in the mail from the IRS that they had, six weeks later, received my documentation and that they would get back to me in six months.
JACK: This kind of made Michael mad. Almost immediately upon getting his tax records he was able to make a lot of progress by opening a police investigation, and here the IRS is saying it’s going to take them six months to investigate this?
MICHAEL: I also got a letter that week from Anthem Healthcare offering me free credit monitoring. I don’t really know if that is related to how my information was obtained.
JACK: Michael had his personal information stolen in the Anthem breach and remembered the data stolen in the Anthem breach included his name, social security number, and past addresses. This would probably be enough to pass the KBA and do the Get Transcript. The police went to the person’s house in Pennsylvania and they found this person who deposited the check was a young female college student.
MICHAEL: She had responded to a Craigslist ad offering a job opportunity.
JACK: Oh yeah, the old money mule scam. Okay, here’s how this works. [MUSIC] Criminals who need to move money around will offer up jobs on Craigslist saying something like an international finance company needs assistance writing letters. Then they’re given the job interview and get hired. First they’re given some basic tasks to do like correct some English on some e-mails. These basic tasks are just there to earn trust, then the criminals will give some sad story about how they need to pay a client immediately but funds are tied up. They ask the victim hey, if we send money to you, could you then send the check to the client? If they agree, a money mule is born. It’s very illegal to be a money mule and this young woman had no clue it was illegal. She just needed some extra cash to get through college.
MICHAEL: Money was deposited into her account and then she wired large amounts of it to Nigeria through Western Union.
JACK: She sent $7,000 to Nigeria and as a reward she was able to keep the other $1,900 which she used mostly on rent, leaving just $5 left in the account when the police caught her. She was arrested for being a money mule and later got out on bail, having to pay $8,500. Michael was frustrated with this whole ordeal so at the end of March he contacted the journalist Brian Krebs to share his story. Right away, his story showed up on Krebs on Security, a blog about breaches and security. The IRS noticed this blog post and eventually refunded the money back to him but this took months. Michael wasn’t the first to report this kind of fraud in 2015. Many more people were having the same issue, thousands of others. The IRS began looking into it.
The commissioner of the IRS, John Koskinen, called together a security summit to determine what’s going on. They saw this post on Krebs on Security and they were also told by the Utah State Tax Commissioner that they were seeing ten times [00:15:00] as much tax fraud this year compared to last year. The IRS was seeing that on a lot of these fraudulent tax returns, the tax forms were filled out exactly the same as the previous year, complete with any typos that were on the year before. This made it obvious that someone had gotten a bunch of people’s tax returns from last year and were submitting them fraudulently this year. The IRS went and looked at these fraudulent tax returns to see if there was a Get Transcript request on the website and sure enough there was. A lot of them were using the same exact e-mail address; hundreds, maybe thousands.
This was obviously a flaw in the IRS’s system, to have thousands of tax returns linked to the same e-mail address. The IRS conducted a deep dive investigation to see what was going on. Two months after that Krebs article, the IRS had figured it out. Through commonalities in e-mail addresses they found out that this crew had issued 13,000 fraudulent tax returns and if you add up all 13,000 tax refund checks, this crew stole around forty million dollars from the US Treasury. I want to take a moment to reflect on this for a second. When we hear about a breach of personal data stolen like at Anthem, we wonder how much this data can be worth and how could criminals use this to make money? Of course the obvious answer is that this information can be sold to others but using it to steal money from the IRS is not only more lucrative, it’s downright genius.
These criminals knew the tax system well enough that they used data stolen from a breach to get old tax transcripts and then they used those old tax filings to submit that person’s taxes this year. Then they had to set up a whole network of money mules and keep in mind, this requires Craigslist ads, and job interviews, and all this other stuff. Then they had to launder the money all the way back to them. They did this 13,000 times in about three months’ time. Unbelievable. By this point in May, IRS was on really high alert for fraudsters and criminal activity. This is when they noticed a really large spike in people using the Get Transfer option on the irs.gov website.
[MUSIC] This Get Transfer feature of the website was so popular that over twenty million requests were seen just in that year so during tax time that’s over 100,000 requests a day for the Get Transcript. But this spike was much more than that. This was like, hundreds of thousands more all in one day. In fact, it was so many requests that the systems started getting backed up and the IRS thought they were under a denial-of-service attack. They were able to keep the site up and sustain the flood of usage and things died down. A week later on May 21st, the security center within the IRS had discovered something terrible. It wasn’t legitimate users trying to do the Get Transfer of tax records. It was hackers, fraudsters, thieves. Over 200,000 suspicious attempts were made to Get Transcripts of taxpayers and half were successful.
The thieves successfully used the Get Transcript feature of the irs.gov website to obtain the tax records of 100,000 people. Now keep in mind, this isn’t a hack. The thieves didn’t use any trick or exploit or vulnerability. They simply found a way to navigate through the authentication system, probably by using some personal information they obtained from other breaches. But even though this isn’t a hack, it’s certainly a breach of data, very personal data, and it’s super scary to think about what criminals like this will do with your past tax records. These people have a lot of resources and time to move fast and steal a lot of money so this could possibly cause problems for those people for years or even life. Once the IRS detected that 100,000 tax records were stolen from their website they immediately disabled the Get Transfer feature. Five days later they announced to the public that there had been a breach and 100,000 tax records were stolen. The IRS made a bunch of corrective actions after this breach. Here’s the IRS Commissioner.
COMM’R: Letters have already gone out to the approximately 100,000 tax payers whose tax information was successfully obtained by unauthorized third parties. We are offering credit monitoring at our expense to this group of taxpayers, we’re also giving them the opportunity to obtain an Identity Protection Personal Identification Number, or IP PIN, as it’s known. This will further safeguard their IRS accounts. The Get Transcript application has also been taken down while we review options to make it more secure without rendering it inaccessible to legitimate taxpayers.
JACK: The IRS created this option to get an IP PIN, or Identity Protection Personal Information Number. This is a six-digit code that the IRS can issue you which would then be required to complete your tax return. This makes it harder for the criminals to submit taxes if they don’t know this PIN. The news of the IRS being breached was the top story in almost all news outlets in the US. Citizens were angry, congress and senators had questions. A full senate committee hearing was held to have the IRS testify. This is the IRS Commissioner John Koskinen’s opening statements.
COMM’R: The unauthorized attempts to access information using the Get Transcript application were made on approximately 200,000 taxpayer accounts from [00:20:00] questionable e-mail domains and the attempts were complex and sophisticated in nature. These attempts were made using taxpayer’s personal information already obtained from sources outside the IRS. During the middle of May our cyber-security team noticed unusual activity on the Get Transcript application. They ultimately uncovered questionable attempts to access the Get Transcript application. Of the approximately 100,000 successful attempts to access the application only 13,000 possibly fraudulent returns were filed for tax year 2014, for which the IRS issued refunds totalling about $39,000,000.
JACK: In this hearing we also hear from Michael Kasper, that guy who tracked down who stole his tax return himself. In fact the clips you heard earlier from him are from this senate hearing. In fact there were multiple hearings that went on for hours and hours. During the hearing we hear a little bit about the types of computer problems the IRS faces.
COMM’R: We are running an antiquated system with some applications that are fifty years old, as noted in some cases. Noted, we haven’t even been able to provide patches for all of the upgrades. Some of our systems don’t have patches ‘cause they’re no longer supported by the provider.
JACK: On one report after an inspection they found that over 30%of the systems in the network weren’t being monitored at all. If you stop to think for a moment, the IRS has pretty much every US citizen as a customer or client. Compare that to Facebook which only has about 68% of the US population as users. The IRS has a lot of users and with 87,000 people on the staff there are a lot of computers. At some point the size of the network becomes so big that it becomes a logistical nightmare to keep it secure. Both Democrats and Republicans offered their support and assistance to help the IRS combat this problem. They seemed to genuinely want this problem fixed. Here’s what one senator said to the IRS Commissioner during the testimony.
SENATOR: I told you yesterday on the phone, I’m here to help. How can I help you?
JACK: The senator seemed to understand the enormous complexity that the IRS faces in this situation and actually felt bad for the IRS Commissioner.
SENATOR: Mr. Koskinen, you have a tough job. There’s no question about it and I don’t know anybody that approaches it with a smile like you do. I’d be upset every day. I think there’s something wrong with you that you’re not upset every day. [LAUGHTER]
JACK: At some point in the hearing the senators wanted to know who was behind this attack.
COMM’R: News reports indicate that the recent IRS identity thieves may have been in Russia.
JACK: The IT inspector who conducted a security audit on the IRS commented on this.
INSPECTOR: Eventually we were able to track them down but at this stage when the report – there was a report that it was solely Russia and I want to make it clear that’s not the case. It’s beyond Russia. I just wanted to get that on the record.
COMM’R: When you say beyond Russia, what do you mean?
INSPECTOR: That there are other domains – the domains are located in nations other than Russia, in addition to Russia.
JACK: When the IRS became aware of this breach they immediately contacted Homeland Security to help them investigate who was behind this. Knowing that a lot of fraudulent uses of the Get Transcript had occurred, the IRS went back to look at the database. Over 23,000,000 times the Get Transcript service was used that year. The security team combed through those 23,000,000 requests and found more fraudulent requests. Three months after the initial discovery of the 100,000 stolen tax records, the IRS announced there were another 220,000 tax records that were illegally accessed. This raised the full number of stolen tax records to 334,000. Looking at some numbers here, it looks like the thieves were able to access about 54% of the transcripts they attempted to get from the website. Compare that to the 22% success rate for normal people.
It seems like criminals are better at knowing your personal information than you are. That’s just fascinating. If you remember, the IRS started using this IP PIN thing to add additional level of security to your taxes but this had a few problems of its own. First of all, your PIN is issued through the website. Compare that to where your bank sends you your PIN in the mail. If you lost your IRS PIN and you wanted to recover it, you had to go through the same irs.gov website to answer the same weak KBA questions that the attackers defeated to get your transcripts. Guess what? The criminals figured this out and began stealing PINs. On February 2016, the IRS issued a statement saying that there were over 464,000 unauthorized attempts to get the PIN. The hackers successfully got 101,000 PINs from taxpayers.
Then the IRS discovered something else. They conducted another audit on the people who did Get Transcript on the website. They found the number was higher than they initially thought. First the IRS said it was 101,000 people and then they discovered it was 334,000. Now the IRS is saying it’s twice that; 724,000 people got their tax returns stolen by criminals through this Get Transcript feature of the website. [00:25:00] More letters were sent and more free credit monitoring was issued. Within the IRS is a whole department called the IRS Criminal Investigation Division and the IRS itself has over 2,000 special agents that specifically investigate tax fraud. These special agents will work with the FBI, secret service, Homeland Security, and local police to track and catch these criminals.
But as budget cuts hits the IRS, this means about 4% of the special agents lose their job each year. When there’s less investigations there’s less arrests. The IRS Criminal Investigation Division opens about 3,5000 cases a year and they actually catch and convict about 3,000 people a year. Did they find out who did this and bring them to justice? I’m not sure. Here’s what I found, though. [MUSIC] The Department of Justice issues a press release each time someone gets sentenced for stolen identity refund fraud. It lists hundreds and hundreds of cases going all the way back to 2010. I started combing through it looking at case notes, and dates, and crimes to see if anything matched this. Stuff started showing up. Probably the biggest one I saw was a Nigerian man who was caught and sentenced to fifteen years in prison for running one of the biggest tax fraud schemes ever.
Here’s what happened; a bunch of people in the state of Oregon were reporting that someone had submitted their tax refund for them. The IRS criminal investigation team looked into it and found that someone was fraudulently submitting tax returns for the people in Oregon and taking all their refunds. They tracked this activity back to a Nigerian man named Kazeem who was living in Maryland. They arrested him and found in his house 150 prepaid credit cards, $40,000 in money orders, and $14,000 in cash. During trial they learned what happened. Kazeem had purchased personal identification information from a Vietnamese hacker, specifically 259,000 records from a company in Oregon. Perhaps the Vietnamese hacker stole a database from a credit agency or a medical facility in Oregon.
Kazeem then used this information to do Get Transcript on the irs.gov website and also get the PINs from the website to submit tax returns for those people. He submitted 10,000 tax returns which would have resulted in $91,000,000 if he got all the returns but a lot of them didn’t get accepted. He was only successfully able to get $11,000,000 back from fraudulent returns. To throw the police off he funnelled a lot of the money through Nigeria and then back to him. He had five other people working for him, all who were arrested and put in prison. Maybe this guy Kazeem was one of the bigger players in this breach but I don’t think he was the only one. Looking through the other arrests on the DOJ’s website, I see some more, this time even more close to home.
There’s a Texas guy that was caught and arrested for fraudulently using the Get Transcript feature and getting people’s information and submitting their tax returns for them. He was sentenced to two years in prison. Then there was a Georgia couple who were arrested for exploiting the Get Transcript feature and got over $1,000,000 in tax refunds. They were both put in prison for years, too. Then there was another guy in Texas who was also caught using the Get Transcript feature and submitted false tax returns, too. In fact, as I started looking at who’s been submitting fraudulent tax returns like this, the bottom of this story began to fall out. Take the case of Danielle, for example. She’s a 27 year old exotic dancer in Tampa, Florida but she was arrested for tax fraud. She had stolen over $1,000,000 in tax refunds from people she didn’t know.
She continued to get away with it for four years. In fact, in some circles she’s known as a pioneer of this stuff. She would organize something called drop parties. This is where you get together and swap tactics, stolen personal information data, and teach others how to do it. She was eventually caught and put in prison. This made me look up the term drop party. This could have been a term she invented but it’s slang used in some circles specifically in Tampa, Florida because only in Tampa have I found the term drop to mean tax fraud. Okay, okay, I’m gonna play you something that might blow your mind but I want to warn you, it’s not safe for work. If you have young kids or something you may want to skip ahead three minutes. Here’s the thing; gangster rappers sometimes boast about the crimes they commit right in the lyrics. They talk about shooting people, stealing stuff, and drug dealing. But listen to this song.
J-CREEK: [MUSIC] Yours truly, J-Creek, Tom Creek, n–. Tax season again. I need a drop hoe bitch. I wanna be your boyfriend. I want a drop hoe. I need a drop hoe.
JACK: What? This song called Drop Hoe is a ballad about a guy trying to find a girlfriend who makes a living off of identity theft tax fraud. It practically goes through step-by-step on how to do it. Here’s some more lyrics.
J-CREEK: [MUSIC] Said her home girl came with a few names, told me all a n– need is a laptop, and she gonna show me what to do to make a tax drop.
JACK: Said her home girl came with a few names, told me all a guy needs is a laptop, and she’s gonna show me what to do to make a tax drop and Ima steal your information on the W-2. Say she needs an address to get more cards. Wanna be a hood rich honey? Ima show you. Told me get a date of birth, don’t forget the social. She got them stacks then went tax on the turbo.
J-CREEK: [MUSIC] Trying to find a drop hoe, it ain’t hard. No, you can look for new rims and a paint job. [00:30:00] Keep her hair done, nails done, nice clothes…
JACK: Wow. Just wow. He even said what tools he used, Turbo Tax. I mean, how popular is this crime? You have to hand it to the gangster rap community. They don’t hoard their exploits; they share them openly on the public stage. It’s kind of like they’re saying hey, this is what we do down in Tampa. But seriously, has tax fraud gotten to the point where gangster rap is in on it? Yeah, I guess so. It appears especially so in the southeast of the US. Alabama, Georgia, Louisiana, and Florida top the charts for the most arrests made for stolen identity tax fraud. These states are ridiculously higher than the others. Keep in mind, they’re exploiting people from all around the country but for some reason in this region, a skill is passed around on the streets and at drop parties.
At some arrests I’ve read it’s been an elaborate scheme where one member of the crew will go work at a company and steal all the W-2s and then another will file the taxes and then someone else will work at a cash-checking place and knowingly cash fraudulent checks. This kind of stuff is seen over and over in these states. It’s crazy. This is what I mean by the story becomes bottomless as I’m trying to figure out who is behind this, because there’s just so many of these cases and it’s a gray line between tax fraud and Get Transcript and stolen identities. But knowing this we do get a glimpse on who’s using your information and how it’s being used against you.
You may think this isn’t your problem, it’s the IRS’s problem, but if you rely on or expect a large tax return and someone else gets it instead of you, it’s your problem now. Sure, the IRS may spend six months investigating and pay it back to you but that delay can be a nightmare. We need to protect ourselves. The IRS brought back the Get Transcript feature on the website and now it requires additional information like you need to know your mortgage account number and phone number to get your transcript. But you can see this KBA authentication method is starting to show its age and may not be secure anymore because the information that only you know is now known by hackers around the world. Who knows what was stolen from that EquiFax breach? Maybe the entire KBA database. This could have exposed all of our secret information which would have completely nullified the KBA altogether. The KBA system is not just used at the IRS.
You can also see it over at annualcreditreport.com so it’s possible these thieves are targeting your credit records, too. Maybe they already have and nobody noticed or disclosed of this breach. It’s also possible that with enough information about you, someone can open a credit card in your name and take loans out in your name. Not only does a breach with your data impact your tax refunds but it can now put you in a serious debt that you didn’t actually spend. The IRS faces thousands and thousands of people trying to conduct tax fraud every year. They’re successful at stopping most of it and even putting thousands of fraudsters in jail but the security they put in place today may not work next year. The IRS doesn’t have traditional security problems that take traditional security solutions.
They’re developing extremely advanced filters and algorithms to detect fraud and have done an amazing job at mitigating it. But it’s one of those things that will never get down to zero because fraudsters will continuously be looking for loopholes or weak security measures and exploit them whenever they can. I can’t imagine the nightmare of trying to secure the IRS. Because it collects over three trillion dollars in tax revenue a year, it’s a red hot target. The IRS sees an endless amount of attacks, scams, frauds, and thieves, especially during tax season when criminals can try to hide in the mass amounts of tax returns being sent. One of the biggest problems with the IRS’s website is that it has to be easy enough for the elderly to use but actually secure at the same time. I’m not sure if forcing everyone to register with an e-mail or two-factor authentication is even doable.
It’s such a complex issue that it actually gave me a headache trying to figure out a solution to this problem. This is the new threat landscape that governments have to face though, and these attacks are getting bigger and more sophisticated. In 2016 we saw a rash of companies getting breached and what was stolen was simply their W-2 tax statements. Past and present employees from CGATE and Snapchat had their W-2s stolen which was enough information for those street gangs to file returns and open credit cards up in your name. I’ll leave you with some recommendations on how to keep yourself safe with the IRS. First, go to irs.gov and register at the site. Link your identity to your e-mail address. This will prevent criminals from registering for you. This is a simple thing to do so there’s no excuse not doing it.
If you want to take it a step further, register for the IP PIN. This is a unique number that you must have to complete your taxes but the problem is you can’t opt out of the IP PIN and it changes every year. If you take this path, you’re taking it for life. Third, freeze your credit at all free credit monitoring agencies. This way, nobody can take loans out in your name or open new lines of credit. Lastly, file your taxes early before the bad guys can do it for you.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. This show is made by me, Mr. Ribbit, Jack Rhysider. When I say it was made by me, I mean everything; the research, the writing, the music design, the editing, and the narration. It takes a lot of work to make each episode so I would really appreciate it if you showed support [00:35:00] by going to patreon.com/darknetdiaries and donate to the show. Donations can only bring good things like better audio, better stories, more stories, and less ads. The theme music for this show was created by the beat master toe-tapper Breakmaster Cylinder. Peace.
[OUTRO MUSIC ENDS]
[END OF RECORDING]