The US Internal Revenue Service (IRS) has been forced to admit that the scam it fell victim to earlier this year allowing cybercriminals to steal taxpayers' personal details actually affected almost double the number stated at the time.
The original incident was spotted back in May, when cyber fraudsters used data harvested from a source outside the IRS to pass verification checks needed to access the “Get Transcript” system.
This allowed them to be reissued filings and tax returns for previous years on behalf of legit taxpayers – information which could be used to file fraudulent returns early ahead of the 2016 tax year and claim refunds back from the IRS.
Originally the IRS said that 114,000 attempts to clear the Get Transcript authentication process were successful and a further 110,000 attempts failed.
However, a deeper analysis of more than 23 million uses of the system revealed the following:
“The new review identified an estimated additional 220,000 attempts where individuals with taxpayer-specific sensitive data cleared the Get Transcript verification process. The review also identified an additional 170,000 suspected attempts that failed to clear the authentication processes.
The IRS will begin mailing letters in the next few days to the taxpayers whose accounts may have been accessed. Given the uncertainty in many of these cases — where a tax return was filed before the Get Transcript access occurred for example — the IRS notices will advise taxpayers that they can disregard the letter if they were actually the ones seeking a copy of their tax return information.”
The US taxman added that anyone receiving a letter who hasn’t applied to Get Transcript should take advantage of free credit monitoring to spot any ID theft activity, and a unique IP PIN to verify the authenticity of next year’s return.
Get Transcript was shut down immediately after the scam was discovered and the IRS said it is continuing work on “strengthening the system.”