Tax pros: Beware of pandemic-related email schemes

All tax pros need to beware of evolving phishing scams that use various pandemic-related themes to steal client data. It is the tax preparer’s responsibility to secure their network to protect taxpayer data.

Tax pros, especially those who engage in remote transactions, remain vulnerable to identity thieves posing as potential clients. The criminals then trick practitioners into opening email links or attachments that infect computer systems.

The warning about these phishing scams comes as part of the IRS and its Security Summit partners annual summer campaign. This year's theme, Boost Security Immunity: Fight Against Identity Theft, urges tax pros to step up their efforts to protect client data.

Scams may differ in themes, but they generally have two traits:

• They appear to come from a known or trusted source, such as a colleague, bank, credit card company, cloud storage provider, tax software provider or even the IRS.
• They tell a story, often with an urgent tone, to trick the receiver into opening a link or attachment.

Fraudsters continue to impersonate pandemic-related government benefit programs to launch phishing campaigns. Pandemic-related scams may be delivered by email, social media, phone, or text, and may reference legitimate programs such as Economic Impact Payments. Instead of providing economic relief, these scams collect personal and financial information. Legitimate government programs will have corresponding information on their official government websites.

Phishing emails or SMS/texts - known as smishing - attempt to trick the person receiving the message into disclosing personal information such as passwords, bank account numbers, credit card numbers or Social Security numbers. Anyone with a smartphone is a potential target. Smishing scams may leverage the child tax credit or other pandemic-related tax-related programs to trick recipients into visiting phishing websites.

A specific kind of phishing email is called spear phishing. Rather than the scattershot nature of general phishing emails, scammers take time to identify their victim and craft a more enticing phishing email known as a lure. Scammers often use spear phishing to target tax pros.

In a reoccurring and very successful spear phishing scam, criminals pose as potential new clients, exchanging several emails with tax pros before following up with an attachment that they claimed was their tax information. Once the tax pro clicks on the URL or opens the attachment, malware secretly downloads onto their computer, giving thieves access to passwords to client accounts or remote access to the computer. Thieves then use this malware known as a remote access trojan to take over the tax professional's office computer system, identify pending tax returns, complete them and e-file them, changing only the bank account information to steal the refund. This scam remains popular as many tax pros continue to work remotely and communicate with clients over email versus in-person or over the phone because of COVID-19.

Tax pros should follow basic security steps to protect their accounts and client data. For example, using the two-factor or the multi-factor authentication option offered by tax preparation providers or storage providers would protect client accounts even if passwords were inadvertently disclosed. Keeping anti-virus software automatically updated helps prevent scams that target software vulnerabilities. Using drive encryption and regularly backing up files helps stop theft and ransomware attacks.

More information:
Publication 4557, Safeguarding Taxpayer Data 

Taxpayer can protect themselves from scammers by knowing how the IRS communicates

Please share this information with your clients.

If the IRS does call a taxpayer, it should not be a surprise because the agency will generally send a notice or letter first. Understanding how the IRS communicates can help taxpayers protect themselves from scammers who pretend to be from the IRS with the goal of stealing personal information.

Here are some facts about how the IRS communicates with taxpayers:

• The IRS doesn't normally initiate contact with taxpayers by email. Do not reply to an email from someone who claims to be from the IRS because the IRS email address could be spoofed or fake. Emails from IRS employees will end in irs.gov.
• The agency does not send text messages or contact people through social media. Fraudsters will impersonate legitimate government agents and agencies on social media and try to initiate contact with taxpayers.
• When the IRS needs to contact a taxpayer, the first contact is normally by letter delivered by the U.S. Postal Service. Debt relief firms send unsolicited tax debt relief offers through the mail. Fraudsters will often claim they already notified the taxpayer by U.S. mail.
• Depending on the situation, IRS employees may first call or visit with a taxpayer. In some instances, the IRS sends a letter or written notice to a taxpayer in advance, but not always. Taxpayers can search IRS notices by visiting Understanding Your IRS Notice or Letter. However, not all IRS notices are searchable on that site and just because someone references an IRS notice in email, phone call, text, or social media, does not mean the request is legitimate.
• IRS revenue agents or tax compliance officers may call a taxpayer or tax professional after mailing a notice to confirm an appointment or to discuss items for a scheduled audit. The IRS encourages taxpayers to review, How to Know it’s Really the IRS Calling or Knocking on Your Door: Collection.
• Private debt collectors can call taxpayers for the collection of certain outstanding inactive tax liabilities, but only after the taxpayer and their representative have received written notice. Private debt collection should not be confused with debt relief firms who will call, send lien notices via U.S. mail, or email taxpayers with debt relief offers. Taxpayers should contact the IRS regarding filing back taxes properly.
• IRS revenue officers and agents routinely make unannounced visits to a taxpayer’s home or place of business to discuss taxes owed, delinquent tax returns or a business falling behind on payroll tax deposits. IRS revenue officers will request payment of taxes owed by the taxpayer. However, taxpayers should remember that payment will never be requested to a source other than the U.S. Treasury.
• When visited by someone from the IRS, the taxpayers should always ask for credentials. IRS representatives can always provide two forms of official credentials: a pocket commission and a Personal Identity Verification Credential.

Upcoming Connecticut MeF Outage

The Connecticut Department of Revenue Services announced a planned outage starting around 11:30 AM on Thursday, September 2,2021 as they transition to a new system. The transition is expected to be completed and the MeF system back online by Monday, September 13, 2021.

No acknowledgments will be sent during this outage. This outage will only affect the business tax types (FID, CORP and PART). Individual Income Tax will not be affected.

Connecticut will be honoring the IRS postmark date, as well as the requested payment date of any payments sent during this outage.

Since CT will honor postmark and payment dates, our Electronic Filing Center (EFC) will continue to send submissions during the window.  Please transmit your returns as normal through your tax software.

Child Tax Credit: New update address feature available with IRS online portal

The Internal Revenue Service has launched a new feature allowing any family receiving monthly Child Tax Credit payments to quickly and easily update their mailing address using the Child Tax Credit Update Portal, found exclusively on IRS.gov. This feature will help any family that chooses to receive their payment by paper check avoid mailing delays or even having a check returned as undeliverable.

Any family can easily have their September check and all future checks sent to their new address by using the portal to make an address change request. To have the change take effect in September, people need to complete the request before midnight Eastern Time on Monday, Aug. 30. Families can still make changes after that date, but their request will not be effective until the next scheduled monthly payment.

If you change your mailing address using the Child Tax Credit Update Portal, the IRS will use this updated address for all future IRS correspondence so the address change feature can also be helpful to taxpayers that are receiving payments by direct deposit. For example, the IRS will mail a year-end summary statement (Letter 6419) to all taxpayers who have received advance Child Tax Credit payments during 2021, and having a current address on file with the IRS will ensure prompt delivery of this statement.

Families will need Letter 6419 to quickly and accurately fill out their 2021 federal income tax return next year. This is important because, for most families, the advance payments they are receiving during 2021 cover only half of the total credit. They will claim the remaining portion on their 2021 tax return.

The address change feature joins a growing set of services available through the Child Tax Credit Update Portal. Available only on IRS.gov, the portal already allows families to verify their eligibility for the payments and then, if they choose to:

• Switch from receiving a paper check to direct deposit;
• Change the account where their payment is direct deposited; or
• Stop monthly payments for the rest of 2021.

Any of these changes made before midnight ET on Aug. 30, will apply to the Sept. 15 payment and all subsequent monthly payments, scheduled for Oct. 15, Nov. 15, and Dec. 15.

Future enhancements are planned for the Child Tax Credit Portal

Later this year, families will also be able to use the Update Portal tool to:

• Add or remove children in most situations;
• Report a change in marital status; or
• Report a significant change in income.

Latest information for the Child Tax Credit payments on IRS.gov

The IRS has created a special Advance Child Tax Credit 2021 page designed to provide the most up-to-date information about the credit and the advance payments. It’s at IRS.gov/childtaxcredit2021.

The web page now features an updated set of frequently asked questions and a new user guide for the Child Tax Credit Update Portal (Publication 5549). It also provides direct links to the portal, as well as two other online tools-- the Non-Filer Sign Up Tool and the Child Tax Credit Eligibility Assistant -- and other useful resources.

Indiana Experiencing Ack Processing Delays due to scheduled maintenance

The Indiana Department of Revenue (DOR) will launch the third phase (Rollout 3) of its multi-year tax system modernization initiative, Project NextDOR, on Tuesday, Sept. 7, 2021. As DOR continues its transition to the new Indiana Tax System (ITS), there will be some outages for maintenance.

As a result, return submission acknowledgements will not be generated from 11:59 p.m. EST on Aug. 12, 2021, until 8 a.m. EST on Sept. 7, 2021. Tax return submissions received during this period will be processed when DOR’s system is back online.

*Resolved* New York Experiencing Ack Processing Delays

New York State has announced that the issue affecting their ability to retrieve MeF submissions and send acknowledgements has been resolved.  

***********

 New York State is currently unable to retrieve MeF submissions and send acknowledgements.  They are working on a resolution.

Once New York notifies us that the issue has been resolved and normal operations have resumed, we will update this blog post.

COVID Tax Tip 2021-120: Here’s how tax pros can help clients battle unemployment related identity theft

Unemployment compensation fraud was one of the more common identity theft schemes that emerged in 2020 as criminals exploited the COVID-19 pandemic and the resulting economic impact.

Unemployment compensation is taxable, although Congress waived the tax for 2020 for many people. States report compensation to the individual and to the IRS by using the Form 1099-G. Because of fraud and identity theft, many taxpayers received Forms 1099-G for compensation they were not paid. Some taxpayers received forms from multiple states.

This scam could affect 2020 or 2021 tax returns. Here are some steps tax pros should take to help victims of the unemployment compensation fraud scheme:

• File Form 14039, Identity Theft Affidavit. This should be done only if an e-filed tax return rejects because the client's Social Security number has already been used. Do not file the IRS Form 14039 to report unemployment compensation fraud to the IRS.
• Report fraud to state workforce agencies, and request a corrected Form 1099-G. Each state has its own process for reporting unemployment compensation fraud. The U.S. Department of Labor has created an information page with all state contacts and other information.
• File a tax return reporting only the actual income received. State workforce agencies may not be able to issue a corrected Form 1099-G in a timely manner. Even if the client has not received a corrected Form 1099-G, report only wages and income received and exclude any fraudulent claims.
• Consider an IRS Identity Protection PIN. Clients receiving Forms 1099-G are identity theft victims whose personal information could be used for additional criminal activities, such as filing fraudulent tax returns. All taxpayers who can verify their identities can now get an Identity Protection PIN to protect their SSN.
• Follow Federal Trade Commission recommendations for identity theft victims. Taxpayers should consider steps to protect their credit and other actions outlined by the FTC. The Department of Labor website explains how individuals should report unemployment identity theft
• Reply to notices in a timely manner. Tax pros' business clients can also assist in fighting unemployment compensation fraud by responding quickly to state notices about employees filing jobless claims, especially when it has no record of those employees.

The American Rescue Plan Act allows an exclusion of unemployment compensation of up to $10,200 for individuals for tax year 2020. In the case of married individuals filing jointly this exclusion is up to $10,200 per spouse. To qualify for this exclusion, the taxpayer’s adjusted gross income must be less than $150,000. This threshold applies to all filing statuses. The exclusion may ease the burden on many fraud victims. However, victims who received Forms 1099-G from multiple states may have fraud claims that exceed the exclusion amount.

More information: 

• Publication 4557, Safeguarding Taxpayer Data
  
• Publication5293, Data Security Resource Guide for Tax Professionals
  
• Small Business Information Security: The Fundamentals 
• Identity Theft Central