Identity Theft at my wife's employer...uggh

[Scarpozzi]

My wife works for a doctor's office. Some idiot in HR installed a Trojan or fell for a phishing scam (this is our best guess). Everyone's tax data got compromised.

I hurried up and got all of our stuff together and tried to e-file tonight...sure enough, her SSN has already been filed on a return. I know this has been happening pretty frequently and there is a basic form you can submit to the IRS via snail mail to resolve the issue...when they get around to it.

Her office was kind enough to offer 1 year of Life Lock for free. It's an amazing $59 value or whatever they charge for it. I've already put a 90 day watch on her account with one of the credit bureaus..... Since her employer is responsible for the data breach through lack of training or at least for hiring an idiot, what should we request to make us feel better about this?

Thanks for any advice or guidance....and get ready to see this sort of thing happen more and more frequently.

 

[Ns1]

Underpay taxes so you never get a refund?

 

[Scarpozzi]

Underpay taxes so you never get a refund?

True. Maybe if we underpay we can find a stupid criminal to pay the balance owed on our taxes.

 

[BrunoPuntzJones]

A doctor's office...? Like with HIPPA and stuff? Shitcan the HR idiot and shitcan the IT staff that didn't have it locked down like daddy's girl on prom night.

 

[Scarpozzi]

A doctor's office...? Like with HIPPA and stuff? Shitcan the HR idiot and shitcan the IT staff that didn't have it locked down like daddy's girl on prom night.

That's what I said. They need a SPAM firewall, better group policies/anti-virus software.....better IT and HR employees.....better training to not be idiots.

The data breach was limited to HR for my understanding. (different office location than the doc offices) I think everyone knows how that stuff works these days. It just takes one person with the right access to install a Trojan. I think their tax stuff is probably outsourced to an external company...they could have also given out that user/pass combo and been compromised that way. I'd like to have more information, then have them pay me to do some consulting there to decrease the likelihood of it happening again.

 

[OutHouse]

They need a SPAM firewall, better group policies/anti-virus software.....better IT and HR employees

thats money a doctors office will not spend.

 

[Carson Dyle]

I assume that means they have info like her name, address, age, and social security number.

Apart from filing a fake tax return, where else could they hurt you? Could someone get loans or credit cards in her identity using only that information?

 

[Elixer]

That's what I said. They need a SPAM firewall, better group policies/anti-virus software.....better IT and HR employees.....better training to not be idiots.

The data breach was limited to HR for my understanding. (different office location than the doc offices) I think everyone knows how that stuff works these days. It just takes one person with the right access to install a Trojan. I think their tax stuff is probably outsourced to an external company...they could have also given out that user/pass combo and been compromised that way. I'd like to have more information, then have them pay me to do some consulting there to decrease the likelihood of it happening again.

Even if it was HR, they still must follow HIPPA, so, more than one person screwed up here.
I assume this has been reported to the authorities ? Could be a inside job.

 

[stlc8tr]

Underpay taxes so you never get a refund?

It doesn't work like that. The ID thieves use fake data so it doesn't matter if you're owed a refund or need to pay.

 

[Carson Dyle]

It doesn't work like that. The ID thieves use fake data so it doesn't matter if you're owed a refund or need to pay.

Wah?? The employer files a W-2 form stating earnings and taxes withheld. How does someone filing a return fake the data and get a refund without the IRS cross-checking their records first?

 

[Bock]

Wah?? The employer files a W-2 form stating earnings and taxes withheld. How does someone filing a return fake the data and get a refund without the IRS cross-checking their records first?

the irs does in fact check b4 sending a refund. the tax preparation places that give you a loan as soon as the irs accepts your return....D:

 

[Carson Dyle]

the irs does in fact check b4 sending a refund. the tax preparation places that give you a loan as soon as the irs accepts your return...

I've never used a prep service. They don't ask the person they're handing money to for some proof of ID?

 

[Six]

Lifelock is a scam.

 

[Scarpozzi]

I wonder if they got my SSN and the kids' info too. It appears to be targeted to tax returns, but I don't know when it happened or any confirmed details. I am hoping it's a local/inside job and not someone who would retain the data.

 

[Raizinman]

The OP sounds like an ad for Life Lock. Scam is right.

 

[BarkingGhostar]

The OP sounds like an ad for Life Lock. Scam is right.

Agreed.

 

[Scarpozzi]

In my OP, your sarcasm meters apparently didn't go off. If you ask me all of those companies and the three credit bureaus are scams for all of the things they sell since they control so much.

I am more angry at her office than anything. I need to find out, if I need to get the IRS Form 14039 notarized. This is all going to be a royal pain.

 

[Carson Dyle]

I wonder if they got my SSN and the kids' info too. It appears to be targeted to tax returns, but I don't know when it happened or any confirmed details. I am hoping it's a local/inside job and not someone who would retain the data.

Why would your SSN be on file with your wife's employer? Is that normal?

Inside job or Russian hacker ... I think you're equally screwed.

 

[DrPizza]

Wah?? The employer files a W-2 form stating earnings and taxes withheld. How does someone filing a return fake the data and get a refund without the IRS cross-checking their records first?

I think my tax return was more than 3 lines long.

How much did you earn?__________
How much tax did you pay?________
You owe/get a refund of ___________


In between, there were lots and lots of lines for various deductions. Since, for the majority of typical people, withheld is reasonably close to what should have been withheld, all it takes is a few fraudulent deductions to go from owing a couple hundred to getting a few hundred back on a return. And, that's not the low hanging fruit. Unless I'm mistaken, more people get returns than end up owing.

Average tax refund so far this year on federal returns is over $3000. So, for the scammers, they can steal 100 identities and make a fortune.
http://money.cnn.com/2015/02/06/pf/taxes/average-tax-refund/

 

[BrunoPuntzJones]

Wah?? The employer files a W-2 form stating earnings and taxes withheld. How does someone filing a return fake the data and get a refund without the IRS cross-checking their records first?

W-2s aren't due until March 31 for a lot of employers. IRS doesn't have anything to check against.

 

[Carson Dyle]

W-2s aren't due until March 31 for a lot of employers. IRS doesn't have anything to check against.

You can get a refund without the IRS even having a W-2 in hand?

 

[KeithP]

The data breach was limited to HR for my understanding.

I am curious...who determined that? Was it the same person(s) responsible for not locking down the system properly in the first place? And how did they determine what was accessed?

Given that there are serious consequences under HIPPA if unsecured client healthcare records are stolen I am not sure I would trust the office IT staff to do their own audit of what happened and what was accessed.

-KeithP

 

[BrunoPuntzJones]

You can get a refund without the IRS even having a W-2 in hand?

Yeah and the W-2 doesn't matter much anyway.

Just throw some numbers on your return saying you made $25,000 and have 3 kids, and you get a $9,000 tax refund. People do it all the time.

 

[lk2500]

Since somebody filed a fraudulent report you need to contact the IRS first, then file a report with the FTC and your local police department (just a formality since they can't do anything about it).

Then you'll need to mail in your tax return with form 14039. The IRS person will give you exact instructions.

The 90 day fraud alert doesn't do much, it just flags your account so that creditors are "supposed" to contact you prior to issuing credit. They can still pull her credit report and issue credit in her name. You might consider a credit freeze instead, I know a lot of peeps affected by the Anthem breach did that. Read more here: http://learn.equifax.com/credit/fraud-alerts/



People can apply for more than credit with that info. They can apply for unemployment, medical, credit, utilities, etc. ... That is where a service like Life Lock can help - by searching databases for her SSN.

 

[Genx87]

You can put a lock on your credit. Helps to keep theives from opening credit under your name.