By submitting mock Free Application for Federal Student Aid (FAFSA) forms with stolen data, scammers were able to access detailed tax information of approximately 100,000 taxpayers, according to IRS Commissioner John Koskinen.
“We had an early indication in September that it was possible, with relatively little stolen information, to pretend you were a student, go online, start to fill out an application, give permission for us to populate that application with tax data, and, most importantly, the adjusted gross income, and complete the application,” said Koskinen.
Fewer than 8,000 fraudulent tax returns were filed using that data, though the IRS systems caught and stopped many more attempted fraudulent returns. According to Koskinen, the 100,000 was determined by measuring the number of suspicious and uncompleted applications, and could include legitimate students who simply failed to finish filling out their form.
“As we tracked that pattern down, we discovered that in fact it was clear that some of that activity was legitimate students, some of it was criminals,” said Koskinen, adding that all 100,000 taxpayers will be informed of the potential exposure and that 35,000 letters have already been sent out.
Koskinen said that there was very little criminal activity from September to December 2016. However, he told the Department of Education that as soon as there was a high volume of criminal activity, they would have to shut down the system that automatically provides tax information on applications. That volume occurred in January and February of 2017.
“So we shut the system down and spent the last three or four weeks working with [the Department of Education] to see whether there was any interim solution we could use before they finished their work in October to bring the system back up,” said Koskinen. “And it turned out there was no way we could satisfy ourselves that opening that avenue again would be free from risk, that criminals would get in, and our highest priority is to make sure we protect taxpayers and their identity.
“So what’s going on at this point, you can still file a student loan application, you just have to put in the tax information yourself.”
Koskinen said that the IRS has found more than 200 different ways that the agency provides tax data to other systems, such as mortgage and finance companies, and have spent the past two years looking for and solving risks in those areas.
