IRS Resumes Online Income-Validation Service That Hackers Penetrated

The Internal Revenue Service on Tuesday relaunched the online version of a service used by taxpayers seeking mortgages and others loans that it shut down more than a year ago after learning hackers were stealing information.

The online Get Transcript service, which was re-launched with new security features, was shut down in May 2015, after the IRS discovered cyber-criminals were using Social Security numbers and other information obtained from elsewhere to gain access to tax-return data. All told, thieves used Get Transcript to gain access to as many as 700,000 accounts and attempted to break into an additional 575,000 accounts between its launch in January 2014 and its shutdown.

Get Transcript provides taxpayers with summary tax-return information, which is often required by lenders in order to validate incomes for mortgages or student loans. People can also use the service to obtain their prior-year adjusted gross income (AGI), which they need in order to e-file their tax returns.

In testimony before the Senate Finance Committee, IRS Commissioner John Koskinen said taxpayers used Get Transcript to obtain 23 million copies of tax information during the 2015 filing season.

Such tax data is also valuable to thieves seeking to steal refunds, because it allows them to make false returns appear more legitimate and evade fraud filters. Although the hackers were able to obtain information from Get Transcript, they didn’t penetrate the IRS’s main database, an IRS spokesman said.

While the online service was down, taxpayers often had to wait a week or more for tax transcripts to arrive by mail.

The current version of Get Transcript uses “multi-factor authentication,” which requires the taxpayer to enter a one-time code sent to a mobile phone to enter an account. The service also has a feature that allows taxpayers to see the date and time their information was last released.

To use the new service, taxpayers must have an email address, a text-enabled mobile phone and specific financial account information, such as a credit-card number or certain loan numbers.

Because of a rash of scams by criminals pretending to be from the IRS, the agency also warned taxpayers that it will not initiate contact via text or email asking for log-in information or personal data. The texts and emails sent by Get Transcript will only contain one-time codes.

Taxpayers who registered under the prior online system will need to re-register and strengthen their passwords, the agency added.


. . . . . . . .

Print Friendly, PDF & Email

Leave a Reply