Today we're talking about identity theft. I know, not exactly the most exciting topic. But it is definitely an important one.
Since I needed something to get everybody's blood flowing this early in the morning, I thought I'd start with a familiar figure: Donald Trump.
Now, don't let him fool you; he is actually a victim: a victim of one of the largest unauthorized disclosures of confidential tax information in IRS history.
In 2023, an IRS contractor named Charles Littlejohn obtained and disclosed confidential tax information involving Donald Trump and thousands of other wealthy taxpayers. Here's the part that's relevant to all Massachusetts taxpayers.
Tax information is extraordinarily sensitive. Think about what's on a tax return: Social Security numbers, addresses, income, employers, investments, and sometimes information about our spouses and our children. Once that information leaves our control, we don't get to decide what happens to it next.
This wasn't just somebody getting a little bit of information. We're talking about actual confidential tax-return information. Trump's tax information eventually became publicly available, along with information involving thousands of other taxpayers. Then the scale kept growing. In April, 2024, the IRS initially notified more than 70,000 identified victims. By December, 2024, hundreds of thousands of additional individuals and entities were notified.
So think about this for a second. If Donald Trump couldn't keep his tax information private, with considerably more resources than anybody in this room, what chance do the rest of us have?
What happens when our tax information falls into the wrong hands?
I'm going to show you two relatively recent examples. One involves tax preparers right here in Massachusetts and the other involves third-party tax software.
Let's start with the people we voluntarily give probably more personal information to than almost anyone else: our tax preparers and CPAs. Think about what we give them: Our Social Security number. Our spouse's Social Security number. Our children's information. Our address. Our employer. Our income. Our bank information. Sometimes even a copy of our driver's license. There are very few professionals in our lives who know this much about us.
Here's a Massachusetts example:
Prosecutors allege that client information was used to prepare 145 fraudulent Massachusetts tax returns, and more than $222,000 in refund checks were diverted instead of going to the clients. Some of that money allegedly went toward real estate. Although, being Massachusetts, I'm not sure how much real estate $222,000 gets us anymore.
But think about how this allegedly happened. These clients didn't hand their Social Security numbers to some stranger on the street. They handed their information to someone they trusted to prepare their taxes. Sometimes our information gets compromised even when we've done everything right.
And it's not just the people we trust. We also give all of this information to software.
And that brings us to our second example:
Now, this one is an ongoing case, so here's my lawyer disclaimer: All defendants are presumed innocent unless and until proven guilty.
There's currently litigation involving H&R Block's online tax software. Plaintiffs allege that tracking technology transmitted certain taxpayer information to Meta and Google without users' consent: including names, income information, tax-credit information, and dependent information. Again, this case is ongoing. H&R Block disputes the claims, and there has been no final determination that H&R Block unlawfully disclosed taxpayer information.
So now we've seen three different places where our tax information can potentially get out:
The government
The tax professionals we trust
3. The software we use
But here's the important part: Just because our information gets out doesn't necessarily mean our identity has been stolen.
Data Breach does not mean Identity Theft
A data breach means “they got our information.” Identity theft means “they used our information,” and Tax Identity Theft means, “they used our information with the IRS or a state tax agency.”
So let's keep this really simple. A data breach means, “They got our information.” Identity theft means, “They used our information,” and tax identity theft means, “They used our information with the IRS or a state tax agency.”
And that last one is what makes tax professionals special.
So let's say we receive one of those lovely emails: “We take your privacy very seriously. Unfortunately…” and we all know nothing good comes after “unfortunately.” So what do we actually do? Do what is listed below:
FREEZE YOUR CREDIT: Contact Equifax, Experian & TransUnion
Stops new credit accounts from being opened in your name
SECURE YOUR ACCOUNTS: Change compromised passwords
Use unique passwords
Turn on multi-factor authentication
PROTECT YOUR TAX IDENTITY: Create/check your IRS Online Account
Consider obtaining an IRS Identity Protection PIN (IP PIN)
Review your IRS records for activity you don't recognize
WATCH FOR IDENTITY THEFT: Monitor bank and credit card accounts
Review credit reports
Be suspicious of unexpected IRS/state tax notices
IF SOMEONE USED YOUR IDENTITY: Report identity theft at IdentityTheft.gov
Contact affected financial institutions
If tax-related, follow IRS identity-theft procedures
Don't ignore an IRS or state tax notice
Now you might be thinking: “Tim, none of those things have anything to do with what you do.” Exactly. If our information was merely exposed, we probably don't need a tax attorney. But here's where things change:
When the identity theft becomes an IRS problem.
Let me give you some examples of what I actually see in my work:
We try to electronically file a tax return, and it gets rejected because somebody already filed one using our Social Security number.
We receive a tax refund even though we never filed a return.
We receive an audit notice involving a credit we never claimed or weren't entitled to.
We filed a legitimate return, but the refund we're actually entitled to never shows up.
Sometimes the IRS simply sends us a letter saying, “We suspect identity fraud.”
These are the kinds of identity-theft problems I actually see, and at that point, changing our password doesn't fix the problem. Freezing our credit doesn't fix the problem. Because now the IRS's records themselves may be wrong, and that's a very different issue.
This is where my work comes in. Not every data breach requires a lawyer. Not every identity-theft case requires a tax lawyer. But think about calling me when the IRS record is wrong, an audit or examination has started, tax has been assessed or collection has begun, or we've already reported the identity theft and the IRS problem simply isn't getting fixed. Because at that point, we're no longer just protecting someone's identity, we're fixing their tax account.
If the IRS says you did something you didn't do, let's talk.
If the identity theft creates an IRS or state tax problem, that’s when you call me.
