Direct Cash Payments For COVID-19 Relief Are Susceptible To Fraud
RACHEL MARTIN, HOST:
Here in the U.S., the government is working to get people their payments from the coronavirus relief package. Single Americans who earn less than $75,000 a year qualify for a one-time payout of $1,200. But because of the way the payment system is set up, millions of the nation's poorest are susceptible to fraud. Here's NPR's Tim Mak.
TIM MAK, BYLINE: If you make less than $12,200 per year, you do not have to file a tax return with the IRS, but you still qualify for $1,200 in cash. The IRS typically uses information from prior returns to verify identities, says Janet Holtzblatt of the Urban-Brookings Tax Policy Center.
JANET HOLTZBLATT: That kind of information often serves as a backstop as a way of sort of identifying people.
MAK: But for people without returns, the IRS relies on much simpler information. Brian Krebs, editor of krebsonsecurity.com, was among the first to notice that fraudsters could steal these coronavirus payments with only a few pieces of identifying information.
BRIAN KREBS: I was a little shocked to see that there were a number of things that they requested but very few things that were required. And the only thing that I could tell that were required were name, date of birth, Social Security number, address, and then you had to have a phone number. And that was pretty scary to me.
MAK: A longtime reporter on computer security, Krebs says that this information is readily available for fraudsters.
KREBS: It's information people think is confidential, is secret, is available for sale on a significant portion of the U.S. population in a number of places in the underground. And in many cases, we're not even talking about the dark web. We're talking about just out on the Internet. And it's a couple bucks. It's about what it costs for a, you know, caramel macchiato at Starbucks.
MAK: Both Holtzblatt and former IRS Commissioner Mark Everson estimate that millions of Americans fall into this category - millions of America's most vulnerable. Here's Holtzblatt again.
HOLTZBLATT: Vulnerable in the sense that for a variety of reasons their income is very low.
MAK: It is too soon to know for sure whether this kind of fraud is under way, and at what scale. But Mike Chapple, a professor of information technology at Notre Dame, says it's a good bet that this kind of fraud is already happening. He points to an incident in 2015 with an IRS system where people could obtain their previous tax return transcripts online. That system was more secure because it asked for more information in order to verify identity.
MIKE CHAPPLE: There were 390,000 cases that the IRS inspector general found of fraudulent access to that system. So now fast-forward five years and we're using an even weaker system to control access, not just to information but to payments.
MAK: The IRS didn't address this specific vulnerability but told NPR that it is actively working on combating scam artists, prioritizing investigations into those who prey on vulnerable taxpayers. IRS Criminal Investigation Chief Don Fort said in a statement that they are tracking the dark web, following message boards and anticipating the schemes of criminals. Mark Everson was the IRS commissioner between 2003 and 2007. He says that the IRS is doing the best that it can under trying circumstances.
MARK EVERSON: There's always a tradeoff between speed and security.
MAK: A priority for the federal government is trying to get these direct payments out the door as quickly as possible, which is going to lead to some vulnerabilities, he said.
EVERSON: They're limited in terms of their technical strength, which has been devoted to getting the payments out. And they have so many different things they're doing right now, amidst what is still a filing season.
MAK: Everson, now with Alliantgroup, which provides specialty tax services, advises those who are seeking coronavirus direct payments and are not familiar with computers to find help from someone they trust. Tim Mak, NPR News, Washington.
NPR transcripts are created on a rush deadline by Verb8tm, Inc., an NPR contractor, and produced using a proprietary transcription process developed with NPR. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.