10
Apr 20

New IRS Site Could Make it Easy for Thieves to Intercept Some Stimulus Payments

The U.S. federal government is now in the process of sending Economic Impact Payments by direct deposit to millions of Americans. Most who are eligible for payments can expect to have funds direct-deposited into the same bank accounts listed on previous years’ tax filings sometime next week. Today, the Internal Revenue Service (IRS) stood up a site to collect bank account information from the many Americans who don’t usually file a tax return. The question is, will those non-filers have a chance to claim their payments before fraudsters do?

The IRS says the Economic Impact Payment will be $1,200 for individual or head of household filers, and $2,400 for married filing jointly if they are not a dependent of another taxpayer and have a work eligible Social Security number with adjusted gross income up to:

  • $75,000 for individuals
  • $112,500 for head of household filers and
  • $150,000 for married couples filing joint returns

Taxpayers with higher incomes will receive more modest payments (reduced by $5 for each $100 above the $75,000/$112,500/$150,000 thresholds). Most people who who filed a tax return in 2018 and/or 2019 and provided their bank account information for a debit or credit should soon see an Economic Impact Payment direct-deposited into their bank accounts. Likewise, people drawing Social Security payments from the government will receive stimulus payments the same way.

But there are millions of U.S. residents — including low-income workers and certain veterans and individuals with disabilities — who aren’t required to file a tax return but who are still eligible to receive at least a $1,200 stimulus payment. And earlier today, the IRS unveiled a Web site where it is asking those non-filers to provide their bank account information for direct deposits.

However, the possibility that fraudsters may intercept payments to these individuals seems very real, given the relatively lax identification requirements of this non-filer portal and the high incidence of tax refund fraud in years past. Each year, scam artists file phony tax refund requests on millions of Americans, regardless of whether or not the impersonated taxpayer is actually due a refund. In most cases, the victim only finds out when he or she goes to file their taxes and has the return rejected because it has already been filed by scammers.

In this case, fraudsters would simply need to identify the personal information for a pool of Americans who don’t normally file tax returns, which may well include a large number of people who are disabled, poor or simply do not have easy access to a computer or the Internet. Armed with this information, the scammers need only provide the target’s name, address, date of birth and Social Security number, and then supply their own bank account information to claim at least $1,200 in electronic payments.

Page 1 of 2 in the IRS stimulus payment application page for non-filers.

Unfortunately, SSN and DOB data is not secret, nor is it hard to come by. As noted in countless stories here, there are multiple shops in the cybercrime underground that sell SSN and DOB data on tens of millions of Americans for a few dollars per record.

A review of the Web site set up to accept bank account information for the stimulus payments reveals few other mandatory identity checks to complete the filing process. It appears that all applicants need to provide a mobile phone number and verify they can receive text messages at that number, but beyond that the rest of the identity checks seem to be optional.

For example, Step 2 in the application process requests a number of data points under the “personal verification” heading,” and for verification purposes demands either the amount of the applicant’s Adjusted Gross Income (AGI) or last year’s “self-selected signature PIN.” The instructions say if you do not have or do not remember your PIN, skip this step and follow the instructions in step A above.

More importantly, it appears one doesn’t really need to supply one’s AGI in 2018. “If you didn’t file a return last year, enter 0,” the site explains.

Step 2 in the application for non-filers.

In the “electronic signature,” section at the end of the filing, applicants are asked to provide a cell phone number, to choose a PIN, and provide their date of birth. To check the filer’s identity, the site asks for a state-issued driver’s license ID number, and the ID’s issuance and expiration dates. However, the instructions say “if you don’t have a driver’s license or state issued ID, you can leave the following fields blank.

Alas, much may depend on how good the IRS is at spotting phony applications, and whether the IRS has access to and bothers to check state driver’s license records. But given the enormous pressure the agency is under to disburse these payments as rapidly as possible, it seems likely that at least some Americans will get scammed out of their stimulus payments.

The site built to collect payment data from non-filers is a slight variation on the “Free File Fillable Forms” product, which is a free tax filing service maintained by Intuit — a private company that also processes a huge percentage of tax returns each year through its paid TurboTax platform. According to a recent report from the Treasury Inspector General for Tax Administration, more than 14 million Americans paid for tax preparation services in 2019 when they could have filed them for free using the free-file site.

In any case, perhaps Intuit can help the IRS identify fraudulent applications sent through the non-filers site (such as by flagging users who attempt to file multiple applications from the same Internet address, browser or computer).

There is another potential fraud storm brewing with these stimulus payments. An app is set to be released sometime next week called “Get My Payment,” which is designed to be a tool for people who filed tax returns in 2018 and 2019 but who need to update their bank account information, or for those who did not provide direct deposit information in previous years’ returns.

It’s yet not clear how that app will handle verifying the identity of applicants, but KrebsOnSecurity will be taking a look at the Get My Payment app when it launches later this month (the IRS says it should be available in “mid-April”).

Tags: , , , ,

304 comments

  1. I went on the “Get My Payment” website and see that I need to put in my SSN. Putting my SSN on any public site always makes me nervous. I don’t even put it on the forms in the doctor’s office. How secure is this site? Can I be sure that my SSN won’t fall into the wrong hands?

    • First this is not a public site it is a government site. Second you can make sure the web address is “irs.gov” and not “.com” be sure there is a lock in the address bar. If both those things are true then you should have a secure connection to the website. Also make sure you are not on any public wifi. These are always best practices when sending sensitive information over the internet.

  2. I filled out the non filers form on 4/12 to Submit my banking info as I’ve never gotten a refund due to being self employed. I just received my stimulus payment today through direct deposit. I too was scared at first that it may be a scam but apparently it’s not. Hopefully this reassures some of you.

  3. If I had received a letter from the Iris stating I had to verify my identity but it won’t let me do it online and the phone lines are down for my 2019 return does that mean they will not process my stimulus check until I verify my identity and is there another number you can call?

  4. I haven’t made any progress but I’ll keep trying. I’ll definitely update everyone if I find anything out. Wish I had something for ya. Good luck !

  5. I filled out a non filers return. I get rejected with error IND .181-01 I put in my PIN from 2018 as is on my return. I did not need to file for 2019 so I filled out the form and put in a pin for 2019. They were 5 digit pin numbers and I got no errors from that. I cannot get another PIN as they want a bank account, cell phone number, loan numbers,etc. None of which I have. Why will it not accept my pin numbers. Can I contact the IRS some way to straighten this out?

  6. I filled out a non filers return last Wednesday night. It got accepted the same day, but I’m still get this message The IRS will process this information and determine your eligibility for the Economic Impact Payment. Can someone explain why I dont have an idea of when I’m going to get my stimulus?

  7. Why isn’t the IRS site taking my social security nbr it gives me errors??

    • Frances CROOKS

      When am i getting my stimulus chevk i have direct deposit its still not there they said i didn’t have to fill out nothing

    • I have not got my stimulus check i get SSI they said i did not have to do nothing i got Direct Deposit

      • Lisa Saucier

        People who receive SSI will not get it until some time after May 5th. There is a May 5th deadline for SSI people to add their dependents (if they have any) to get the extra $500 per dependent. So with that info it’s most likely be some time after May 5th.

    • Francine Arnold

      You need to use dashes in the SS#. HOPE THAT WORKS.

  8. Mine suppose to deposit april 29 in my account bit no deposit

  9. Ladonnica Collins

    I filled out there non file get my payment I’m on disability so I don’t normally have to file I read so much stuff but I went BK and looked at my information I out one number wrong on my SS number I deleted that form and started over I haven’t got a email to verify my stuff like it says after forms 2 should I delete it all and start with a new email and stufc

  10. My boyfriend is on SSDI , he didn’t have to do anything a date just popped in the get my payment app. An it said he would get a DD on the 29th. Well it never came. I called the Fiscal Treasury Offset department, and his stimulus check is going to his x wife for back child support. Even though they take it out of his monthly disability check every month , they consider it delinquent. Now mind you , shes remarried , very well off and both his kids have their own families. So maybe an offset ??

  11. I WENT ON,,, “GET MY PAYMENT “,,,
    I AND MY HUSBAND ARE ON SSDI,,AND IT SAYS HES GETTING A STIMULUS OF 1,200 AND THATS CORRECT FOR HIM BUT,,THE GET MY PAYMENT SAYS ,,,IM INELIGIBLE,,HOW CAN THIS BE???? ,,WE ARE MARRIED,,WE FALL BELOW INCOME REQUIREMENTS,,,
    BUT WE ARE SUPPOSE TO GET 2,400 00..***HELP VERY DESPERATE,,,WE ARE EAGERLY WAITING FOR REST OF OUR STIMULUS PAYMENT..LONA AND PERRY PIERCE,,BRAINERD,,MN..WE ARE DIRECT DEPOSIT,,MID MN BANK

  12. TO THE COMMENT BEFORE THIS,,, ON THE 29TH OF APRIL ,,WE ONLY RECEIVED 1,200 FOR MY HUSBAND SHOULD HAVE BEEN FOR THE BOTH OF US 2,400.00,,WE ARE ON SSDI,,,

    • My fiance for his automatic payment with his check. Call as and let them know! I don’t answer just keep trying you’re entitled to it

      • JACKIE,,I WOULD REALLY APPRECIATE YOUR HELP,,I SEEN YOU ANSWERED SOMEBODY ELSES QUESTION,,
        ***I AM THE LADY THAT ,HAS THE POST DATED MAY 2,,2020
        MY HUSBAND RECIEVED 1,200.00,,WE ARE ON SSDI AND WAY UNDER THE LIMIT FOR THIS,,BUT NOTHING FOR ME,,I AM VERY DESPERATE***I DONT KNOW IF YOUR FROM THE IRS OR INDEED IF YOU HAVE SOME PULL ,,IN THIS AREA BUT IM LOOKING FOR SOMEONE TO CORRECT THIS PROBLEM.
        **NOW THE FIRST TIME I WENT ON THE GET MY PAYMENT ON IRS.GOV,,THE PAYMENT PORTAL IT SAYS FOR ME ,,**NOT ELLIGIBLE,,HOW CAN THIS BE IF MY HUSBAND IS????AND NOW IT CHANGED SAYING,,,” THEY DONT HAVE ENOUGH INFORMATION”,,OR IM NOT ELIGIBLE( STILL)…????**NO BODY ANSWERS IRS,,PHONE…***JUST TELLING ANY IRS AGENTS OUT THERE WE DO APPRECIATE ANY KIND OF HELP YOU CAN GIVE US.. WE HAVE DIRECT DEPOSIT THROUGH SS***

        • I also am on ssdi. The get my payment has never worked for me. Still waiting on my payment. Hopefully it will arrive by this Wednesday the 13th of may. But if it does not i am giving up hope. I was expecting on the 29th of April when many people I know on ssdi got theirs. Some did many didnt.

          Also it says the don’t have enough info yet or you may not be eligible on mine. I know I am iligible so I suspect they has not got to mine and likely yours or they made a mistake at irs. I hope they don’t have an employee sending them to their own account. Never know nowadays.

  13. Someone done tax fraud in my name last year and even though I reported it and still got my tax money which I had to get it in a check and I thought I was getting my stimulus payment in a check whatever bank account the fraudsters used to file my taxes in my stimulus check is going into there account it is to late for me to change my account info and there is nothing that I can do about it ppl are really getting over on this stimulus money

  14. I filed 2019 taxes get well below 75000$ collect SS went on get my payment 04/15 and put in DD deposit info for me and my granddaughter finally got a DD date of 04/30 granddaughter got hers mine no show called bank no deposit ever made or pending now when I go on get my payment it says info doesn’t match it’s same info I submitted when it gave me DD date now I am locked out for 24 hrs for inputting the correct info 3xs

    • Yes they do that . Even if you put the correct info in do to the high volume of taxpayers inquiring. I have to wait until someone can actually talk to me which can be months refeirng to a pin number as someone from filed a fraudulent refund 6 years ago. The IRS makes it almost impossible for anything in question to be solved at this time. Just keep trying it’s all you can do good luck stay safe God bless

  15. I used the non filers to give the bank information for myself with my email…. My sister also used my email. Is that going to be a problem?

  16. My site image and phrase is wrong on the irs.gov website and I cant find anything online about what to do

  17. I recently applied for the stimulus payment on debt free e-file for non-taxpayer for 2018 or 19.I put in my information but since my taxes were frauded back in 2014 they gave me a PIN number which I had never used in the next following year now they won’t give me the stimulus because are you have the wrong PIN number or because I need to apply for a new PIN number what you can’t do because everything’s closed any suggestions I could use a help. Thanks for helping I needed a single person senior citizen that could use the stimulus to buy clothes and food.

  18. IS THERE ANY IRS AGENTS OUT THERE THAT CAN TAKE CARE OF MY REQUEST,,AND SOME OTHERS PLEASE…
    I HAVE PREVIOUS POSTS …GOD BLESS YOU,,,
    ….THE IRS AGENTS ,,WHO ARE WILLING TO HELP
    ,,,***VERY MUCH NEEDING HELP…
    **PLEASE REFER TO MY DETAILED POSTS***BEFORE THIS…
    CAN YOU PLEASE GET BACK IN REPLY….SOON…
    SINCERELY,,,LONA AND PERRY PIERCE

  19. I AM NOT RECIEVING EMAIL TO VERIFY MY EMAIL FOR THE STIMULUS

  20. I recommend Michelle Singletary’s columns in the Washington Post about the stimulus money problems. Her column is syndicated so you can find it elsewhere, too.

  21. Marcia Brown

    I filed our 2018 tax return a 2 months ago. My husband who is a social security receippent received his in his bank account. I am not on social security, what do I need to do in order to receive mine? Can you advice!

  22. Stephanie Bennett

    First, I have been a Social Security Disability recipient since 2007. I am not required to file an annual tax return because my income is too low. The IRS stated that they will issue automatic stimulas payments to all Social Security recipients using the information on their SSA-1099 tax form that the Social Security Administration mails out every year in January that shows the total amount of benefits received the previous year. I receive my SSD by direct deposit, We were also told that those receiving Social Security, Survivors and Disability payments no later than April 29, 2020. I still have not received my stimulas payment. And everyday, I go to the IRS website to use the check my payment tool, and I continue to receive Payment Status Not Available Yet and that they are unable to provide the status of my payment right now bc we don’t have enough information yet (we’re working on this) or you’re not eligible for payment. I know I am definitely eligible. Anyway, because I have received this same message for over 2 weeks straight, I decided to use the non filers site to enter my information.

  23. Stephanie Bennett

    This is a continued comment from May 7th at 10:42 am
    My previous comment was sent before I was finished.
    Even though, I am an SSDI recipient and I receive my benefits every month through Direct Deposit, and we were told that we didn’t have to do anything to get our stimulas check, I still have not received mine so I decided to use the non filers link although it said, Social Security recipients were not supposed to use it but after receiving the same Payment Status Not Available Yet for 2 weeks straight, I decided to input my info anyway. Now, I ran into another problem. I received an automated email that my application was rejected bc of an Identity Theft issue that I had a few years ago. I was still on SSDI but filed a tax return to get the education credit that I was entitled to bc I was a college student at the time. Now, they are asking for that identity pin that I never received bc I haven’t filed any taxes in a few years plus I moved from the address that the IRS has on file for me. So now, I have no idea how to correct this. I am on SSDI and I don’t have that identity pin. Can anyone please help?

    • I am having the same issue without the identity things my non filers was accepted.. ssdi here. No stimulus yet. But I more 8 years ago have not done taxes since before then. I think irs and ssa addresses are not matching and we are being set aside.

      We should get something by Wednesday the 13th ,but we’re supposed to get it by the 29th so it does not arrive I am losing hope it will ever arrive.

  24. Norma yutangco

    Where is my stimulus money suppose to be deposited to my direct deposit my SS goes to my bank.

  25. Jenny Reginek

    Hello, i am beyond stressed and worried. Im a single mom and i have no help at all. Someone stole my identity in 2015 and later that year I did finally get my refund and the following year they sent me a letter with a pin number to use to verify it was me and they also sent me one in 2017 that I still have and I did not file 2018 or 2019 taxes because I have been off work due to health reasons and I was really thankful for the stimulus money but I have tried everything to get a new pin number sent to me in the IRS website keeps locking me out even though I am putting in my account information such as my student loan account my car loan account credit cards and I even pulled my credit report from Experian I noticed that on the credit report there are extra numbers Added to my accounts so if anybody could please help me and tell me how I am supposed to put the account numbers in correctly? I was also wondering if I could print the non-filer’s application that was rejected because of the missing IP pin number and I mail it in or fax it in along with a copy of my drivers license and Social Security card and other accounts with my name on it including my direct deposit information. Does anybody know if I can do that or am I just out of luck and I don’t get any stimulus money? Also this second round of stimulus money they are talking about I would not receive as well? I have been reading up on this nonstop trying to figure out how to get this pin number and a lot of people are having the same problem and I don’t understand why they are not issuing some sort of instructions or a phone number where I could ask somebody question because I thought that the stimulus was sent out to help the people not drive us insane. I do not get social security yet so i am really counting on this money and i cannot work as many hours as i used too but now i cannot work at all and have a young child to feed. Im scared, this is so ridicules. Cam Somebody please email me back with an answer before I go absolutely insane. Thank you so much