April 10, 2020

The U.S. federal government is now in the process of sending Economic Impact Payments by direct deposit to millions of Americans. Most who are eligible for payments can expect to have funds direct-deposited into the same bank accounts listed on previous years’ tax filings sometime next week. Today, the Internal Revenue Service (IRS) stood up a site to collect bank account information from the many Americans who don’t usually file a tax return. The question is, will those non-filers have a chance to claim their payments before fraudsters do?

The IRS says the Economic Impact Payment will be $1,200 for individual or head of household filers, and $2,400 for married filing jointly if they are not a dependent of another taxpayer and have a work eligible Social Security number with adjusted gross income up to:

  • $75,000 for individuals
  • $112,500 for head of household filers and
  • $150,000 for married couples filing joint returns

Taxpayers with higher incomes will receive more modest payments (reduced by $5 for each $100 above the $75,000/$112,500/$150,000 thresholds). Most people who who filed a tax return in 2018 and/or 2019 and provided their bank account information for a debit or credit should soon see an Economic Impact Payment direct-deposited into their bank accounts. Likewise, people drawing Social Security payments from the government will receive stimulus payments the same way.

But there are millions of U.S. residents — including low-income workers and certain veterans and individuals with disabilities — who aren’t required to file a tax return but who are still eligible to receive at least a $1,200 stimulus payment. And earlier today, the IRS unveiled a Web site where it is asking those non-filers to provide their bank account information for direct deposits.

However, the possibility that fraudsters may intercept payments to these individuals seems very real, given the relatively lax identification requirements of this non-filer portal and the high incidence of tax refund fraud in years past. Each year, scam artists file phony tax refund requests on millions of Americans, regardless of whether or not the impersonated taxpayer is actually due a refund. In most cases, the victim only finds out when he or she goes to file their taxes and has the return rejected because it has already been filed by scammers.

In this case, fraudsters would simply need to identify the personal information for a pool of Americans who don’t normally file tax returns, which may well include a large number of people who are disabled, poor or simply do not have easy access to a computer or the Internet. Armed with this information, the scammers need only provide the target’s name, address, date of birth and Social Security number, and then supply their own bank account information to claim at least $1,200 in electronic payments.

Page 1 of 2 in the IRS stimulus payment application page for non-filers.

Unfortunately, SSN and DOB data is not secret, nor is it hard to come by. As noted in countless stories here, there are multiple shops in the cybercrime underground that sell SSN and DOB data on tens of millions of Americans for a few dollars per record.

A review of the Web site set up to accept bank account information for the stimulus payments reveals few other mandatory identity checks to complete the filing process. It appears that all applicants need to provide a mobile phone number and verify they can receive text messages at that number, but beyond that the rest of the identity checks seem to be optional.

For example, Step 2 in the application process requests a number of data points under the “personal verification” heading,” and for verification purposes demands either the amount of the applicant’s Adjusted Gross Income (AGI) or last year’s “self-selected signature PIN.” The instructions say if you do not have or do not remember your PIN, skip this step and follow the instructions in step A above.

More importantly, it appears one doesn’t really need to supply one’s AGI in 2018. “If you didn’t file a return last year, enter 0,” the site explains.

Step 2 in the application for non-filers.

In the “electronic signature,” section at the end of the filing, applicants are asked to provide a cell phone number, to choose a PIN, and provide their date of birth. To check the filer’s identity, the site asks for a state-issued driver’s license ID number, and the ID’s issuance and expiration dates. However, the instructions say “if you don’t have a driver’s license or state issued ID, you can leave the following fields blank.

Alas, much may depend on how good the IRS is at spotting phony applications, and whether the IRS has access to and bothers to check state driver’s license records. But given the enormous pressure the agency is under to disburse these payments as rapidly as possible, it seems likely that at least some Americans will get scammed out of their stimulus payments.

The site built to collect payment data from non-filers is a slight variation on the “Free File Fillable Forms” product, which is a free tax filing service maintained by Intuit — a private company that also processes a huge percentage of tax returns each year through its paid TurboTax platform. According to a recent report from the Treasury Inspector General for Tax Administration, more than 14 million Americans paid for tax preparation services in 2019 when they could have filed them for free using the free-file site.

In any case, perhaps Intuit can help the IRS identify fraudulent applications sent through the non-filers site (such as by flagging users who attempt to file multiple applications from the same Internet address, browser or computer).

There is another potential fraud storm brewing with these stimulus payments. An app is set to be released sometime next week called “Get My Payment,” which is designed to be a tool for people who filed tax returns in 2018 and 2019 but who need to update their bank account information, or for those who did not provide direct deposit information in previous years’ returns.

It’s yet not clear how that app will handle verifying the identity of applicants, but KrebsOnSecurity will be taking a look at the Get My Payment app when it launches later this month (the IRS says it should be available in “mid-April”).


304 thoughts on “New IRS Site Could Make it Easy for Thieves to Intercept Some Stimulus Payments

  1. Dirt

    Well guess I’m not the only one. After many attempts at putting my stupid tax info in, 2019 & 18 and nothing matches what they have on file…I lost it. Smashed everything in sight, almost broke my window, a few holes in my door and contemplating suicide…. I’m getting more mad just talking about it!

    1. Tammie L Schwartz

      Me too!!!! Does it mean someone stole my money????

    2. Zigg

      When you commit suicide, can I have your Economic Stimulus Payment?

    3. rd

      Don;t despair.. I kn ow so many of us could us that 1200 bucks and more in the coming weeks… you would think they would have worked on a secure system and beta tested it for weeks before getting all excited about putting Orange Brain’s signature on it and the checks..!n Sheeesh! but you must admit.. this thing gets more hilarious and sad each and every day the Clown in Chief is directing this show of misfits and nitwits!

    4. Tna

      The same exact thing happened to me I even got a letter from social security saying that got my change of addresses ..IAM like I never sent one in.

  2. Susan

    OMG, I made a mistake by entering the wrong bank account number on the IRS website for the stimulus check, no my money is going to someone else. I definitely feel that they should have an option wherein we can make the changes and recheck our bank account details!!! I was so dependent on this money coming in, now i am screwed!!

  3. trudy boshers

    I got the form filled out online they said sending your code,it never goes through

  4. john wilcoxen

    Ive read a ton of info on all aspects of the stimulus deposits today. The best general solution for all of it is not to count your chickens when they are provided by the IRS. Time to get with what you can count on, whatever that might be. If the IRS is your only hope you could very well be left in bad spot. Their incompetence is evident in the volume of deposits made to wrong accounts despite having correct account info.

  5. Tex

    Thanks for this review. I was about to fill in the form but had reservations when I noticed the weak security aspects.

  6. Christopher

    Filed it all out then very last part where I agree and submit is its cut off from screen and can access it so can’t push submit.

    1. BrianKrebs Post author

      Try to decrease the font size on the browser page to see if that makes the submit button show up? Or zoom out (ctrl and -)

      1. Lin Janis

        I couldn’t get it to show SUBMUT either! Why allow such bad programming?? No changing the font does not help. It is the ONLY word that does not show up in the form!

        1. Nj bailey

          Try switching it to desktop view. That’s what I had to.do

      2. Celena Johnson

        Me too! I went through and put in all the information and got right at the end and it wouldn’t let me send it. Why? What’s going on with this site??

    2. Sarah

      The top corner where the three dots are and press desktop site and turn it sideways you’ll see the whole thing and be able to press it

    3. Whitney Callender

      Same thing for me I was assuming you have to use a desktop computer

    4. Linda LJanis

      Yes!! I tried and tried looking at this in landscape and portrait but the stupid SUBMIT button cannot be selected!!! How can such BAD PROGRAMMING be passed on as a final product?

      1. Jeana

        Go to Google menu top right and click box to go to desktop site

    5. Grace Ann

      You have to VERIFY your EMAIL address for the Submit button to highlight – once you verify your email it will bring you back to the form Make sure (single) or (file jointly) is still checked and then you will be able to submit

      1. Jennifer Shipek

        Nope did all that and it still won’t let me see the button to finish

    6. Ernie Thornhill

      Press the tab key on your keyboard to set focus on the next item on the web page, which is a button out of sight at the bottom of the web page. The web page will automatically scroll down and select the first button. Now you can see — and press — the “Submit” button.

      The programmer didn’t add the line of code for a vertical scroll bar on the web page, because his huge screen didn’t need scroll bars to view the whole page. Ours does.

    7. Jennifer Shipek

      Me too nothing is working. I made the font Small and looked for The make it a desktop thing and couldn’t find it. Did you figure out what to do?

    8. Lori

      Go up to right corner of phone and change to desktop site..it works so u can see page

  7. koko

    I have not filed 2019 taxes this year and pay every year therefore I want to update bank acct. info. Last year taxes were filed using our identity so now when I file this year I have a special pin. Will I be able to update bank acct. info.? I tried doing so on portal however received error that eligibility cannot be determined.

  8. Casslaine

    I filled out the registration form on Turbotax about 2 weeks ago. The very next day it said that it was accepted by the IRS. The email said that the IRS had to check my eligibility and if it was approved they would deposit the stimulus payment into the account that I provided. I was just wondering if anyone might know how long it usually takes for the IRS to check eligibility…
    Thank you for any information you might be able to give.

    1. Robert Slack

      I did the same exact thing on April 5th now I tried to do it through the it’s website and it says I already submitted it… however if I try and follow my check it days “they have no information one” in the IRS website……I’m literally so confused

  9. Gene

    I did not recieve my IP pin in the mail so it won’t let me file electronically, due to covid19 there isn’t a single IRS phone number that reaches a live person. Also it says that paper tax returns are not being accepted. I tried the get my pin tool but it won’t let me make an account due to some info mismatching, even though that’s not possible. I’ve had same info for 10+ years. Any idea what i can do to either retrieve my IP pin, get a new one or how to file electronically without one?? Any help will be greatly appreciated, I am at my wits end and out of ideas. Thank you!

    1. Kristina

      You and I are both in the same boat. My tax lady told me there is nothing she or I can do except wait until IRS opens back up so I can get an IP Pin. The IRS never mailed it to me. So because of their mistake, you and I suffer =(

    2. Tiara

      Same issue here, this is so frustrating and unorganized

  10. Kim Murphy

    I am so frustrated I want to scream. I went in and filled out the form online that you just had in the above comments and I got an email back first thing that was confirmed and I actually submitted the form twice. then I got another email saying that someone had used me as a dependent and there’s no way for me to fix it what do I do? Does that mean I’m playing to lose the $1,200 simply because it’s hard to go to the system to get that information incorrectly? Who do I call?

    1. Yoirnom

      I can tell you this I had nonproble updating my info and was told for three days I would be receiving my direct deposit very shortly and now this morning it says we getting a paper check ! Wtf thanks turbo tax for screwing me the fort time and thanks IRS for crewing me a second time. I’m Ina Facebook group called stimulus check 2020 and it’s happened to thousands of us. We all updated our direct deposit info and now bam we all of a sudden say thanks for waiting yori time we’re mailing you a check .

  11. Elice Nowak

    I already did this! How do I fix it so I won’t get ripped off?

  12. Coralee Reith

    After inputting bank info to receive stimulus check, I get error “Technical Difficulties”. The explamation is that the service is not available at this time. Tried repeatedly with same message.

  13. Samantha

    I submitted the non-filer form yesterday, because I’m 22 and I did not have to file in 2018, and it said I was accepted. However, I went to efile for 2019 because I had a larger income last year, and it said someone had already filed with my ssn. I do not know if someone committed fraud with my ssn, or possibly that I was not supposed to submit the non-filer form and that was a form of filing that is preventing my from actually filing my 2019 taxes. Since the system of the stimulus check is new, there are bound to be flaws, but I am not able to contact the IRS to get answers. If anyone had any advice, it would be greatly appreciated!

    1. Douglas Lee

      The non-filer form specifically says it is for eligible U.S. citizens or permanent residents who:

      . Had gross income that did not exceed $12,200 ($24,400 for married couples) for 2019
      . Were not otherwise required to file a federal income tax return for 2019, and didn’t plan to

      In other words, if you were planning to file a 2019 tax return, you should never have used it. I am not sure if you should file a regular tax return, an amended tax return or a superseding tax return but you must file on paper. I would suggest completing a regular tax return on paper and see if the IRS sends it back (once they reopen this summer).

      Good luck.

  14. Taylor Vanleeuwen

    I’ve found myself a victim of this EXACT problem. I went to go file my 2019 taxes yesterday and got rejected because someone already filed under my SS number. I’ve been attempting to fix it now for 2 days to no avail. So now I’m out of my Sim check AND my tax return.

  15. Jay Harris

    I just used the irs.gov site and non filers link i hope to god irs.gov is the real website and not one of the fake ones going around. i also hope that the link tool for non filers is safe and legit. i read the warnings its might not be but 100s have used it already so if not safe atleast i wont be the only one with stolen identity. but i sure hope everones id is safe using this tool i had no protection pine and its now thursday and still no 1200 so i had to take a chance and use this irs tooli hope i just get my money with no problems.

  16. Lin Janis

    Huge issue: On the IRS website in tiny print under FAQ it says if you Owed/Paid taxes last year, They are not using your direct deposit info! Only if you got a refund is the bank info automatically known It says this is to prevent fraud ( like who else would pay my tax bill)? THIS IS SO AWFUL – this info is not clear, it is not discussed, not publicized and is only in tiny print – not in the instructions ! We hear Only those who DID NOT FILE need to fill the form. Well I filed but they don’t have my bank info since I paid taxes via direct bank withdrawal.
    2 Nd issue: why does that form discuss only “filing your Taxes” does not mention entering information for the “stimulus “ till the last page. Makes one think they are actually filing taxes when they’re really not filing taxes.

  17. Ronny

    What’s the address to send this forms in if your not able to e file?

  18. Dominic lopez

    What is the phone number to call if someone haceked ypur bank account and stoll all your stimulus check

    1. Taylor Vanleeuwen

      As far as I’ve found there is non. I had the same thing happen, spoke to my accountant and they said I just have to wait until the IRS opens back up. Sorry it happened to you too.

    2. Jonaki Mehta

      Hey Dominic,
      I’m a producer at NPR and am looking to talk to people who might be victims of stimulus check / unemployment fraud during this time. If you or someone you know may have had your check intercepted, or perhaps your unemployment payment, please reach out to me at jmehta@npr.org.

      Thank you,
      Jonaki

  19. Pelin

    I made a mistake on the freefileableforms by accident i checked the box where it says someone filed you as a dependent how do i change this???!!!

  20. Linda oppelt

    Same thing. I thought ok I can do this, it said 4 easy questions. No way. At one point it said my account that I had just made was locked! I tried to finish on my iPad so I could see better but it’s still a mess. I’ll be seriously shocked if I get my money. I get SSI and I haven’t filed a tax since 2009. I’m disabled. Talk about stress.

  21. Joseph Norman

    Just as bad as unemployment if not worse at thjs point in time. Locked out for a full 24 hours! I have direct deposited my taxes every year never had a problem until now. This is beyond ridiculous this needs fixed immediately some people are dependent on that money and still don’t have their taxes back yet!!!! People are out risking their lives for you, the least you can do is make sure they get their damn money in the mean time!

  22. Juantize D Jackson

    I used the freefilefillable website for my partner it gets all the way to the end and it won’t let me do the captcha or e-file why is that?

  23. Juantize D Jackson

    I use that website to do my partner direct deposit it gets all the way til the end with no problem and then won’t let me do the captcha or e-file, what could be the problem?

  24. Bobby Bromley

    Hi, I filled out the non filers about a week ago. Then received an email saying the following”Congratulations, the IRS has accepted your Non-Filers: Enter Payment Info return” does that mean I’m approved for the check or under review?

  25. c. johnson

    i am trying to fill out a non filers form but it won’t let me complete the process. it says something is not filled out but i’ve done everything correctly. what is going on?

  26. Alice

    Is irs accepting paper returns through the mail? I had to mail it in since I didn’t have a Ip PIN number that required me to put in the individual stimulus return.

  27. Jennifer

    I filed 2019 tax with my husband, and we were separated recently.
    IRS has our joint bank account information, that’s what I thought
    My husband gave his individual bank account information to our CPA.
    Now he got $2400 in his bank account, and he won’t give a penny!!
    I try to change my bank account information, it is impossible to do it.
    My CPA tells me there is nothing she can do.
    I am a American citizen and paid triple the amount of tax then my EX husband
    To be. He has work permit!!

  28. Jennifer Ok

    I filed 2019 tax with my husband, and we were separated recently.
    IRS has our joint bank account information, that’s what I thought
    My husband gave his individual bank account information to our CPA.
    Now he got $2400 in his bank account, and he won’t give a penny!!
    I try to change my bank account information, it is impossible to do it.
    My CPA tells me there is nothing she can do.
    I am a American citizen and paid triple the amount of tax then my EX husband
    To be. He has work permit!!

Comments are closed.