IRS News- Security Summit Update - November 3rd

Below are the following items:

IRS News Release 2016-144, IRS, Security Summit Partners Expand Identity Theft Safeguards for 2017 Filing Season, Build on 2016 Successes.

Federation of Tax Administration News Release

Statement of Bill Cobb, H&R Block President & CEO

Intuit Announces Expanded Security Measures for Taxpayers and Tax Professionals

IRS, Security Summit Partners Expand Identity Theft Safeguards for 2017 Filing Season, Build on 2016 Successes

IR-2016-144, Nov. 3, 2016

WASHINGTON – The Internal Revenue Service, state tax agencies and industry partners today finalized plans for 2017 to improve identity theft protections for individual and business taxpayers after making significant inroads this year against fraudulent returns.

Public and private sector leaders announced today that their collective efforts through the Security Summit initiative have led to a marked improvement in the battle against identity theft during 2016. This is highlighted by the number of new people reporting stolen identities on federal tax returns falling by more than 50 percent, with nearly 275,000 fewer victims compared to a year ago.

At a Washington press conference, Summit leaders also detailed new and expanded safeguards for taxpayers in the upcoming 2017 tax season. The 2017 focus revolves around “trusted customer” features that will help ensure the authenticity of the taxpayer and the tax return - before, during and after a tax return is filed. The additional protections will build on the 2016 successes that prevented fraudulent returns and protected tax refunds.

“We’ve made remarkable progress this year in our efforts to protect taxpayers following the unprecedented coordination with the states, the tax industry and the financial sector,” said IRS Commissioner John Koskinen. “Working together, this coalition has expanded its activities in many different areas, and we are focused on strengthening our systems and processes even more for the upcoming tax season.”

“It is gratifying to see how many different ways we have already identified and begun to implement changes,” said Dawn Cash, Commissioner, Oklahoma Tax Commission and President, Board of Trustees of the Federation of Tax Administrators. “Taxpayers in states across the country are benefiting from this important work.”

Summit Helps Produce Successes in 2016 Against Identity Theft; Victims Down by Half

Security Summit initiatives put in place in 2016 had a dramatic impact on the collective ability to identify and stop fraudulent returns. Key IRS statistics show decreases because Summit efforts were successful at preventing fraudulent returns from entering tax processing systems. This meant fewer bad returns, fewer bad refunds and fewer taxpayers becoming victims.

Among the examples seen by the IRS:

• Identity theft affidavits fell sharply. The number of people who filed affidavits with the IRS saying they were victims of identity theft dropped 50 percent during the first nine months of this year compared to 2015. The number of new affidavits filed fell to 237,750 compared to 512,278 for the first nine months of 2015.

• More fraudulent returns stopped before processing. IRS statistics show a nearly 50 percent drop in the number of fraudulent returns that made it into the IRS tax processing systems– another sign the Summit efforts are working up front in the tax process. Through September of this year, the IRS stopped 787,000 confirmed identity theft returns, totaling more than $4 billion. For the same nine-month period in 2015, the IRS stopped 1.2 million confirmed identity theft returns, totaling about $7.2 billion.

• Fraudulent refunds fell. The number of bank partners grew to 620 institutions from 514 institutions in 2015, enabling internal processes to continue improving. The number of suspect refunds stopped by banks and returned to the IRS dropped by more than 50 percent, to 108,539 in 2016 compared to 243,361 in 2015, demonstrating our improved ability to stop fraudulent returns before refunds are paid. The dollar amount of suspect refunds dropped to $239 million from $829 million in 2015.

• Shared information stopped more bad returns. Industry and state partners provided information that helped improve IRS fraud filters and stop additional bad tax returns, including 57,000 that would have bypassed IRS processing filters without Summit assistance.

• Shared data elements helped identify new areas. Several new data elements shared on tax returns from Summit partners helped the IRS stop over 74,000 suspicious returns, representing over $372 million in refunds that were prevented from being paid.

“We've come a long way in a short time following the creation of the Security Summit,” Koskinen said. “But much more work remains to be done, and the partnership has agreed to take even more steps to protect taxpayers in 2017.”

More Steps Planned for 2017 Tax Season

For the 2017 filing season, the IRS and Summit partners will take additional actions. As with 2016, many of the new features will not be visible to taxpayers but will provide the IRS and states with the information they need to identify and stop fraudulent identity theft returns.

Among the new or expanded features for 2017 that will protect taxpayers and the tax system:

• New data elements transmitted by the tax industry with every tax return have been updated and expanded. In all, 37 new data elements will be added for 2017, providing additional information to strengthen the authentication that a tax return is being filed by the real taxpayer.

• The tax industry will share with the IRS and states 32 data elements from business tax returns – extending more identity theft protections to business filers as well as individuals.

• More than 20 states are working with the financial services industry to create their own version of a program that allows the industry to flag suspicious refunds before they are deposited into taxpayer accounts. Also, private sector partners are enhancing efforts to identify the “ultimate bank account” to ensure that the refunds go into the true taxpayers’ accounts – not fraudsters.

• The Form W-2 Verification Code initiative started by the IRS last year will expand to 50 million forms in 2017 from 2 million in 2016. When completing a tax return, the 16-digit verification code should be entered when prompted by tax software used by both individuals and tax professionals to validate the information on the Form W-2. The IRS anticipates the verification code will be expanded in future years for all Forms W-2.

• The software industry will continue to enhance software password requirements for individuals and tax professional users – providing additional safety prior to filing.

Taken together, these “trusted customer” features will help the IRS and states do an even better job of detecting fraudulent returns and protecting taxpayers.

As part of that effort, the Summit partners will launch a new Identity Theft Tax Refund Fraud Information Sharing and Analysis Center, or ISAC. This project, in its initial stages for 2017, will serve as an improved early warning system – identifying emerging identity theft schemes and quickly sharing that information among Summit partners so that all of the participants can enact safeguards.

Summit partners believe an ISAC ultimately promises significant gains in detecting and preventing identity theft refund fraud and will provide better data to law enforcement to investigate and prosecute identity thieves. This effort will provide all Summit partners with a threat assessment capability, early warnings about problems and insights about identity theft fraud schemes through nimble and agile information sharing.

Education Campaign Continues for Taxpayers, Tax Professionals

The Security Summit will continue its campaigns to increase awareness about data security to both taxpayers and tax preparers. Last year, the Summit partners launched the “Taxes.Security. Together.” campaign to encourage taxpayers to take greater data security precautions and to learn how to recognize and avoid phishing emails that seek to trick people into providing sensitive data such as Social Security or credit card numbers.

This year, the Summit partners expanded the campaign to include tax professionals, who increasingly are being targeted by criminal syndicates. Summit partners initiated a new campaign called “Protect Your Clients; Protect Yourself” and urge tax professionals to use the best security practices available. Tax professionals should review Publication 4557, Safeguarding Taxpayer Data, to see an action check-list for ensuring data security.

As tax season approaches, the IRS and Summit partners will share more tips for tax professionals in upcoming weeks. And for taxpayers, the “Taxes.Security.Together” campaign will resume for a second year in the weeks leading up to the opening of the 2017 filing season in January with important information that taxpayers can use to protect their sensitive taxpayer and financial data.

―30―

FEDERATION OF TAX ADMINISTRATORS

WASHINGTON, D.C. (Nov. 3, 2016). Dawn Cash, president of the FTA Board of Trustees and Commissioner with the Oklahoma Tax Commission, today thanked all of the private and public sector individuals who have given their time and expertise to collectively work to protect the American tax system from refund and identity thieves.

“The bulk of the work will probably never be recognized,” said Commissioner Cash, “because security measures are little good if they serve as a roadmap to further criminal behavior. A few ideas or changes are visible, such as last year’s decision to begin asking for driver’s license numbers on income tax returns. But most of the Security Summit accomplishments take place behind the scenes. And that’s too bad. I wish the taxpayers could appreciate the width and depth of this work, and recognize the groundbreaking level of private-public partnership that drives us forward.

“We have pledged ourselves to bring 52 governments, dozens of competitive vendors, and a number of associations and coalitions together in as many different ways as possible to strengthen the foundation of the income tax filing system. It is gratifying to see how many different ways we have already identified and begun to implement changes.

“We know there is more work ahead of us. We know that even the Summit cannot address every structural threat to the income tax filing system. That is why you see states taking steps such as changing their laws to require employers to file employee W-2 reports with the states by Jan. 30. This is why there is a new federal law that will schedule certain high-risk federal refunds to be paid no sooner than mid-Feburary.

“But whether work is done within the Summit or, as needed, outside the Summit, we are determined to collectively identify our opportunities and to make sure identity theft and refund fraud is no longer a profitable enterprise for criminals.”

FTA is an association of the principal revenue agencies in the 50 states, Washington, D.C., New York City and Philadelphia.

###

Statement of Bill Cobb, H&R Block President & CEO, November 3, 2016

Since this public-private partnership formed some 20 months ago, we have progressed from initial ideas on how to combat tax refund fraud, to developing clear operating concepts, and now, to executing concrete measures that are materially impacting the fraudster’s actions.

Through it all, Commissioner Koskinen has led the way with thoughtful and focused leadership.  Combined with the flexibility and close collaboration of state officials and members of the industry, the working group has accomplished much on behalf of American taxpayers.  I especially want to compliment the Federation of Tax Administrators and the state leaders for developing and implementing a standardized agreement for e-filing certification.  This standardization is essential to our overall efforts and has streamlined our preparations for tax season this year.  Without it, the fraudsters will continue to attack the weakest parts of the system.   

Another success story is the establishment of the Information Sharing and Analysis Center.  While we will likely not have all state signatories to the ISAC finalized by the start of tax season 2017, the capability will largely be in place.  Our momentum is irreversible and the ISAC will do much to synthesize and share information among all the players.

That said, we cannot rest.  We must remain unrelenting in our actions against the ever-evolving attempts to steal refunds.  To that end, the working group’s information campaign this year to educate tax preparers on the threat is another step in the right direction.  The real focus of this campaign is the community of small and independent preparers.  They do not have the systemic protections in place of the large, nationally-branded preparers, so this campaign is clearly needed for the more vulnerable members of the tax preparation category.

Finally, H&R Block looks forward to working with the Electronic Tax Administration Advisory Committee as it assumes an advisory role to the working group going forward.  The fact that the security summit efforts will be able to continue with the permanency of ETAAC speaks to the maturity of the working group and to the commitment of all members to building an enduring capability.

In closing, the H&R Block team looks forward to continuing the substantive progress of  the working group as, together, we strive to better protect taxpayers in 2017 and beyond.  Thank you.

###

Intuit Announces Expanded Security Measures for Taxpayers and Tax Professionals

Commends government, industry progress to combat tax fraud

MOUNTAIN VIEW, Calif., Nov. 3, 2016 – As part of today’s meeting of the IRS Security Summit, Intuit Inc. (Nasdaq: INTU) announced additional security measures for its consumer and professional tax software products. These measures build on safeguards enacted in prior years and reflect the company’s continued role in supporting industry and government’s collaborative efforts to fight fraud and help protect taxpayer information.

As a result of actions taken following last year’s inaugural Security Summit, the IRS has reported that fewer people became victims of tax-related identity theft this past tax season. Government and industry protected more taxpayers from tax-related identity theft, stopped more suspicious tax returns and prevented more fraudulent refunds from getting into criminals’ hands. In fact, from January through April 2016, the IRS stopped $1.1 billion in fraudulent refunds.

“Protecting taxpayers and strengthening the integrity of the U.S. tax system is a team effort, and the progress we’ve made together over the past 18 months demonstrates our shared commitment to fight fraud,” said CeCe Morken, executive vice president of Intuit’s ProConnect Group. “There’s still much work to do. Intuit is committed to doing our part to actively promote a set of best practices and standards for reporting suspicious behavior to the IRS and state revenue agencies to help them improve their ability to identify tax fraud.”

Expanded Security for Tax Professionals

The IRS Security Summit has developed industry requirements for authentication for online and desktop professional tax products. In support of these standards, and as part of Intuit’s continued commitment to lead the industry with new capabilities, Intuit ProConnect has implemented enhanced security measures for Lacerte, ProSeries and ProConnect Tax Online.

• End-User Authentication in Desktop Software: New this year, all individual users within a firm who login and access Intuit ProConnect desktop professional tax software must create and use a unique username and password. After 30 minutes of inactivity, re-authorization will be required.

• Stronger Passwords: Passwords must now be at least eight characters in length and include a combination of upper and lower case letters, numbers and special characters. Passwords will expire every 90 days.

• Captcha Technology: Captcha technology helps ensures a person is signing in, not a robot and has been enabled to help protect Intuit online products.

These changes supplement multi-factor authentication, introduced last year in Intuit’s ProConnect Tax Online, which requires customers to use more than a password before access is granted to their account. When customers login to ProConnect Tax Online, Intuit automatically sends a unique, six-digit code to their pre-designated, trusted device or email account to be used in combination with their password to securely access their account.

Expanded Security for Taxpayers

In addition to the multiple security measures Intuit introduced in prior years in its TurboTax® products, including expanded multi-factor authentication, Touch ID account authentication and customer notifications, this year, additional measures have been put in place, including:

• Trusted Phone Number: TurboTax is making it easier for returning customers to regain access to their prior-year account by logging in with a phone number. Anytime returning customers come back to log in to their TurboTax account, they now have the added option of using a verified phone number for a trusted device. Adding a trusted phone number – one that can be used to receive verification codes by text or call, provides an extra layer of security.

• Anti-Phishing: TurboTax is taking additional steps to fight phishing scams.  In their account history, customers can now view security and account emails that come from TurboTax, helping them determine whether an email they received is from Intuit.

• Stronger Passwords: Consistent with IRS Security Summit requirements for all tax software products, TurboTax passwords must now be at least eight characters in length and include a combination of upper and lower case letters, numbers and special characters.

“Security is built into everything we do. We’re continuing to invest in new measures to ensure our products have industry-leading fraud protection while driving industry-wide standards that will help further protect taxpayers and tax professionals,” added Morken.

# # #