IRS Suspends Insecure ‘Get IP PIN’ Feature

  • 8 March 2016
  • 2 replies
  • 195 views

Userlevel 7
Badge +54
After recent events I don't think they had much choise in the matter.
See Also - Thieves Nab IRS PINs to Hijack Tax Refunds
 
7th March 2016
 
Citing ongoing security concerns, the Internal Revenue Service (IRS) has suspended a service offered via its Web site that allowed taxpayers to retrieve so-called IP Protection PINs (IP PINs), codes that the IRS has mailed to some 2.7 million taxpayers to help prevent those individuals from becoming victims of tax refund fraud two years in a row. The move comes just days after KrebsOnSecurity first exposed how ID thieves were abusing the service to revisit tax refund on innocent taxpayers two years running.
 
Last week, this blog told the story of Becky Wittrock, a certified public accountant (CPA) from Sioux Falls, S.D., who received an IP PIN in 2014 after crooks tried to impersonate her to the IRS. Wittrock said she found out her IP PIN had been compromised by thieves this year after she tried to file her tax return on Feb. 25, 2016. Turns out, the crooks beat her to the punch by more than three weeks, filing a large refund request with the IRS on Feb. 2, 2016.
 
Full Article

2 replies

Userlevel 7
Finally!!! The IRS has woke up and smelled the roses and is starting to react to this issue.  Will this teach them a lesson?? i DOUBT it that's the governement for you.
Userlevel 7
BY: 8 Mar 2016 at 20:51, Iain Thomson
 
The US Internal Revenue Service (IRS) has suspended its Identity Protection PIN tool, designed to safeguard people at risk from identity theft, because scammers are using it for identity theft.
American taxpayers can request a six-digit PIN code from the IRS that is supposed to lock down their account with the taxmen: no valid code, no login. For example, when the IRS admitted last month that 700,000 people's old tax returns – which are full of sensitive personal information – had been sent to scammers, it enrolled those affected in the PIN system.
In total this year, the IRS has issued 2.7 million PIN codes. But the scammers got wise, and used 800 of them to file fraudulent tax returns to redirect people's refunds to the criminals' bank accounts. Now the IRS has stopped the system.
"As part of its ongoing security review, the Internal Revenue Service temporarily suspended the Identity Protection PIN tool on IRS.gov," the agency said in a statement.
 
full article here:

Reply