What You Can Do Now to Protect Your Tax Refund

Millions of Americans count on their tax refunds to pay down debt, save for the future and cover necessities such as groceries or utilities. So imagine filing your return, only to be told your refund has been paid to someone else.

It's a big problem

The IRS paid $5.2 billion to identity thieves last year, as bad guys took advantage of delays in W-2 reporting to swoop in on other people's money, according to a recent Government Accountability Office report. Although employers are required to send W-2s to their employees by the end of January, companies don't have to send copies to the Social Security Administration until the end of February. Social Security then passes the W-2 data along to the IRS, which doesn't start matching reported wages to tax returns until July.

The Treasury Department has suggested that Congress make W-2 deadlines earlier and require e-filing for more employers. Until lawmakers take action, here's what you can do to reduce your chances of becoming a victim.

File early and electronically. Identity thieves often file phony W-2s and then use real people's Social Security numbers to claim bogus refunds, says attorney Steve Weisman, author of "The Truth About Avoiding Scams." If you file first, a criminal's attempt to use your Social Security number will be flagged and any subsequent tax returns will be rejected. Electronic filing makes it even speedier to file your return, and it keeps your precious tax and personal information out of the mail.

Guard your Social Security number. As you can see, your Social Security number is the key to this scam. Try offering alternate identifiers, such as your driver's license number, to health care providers and others who don't really need your Social Security number, suggests Weisman, who runs the Scamicide site. Those with Medicare cards -- which still use Social Security numbers, after other insurers switched to alternate identifiers -- should avoid carrying the card or use a copy with most of the numbers blacked out.

Don't be an easy target. Good Internet hygiene can protect you against bad guys of all kinds:

Install, update and use anti-virus and anti-malware software.
Don't click on links or download attachments unless you're absolutely sure what you're getting.
Don't respond to emails from the IRS (the IRS doesn't email you about sensitive tax information) and be extremely wary of calls seemingly from the IRS, since they're often fakes.
Employ hard-to-guess passwords and answers to security questions. "The best answers ... are absolute nonsense," Weisman said. "If the security question is 'Where did you go to high school?' the answer is 'grapefruit.'" In other words, the answer shouldn't be easily gleaned from your Facebook page or a Google search.

If, despite your best efforts, you become a tax identity theft victim, contact the IRS' Identity Protection Specialized Unit at (800) 908-4490. People who have been victimized by tax refund fraud typically do get their money eventually, but they may have to wait up to a year.