The popular TurboTax software has temporarily stopped processing state tax refund filings in all states after reports of fraud increased.
Criminals may be using identity information (like a Social Security number) that was stolen from somewhere else to file fake returns via TurboTax and collect refunds.
In Minnesota and Utah, for example, some taxpayers recently logged into TurboTax and saw that a return has already been filed under their name.
Intuit, the company that owns TurboTax, said that itself has not been breached, but an investigation is ongoing. About 29 million people used TurboTax to file their tax returns last year.
Intuit heard this week from a “small handful of states” that saw an uptick in suspicious filings, said Julie Miller, a spokeswoman from Intuit.
Miller declined to name the states, but Minnesota, Alabama and Utah have all reported issues. Nineteen states in total have identified similar problems, according to the Utah Tax Commission.
In Utah, the Tax Commission said 28 fraudulent returns were filed over the course of two days this week. Another 8,000 were flagged as suspicious and are being investigated.
“That is off the chart for us,” said Charlie Roberts, a spokesman for the state tax commission.
Utah’s fraud detection system indicates that whoever is filing the fraudulent claims probably has access to taxpayers’ returns from previous years. The state said its own systems had not been compromised and could not say how a criminal could have gotten access to the previous year’s filings.
But it warned that Utah taxpayers who filed state income tax returns electronically prior to 2014 through third-party vendors are potentially affected.
“Unfortunately, the bad guys have a lot of places to get information,” Miller said.
All it takes to file a fraudulent return under someone else’s identity is a name and Social Security number. The online black market is full of this type of information.
CNNMoney discovered that hackers have stolen more than 6.5 million Social Security numbers in 2014.
But possibly 80 million more were stolen so far this year from insurance giant Anthem, which was was hit by a massive data breach. Hackers stole a database of names, birthdays, medical IDs, Social Security numbers, street addresses, e-mail addresses and employment information.
When someone claims your tax return fraudulently, it can take years for the IRS to complete its investigation and clear your name. Until then: no refunds for you.
Intuit stopped processing electronic state returns Thursday afternoon , but did not stop processing federal tax refund filings, Miller said. Those forms have more stringent fraud controls, put in place by the IRS over the past year.
Despite the suspension, people can keep preparing their state returns via TurboTax, which said it will store them securely until it can resume processing them.
It was unclear Friday if the problems are more likely to happen when using the free version of TurboTax, Miller said.
H&R Block, another tax preparer, said Friday that it is not having similar problems with state returns.
Intuit customers who believe they are victims of tax fraud can call 800-944-8596 for help. TurboTax said it will prepare taxes for affected customers for free, and provide identity protection services and free credit monitoring.
