Don't Mess With Taxes

Identity thieves got access to personal information on 143 million Americans by hacking into credit reporting bureau Equifax's data base in late July.

If you have credit, you're screwed. Thanks Equifax.

Equifax is one of three major companies that tracks the credit worthiness of American consumers. The other two are Experian and TransUnion. These repositories of how we pay, or don't, our bills are where lenders, landlords and even potential employers go for information before making decisions that affect our lives.

Equifax also is where criminals went for all our personal data they need to steal our financial identities and money.

Protection problems: By now, we're all aware that the hack of Equifax exposed around 143 million of us to such life-damaging attacks. We millions of potential identity theft victims are this week's By the Numbers figure. Oh joy. And thanks Equifax.

Many of us have already gone to the company's special website, operated by Equifax subsidiary TrustedID, to see if our private information has been stolen.

Apparently, according to a report by Zack Whittaker for ZDNet, it's worthless.

To find out if your data was among that compromised, the check site asks you to enter your last name and the last six digits of your Social Security number.

After typing in "Test" as the surname and "123456" as the Social Security number, writes (and Tweets) Whittaker, the system validated the entry and said that the person "may have been impacted."

Security breach next steps: So it looks like we all should take the next steps to the protect ourselves.

You can enroll in TrustedID Premier, the credit file monitoring and identity theft protection service, the cost of which that Equifax says it will pay for a year. There were some questions raised about whether that would abrogate your ability to join a future class-action lawsuit against Equifax if your identity is stolen.

Despite the arbitration only clause warning in the enrollment notice, Equifax now says you can still sue it. How gracious of the company. But some privacy and consumer protection experts believe your legal rights here are still unclear.

You definitely should get copies of your credit reports from not only Equifax, but also Experian and TransUnion to see if there's anything unusual there. Identity thieves could have already acted since the hack Equifax announced Sept. 7 actually occurred six weeks ago. Again, thanks Equifax.

Fraud alert and/or credit freeze: You also can place a fraud alert or credit freeze on your credit reports.

A fraud alert can make it harder for an identity thief to open more accounts in your name. When you have an alert on your report, a business must verify your identity before it issues credit, so it may try to contact you. The initial alert stays on your report for at least 90 days. You can renew it after 90 days.

You don't have to go to each of the three credit reporting agencies. Filing an initial fraud alert with just one and it must tell the other two companies.

A credit freeze, also known as a security freeze, lets you restrict access to your credit report, which in turn makes it more difficult for identity thieves to open new accounts in your name. That's because most creditors need to see your credit report before they approve a new account. If they can't see your file, they may not extend the credit.

Of course, if you're considering getting a car loan or mortgage in the near future, you'll have to release the freeze so you can go through those loan-seeking processes.

Keep an eye on your taxes, too: As for taxes, if you're concerned a crook will use your credit bureau personal information to file a fake return in your name to claim a fraudulent refund, the Internal Revenue Service says data breach victims should stay in touch with the affected company, in this case Equifax.

As for the Equifax situation, the IRS said it "is currently reviewing and assessing this serious situation to determine necessary next steps."

And the data breach is all the more reason to submit your return early next filing season, so that ID thieves won't beat you to the IRS.

If it turns out that a fake return ultimately is filed in your name, file Form 14039, Identity Theft Affidavit, with the IRS.

You can find more info on tax identity theft here on the ol' blog, as well as at the IRS special tax identity theft Web page and its Publications 5027 and 4524.

Don't forget about your state taxes. Contact your state tax department about what steps you need to take to get any fake filing corrected.

A few final steps: And just to be sure, Sarah Jamie Lewis, an anonymity and privacy researcher at Mascherari Press, suggests a few more steps to protect your finances and identity.

"Don't forget to change your name, date of birth, home address and social security number regularly," Tweets Lewis.

She's being sarcastic (I think), but the way things are going in this Big Data era, Lewis just might be onto something.

You also might find these items of interest:

• 4 tax cyber security tips from IRS, NY tax officials
• Cyber crooks are looking to make tax fools out of us all
• 5 ways to protect your identity (and money!) during National Tax Security Awareness Week
  (and year-round!)