Why Child Identity Theft Is a Growing Concern During Tax Season
Social Security numbers and other data stolen from kids are now making their way onto fraudulent tax returns
Researchers who specialize in the so-called dark web say they’re seeing an uptick in the number of online listings for personal information used by cybercriminals to claim dependents on fraudulent tax forms. At other times, that kind of data can be used for fake loan requests and credit card applications, too.
Earlier this year, employees at the cybersecurity firm Terbium Labs spotted a set of stolen data—titled “infant fullz”—that included a baby’s full name, Social Security number, date of birth, and mother’s maiden name. The listing was priced at $312—significantly more than the $5 requested for similar bundles of information for adults. (Used by data thieves, “fullz” refers to a complete package of identity information stolen from a person.)
Adding a child to a tax return can be worth about $1,000, providing a decent return for someone who pays $312 for the identity info. And a fake deduction like that is likely to be combined with others to maximize a criminal’s take, Wilson says.
Most returns—and refunds—get approved by IRS officials well before the tax form is scrutinized, she says. That gives criminals plenty of time to take the money and run.
In the past, most fraudsters have distanced themselves from the areas of the internet that exploit children, Wilson says. They don’t wish to be associated with something as nefarious as child pornography, and they don’t want the extra attention that comes from authorities when the victims are children.
Current statistics back that up. According to the Federal Trade Commission, which tracks fraud and identity theft, victims younger than 19 accounted for just 4 percent of the identity-theft cases reported last year.
Tempting Tax Credits
Not all child-identity issues that crop up during tax season are tied to criminal activity. Bryan Woodcock, product manager at H&R Block, says returns routinely get rejected by the IRS because a couple has broken up and both parents try to claim the child as a dependent.
But there are cases of intentional fraud, too, and the IRS’ electronic filing system is quick to flag a Social Security number that has appeared on more than one return form. That’s yet another good reason for parents to get their returns in early.
“This is really the second year that we’re seeing those kinds of rejections,” Woodcock says. “The early signs show that there are going to be more this year than last, but it’s still too early to tell.”
The reality is that the theft of children’s digital data often goes undetected until the child’s real parents file a legitimate return, Wilson says. And then those parents are the ones subjected to the extra scrutiny. They may have to file by mail, instead of electronically, and may be required to submit a special affidavit stating that a dependent is a victim of identity theft.
Worst of all, try as they may to prevent someone from stealing their child’s identity (see our tips on how to protect your kids, below), there’s no foolproof way to determine whether the info has already been swiped.
“I wish there was a better answer,” Wilson says. “But there really isn’t.”
Long-Term Impact Unknown
Eva Velasquez, president and CEO of the Identity Theft Resource Center, a nonprofit group based in San Diego, says her organization has been dealing with this problem for more than a decade. In that time, she says, the crimes the ITRC has studied were usually perpetrated by relatives, family friends, or caretakers who had access to a child’s personal information.
But Velasquez says she’s not surprised by Terbium’s findings, given the growing number of breaches involving children’s information. Her big worry? The countless children who have no way of knowing that their data has been stolen until they grow up and try to apply for a credit card or loan.
That’s a concern shared by many cybersecurity experts.
“Children’s information has a long shelf life,” says John Prisco, president and CEO of Quantum Xchange, a data-security company focused on new encryption technologies. “It’s very likely that criminals are stealing the personal identifying information of kids, and people don’t notice.”
According to H&R Block’s Woodcock, teenagers just entering college have long represented a sweet spot for cybercriminals. They often have a job and pay taxes. And it doesn’t look strange for them to be taking out a loan or applying for a credit card.
In addition, a teen’s thin credit history can prevent automated security programs from spotting the patterns used to flush out fishy transactions. This gives criminals more flexibility in how they use stolen identities, says Paige Hanson, Symantec’s chief of identity education.
Meanwhile, the pool of data continues to expand because of breaches. Wilson singled out the VTech hack, which exposed the personal information of 12 million kids and adults.
“What’s the fallout from that?” she asks. “It’s a little too early to tell at this point. We probably won’t know for the better part of a decade.”
How to Protect Your Kids
So given those dangers, what’s a parent to do?
The obvious answer, it would seem, is to perform a credit check on your child, just to be safe. But experts say you should not do that without careful consideration.
If your child doesn’t have a credit history, the act of performing the check will officially start one, Hanson says.
And if you then decide to freeze your child’s credit, it can create headaches down the road, Velasquez says. To unfreeze the credit, you need a PIN that verifies the child’s identity, she explains. If that PIN gets lost in the intervening years, such as in the case of a death or divorce, the child needs to provide documentation confirming his or her identity to receive a new PIN.
Trouble is, children often don’t know about the freeze until much later in life, when it’s time to apply for a college loan or buy a car or home.
“This can’t be something you just throw in a file somewhere,” Velasquez says. “It needs to be kept with important documentation, such as birth certificates, that get handed over when a child turns 18.”
There are some additional steps you can take, though, to protect your child’s identity and personal information.
File early. The longer you delay, the more room you leave for someone else to claim your child with a stolen Social Security number.
Safeguard Social Security numbers. Just because an after-school program, sports team, or doctor’s office asks for your child’s Social Security number, that doesn’t mean you have to hand it over. Groups like these often just want it to make their record keeping more convenient.
Parents used to be required to give out a child’s number if, for example, a family member wanted to donate to the child’s college fund, Hanson says. But that’s no longer the case.
Protect your print copies. Social Security cards should be filed away in a secure location. Most identity theft against children is perpetrated by someone they know, Velasquez says.
Ask for a PIN for your tax returns. If you’re worried that your child’s Social Security number has been compromised, you can ask the Internal Revenue Service to issue an Identity Protection PIN that will act as a second form of identification on your tax return.
“It’s like having a second Social Security number,” Woodcock says.
But keep in mind that the IRS gets the final say in whether to grant the PIN and that it’s rare for a child to have one, he says.
Watch out for junk mail. This can be one of the biggest hints that someone has started using your child’s personal data.
If your child doesn’t have a credit history, as far as you know, there’s no way he or she should be getting credit card applications in the mail, Hanson says. The same goes for unexplained traffic tickets and notifications for overdue taxes, which may arrive if someone else is using your child’s identity.