Taxing times to fend off cyber fraud

Tax time may be tough on businesses and individuals, but it’s especially hard on the Internal Revenue Service and other government agencies that handle tax return information.

Wily cyber criminals eager to exploit the annual stress that surrounds tax filing to steal valuable, data-rich returns are adding to agencies’ workloads -- putting the IRS on the defensive, and forcing the Department of Education to temporarily shut down the IRS data retrieval tool used to populate the Free Application for Federal Student Aid form.

In comments before the Senate Finance Committee on April 6, IRS Commissioner John Koskinen revealed that hackers recently exploited the tax agency’s online data retrieval tool that transfers parents’ financial information to the student-aid application, putting  nearly 100,000 people at risk of identity theft. (Nearly 20 million people filed a FAFSA in 2015-16.)

Given that there are more than 200 ways in which the IRS shares, or allows individuals to share, tax data with financial firms, lenders, employers and other government agencies, it is not surprising that vulnerabilities exist.

“The attacks against FAFSA’s data retrieval tool are a good example of how attackers will go after the weakest link to get what they want,” said Matias Woloski, CTO and co-founder of Seattle-based Auth0, an identity management company. “In this case, they were after previous tax returns, which are rich in personal data -- useful for identity theft as well as filing fraudulent tax returns this year.”

Although the IRS has not released technical details about how the system was misused, the most likely scenario is a weak authentication mechanism used by the FAFSA application system, Woloski suggested. “It almost certainly did not require multifactor authentication and may have allowed for easy-to-guess password reset questions,” he said. Another possibility is that attackers launched email phishing campaigns against FAFSA applicants. “It’s not hard to search social media to find kids who are likely to be going through the financial aid process.”

Attackers are simply targeting where information and money flows -- often to and from the IRS and federal departments or businesses that exchange tax information with the agency, John Bambenek, threat research manager at Fidelis Cybersecurity, said. Often these criminals target younger individuals’ records -- people under 25 -- because they typically have fewer addresses of record or places of employment and, therefore, present less of a verification problem for fraudsters, according to Vitali Kremez, director of research for Flashpoint. “Tax fraud is typically much safer than stealing a credit card,” he said, pointing out that the chances of getting caught or prosecuted are lower with tax fraud.

“The increase in fraud attempts noted by the IRS is reflected in the level of chatter we’ve observed on dark web and criminal forums,” said Michael Marriott, research analyst for Digital Shadows, adding that these attacks are fueled largely by the increased availability of personally identifiable information online.

The overall richness and exploitation potential of a tax record is definitely a big reason that government  is becoming a hot spot for hackers, according to Stu Sjouwerman, founder and CEO of KnowBe4 Inc., an IT security company. Where a credit card number may sell for 50 cents to $1 on the dark web, and a health care record might garner $60 to $80, the personal information to file a tax return (and collect an ill-gotten refund) can fetch as much as a few thousand dollars.

“Vast and rich data repositories within government agencies represent well-stuffed and thin-skinned piñatas to cybercriminals,” said David Vergara, head of global product marketing for VASCO Data Security. Antiquated platforms, systems and security measures allow hackers to use a number of attacks ranging from social engineering and phishing emails “to literally dozens of password-cracker tools, shared across hacker networks online, to compromise static passwords,” he said.

In his comments before the Senate, Koskinen said the IRS began working with the Department of Education in October to try and mitigate such scams and attacks. By February 2017, however, he said both agencies realized that online fraudsters were still getting the better of the system. “[By the] middle of February, it became clear that there was a pattern of activity …that was clearly not consistent with people going [to] actually apply for student loans,” Koskinen said in his April comments.

The IRS discovered that hackers had posed as 8,000 college students applying for financial aid to access the IRS data. “They would start the financial aid process like a normal student, and then use the IRS tool to automatically populate tax information for the student and parents.” Using that stolen tax information, identity thieves filed fraudulent tax returns, stealing $30 million from the IRS, he said.

Going forward, Woloski said he expects that the IRS and the Department of Education are likely to require “stronger authentication for online sites [including] more complex passwords, SMS-based multifactor authentication, additional verification of personal details at signup.” They might also use machine learning to detect suspicious behavior before the fraud is committed. “Using machine learning to defeat fraud has been a common approach for years in the e-commerce field, used by sites such as Amazon.” The IRS is likely to use machine learning to identify people cheating on their taxes, so it would be a natural extension to use it for improving security as well, Woloski pointed out.

And while he admitted in his comments before the Senate that “identity theft is still a major threat to tax administration and we need to keep up the fight,” Koskinen added that in 2016, IRS systems stopped more than $6.5 billion in fraudulent refunds on 969,000 returns filed by identity thieves. Kremez, a former cybercrime analyst for the New York City District Attorney’s Office, agreed that the IRS “is implementing better tracking online and getting more staff involved in application with inconsistencies.”

Government agencies that trade in tax information could do more to protect this highly valued data, Vergara said, including making more use of security and encryption software for sensitive data, encouraging the use of strong passwords and looking out for suspicious emails. “The weak link here is clearly the continued use of static passwords, which are easily hacked by a motivated cybercriminal,” he said. “This one is particularly painful as two-factor authentication technology has been around for a long time and widely available.”