Identity thieves are at it again. Internal Revenue Service Commissioner John Koskinen testified during a Senate Finance Committee hearing this week that taxpayer data may have been compromised as thieves attempted to access information using the Data Retrieval Tool (DRT). The DRT is a free service which allowed student loan applicants and their parents to transfer tax data from a taxpayer’s federal tax return directly to a Free Application for Federal Student Aid (FAFSA) form, eliminating the need for extra forms and paper. While the exact numbers of affected taxpayers have not yet been determined, Koskinen told the Committee that it could be as many as 100,000.
In March, the Internal Revenue Service (IRS) and Federal Student Aid (FSA) announced that the DRT on fafsa.gov and StudentLoans.gov would be unavailable until extra security protections can be added. In a joint statement, the agencies advised, “While we are working to resolve these issues as quickly as possible, students and families should plan for the tool to be offline until the start of the next FAFSA season.”
In a hearing this week, Koskinen stated that the IRS had an early indication in September that “it was possible, with relatively little stolen information, to pretend you’re a student, go online, start to fill out an application, give permission for us to populate that application with tax data — most importantly, the adjusted gross income — and then complete the application.” The IRS relayed those concerns to the Department of Education: the concerns were weighed against the notion that 12 million to 15 million applicants use the system. The decision was to work on a long-term solution while monitoring the existing system. However, the IRS told the Department of Education that “as soon as there was any indication of criminal activity, we would have to take that application down.”
Koskinen advised the Committee that, in February, the agency noticed a pattern that appeared out of the ordinary. As they investigated further, they determined that some of the activity was legitimate while other activity appeared to be criminal. As a result, the DRT was shut down in early March, and it has remained offline.
The IRS has marked all of the accounts of those taxpayers who did not complete their FAFSA application using the tool. That totals 100,000 taxpayers whose accounts will be monitored. But, the Commissioner says, “it’s clear, some of those are legitimate people who actually just didn’t complete the application.” To be safe, the IRS will notify all 100,000 potentially affected taxpayers – even if the data suggests that attempts to access the account were legitimately from the taxpayers. When asked by Sen. Ron Wyden (D-OR) whether the IRS was confident about those numbers, the Commissioner replied that “The number may grow, although we’ve continued to look at it and analyze it, ours — at this point, all of the analytics with the Department of Education shows that the pool is about 100,000.” Letters have already been mailed to 35,000 taxpayers.
The IRS filters initially stopped 52,000 returns from being processed and of those, the IRS had determined that 14,000 of those were identity theft refund illegal returns “that didn’t get out the door, but were there.”
Were any of the thieves successful? The IRS estimates that fewer than 8,000 fraudulent returns were actually filed, processed and refunds issued.
As the IRS works through this issue, together with the Department of Education, it’s clear that students will still need to complete the FAFSA – even in the absence of the DRT. You can find the information you need to complete the FAFSA on a previously filed tax return. If you are completing a 2016–17 and 2017–18 FAFSA, you should manually enter your 2015 tax information from the tax return you filed in 2016 (not your 2016 tax information that you will file in 2017). If you don’t have a copy of your tax return and can’t access the tax software or contact the tax preparer who filed your return, you can order a tax transcript directly from IRS. The Get Transcript tool is available online at www.irs.gov/transcript, or you can call 1.800.908.9946 to order a copy to be mailed to you.
For the most recent FAFSA cycle, there were 19,757,764 total applications. Approximately one-quarter of those applications are students completing FAFSA for the first time. FAFSA is required for Title IV federal financial aid purposes. Before it was taken down, the DRT had been available since the 2009-10 school year.