Are you protected from data security issues?

Earlier this week, I received complaints that our law firm was dialing random numbers. We followed up with our phone company and were advised that scammers were most likely masking or spoofing our number. The phone company filed a complaint with the authorities and advised us to report any further activity.

Of course, we aren’t the only businesses affected by phone scams. The Internal Revenue Service (I.R.S.) has repeatedly warned about phone scams, including impersonation scams involving phishing or spoofing. It’s not surprising that taxpayers are getting fed up with these scams: since October 2013, the Treasury Inspector General for Tax Administration (TIGTA) has received complaints from more than 2.5 million people who have reported to TIGTA that they have received an impersonation call. More than 15,800 victims have reported that they paid the criminal impersonators a total amount of more than $80 million.

And when it comes to all scam calls – even those not related to the I.R.S. impersonation scams – the F.T.C. reported that consumers lost more than $285 million in November of 2019.

As the calls get more pervasive, taxpayers have offered advice about the best ways to deal with the scammers. Many of these same taxpayers have posted tips on Facebook and other social media for dealing with scammers. The advice ranges from blowing whistles in the phone to trying to “catch” the scammers at their own game by challenging their questions. Many of those same pieces of advice are being re-posted as though they might be effective. They are not. The best advice? Hang up. Don’t engage. Why not? Here are seven reasons why those tips don’t work and why you should never engage with scammers:

1. When you engage with a scammer – even if you are blowing a whistle in the phone – you’ve just confirmed two pieces of information for the scammers: they’ve called a working phone number AND you’ll answer the phone. Why does this matter? Because stealing money from taxpayers is only one part of the equation. Remember that identity theft isn’t just about getting money out of you once or stealing a tax refund check, it’s an entire industry. Your data typically isn’t getting stolen in one fell swoop: your identity profile is being put together piece by piece. Key bits of information about you may be stored, repackaged, and sold from one scammer to the next. The fact that you answered the phone and were willing to engage? That’s valuable to scammers who might try it again later – or sell your number to the highest bidder.
2. When you tell scammers to stop calling you, you may inadvertently give out more information about your phone number. When you offer comments like “stop calling my house” or “don’t call me at work” or “this is my cell phone,” you’ve just added to the database. Not only do the scammers know that it’s a good number, and you’ll answer (see #1), you’ve now offered up more details about the number the scammer just called (i.e., it’s your house, workplace or cell number). If they’re simply calling off of a stolen call list, you’ve just made your phone number more valuable.
3. When you tell scammers that you know you don’t owe anything, you might have confirmed your name, that you’re a taxpayer, and worse, possibly your Social Security Number (SSN). Remember, this isn’t some kid calling with a script: these are professional thieves who likely do this for a living. They know how to get what they want. It can be easy to give out or confirm additional information even if you don’t intend to. For example, if a scammer says, “Our records indicate that Kelly Erb with SSN 123-45-6789 owes $5,400,” and I reply, “That’s not true, I always pay my taxes,” I might have inadvertently offered up more information. Not only does the scammer now know that my phone number is good (see #1), they have a name to attach to it. And since I automatically didn’t say, “That’s not my Social Security Number,” that may indicate that they have the right SSN, too. So now they might have the name and SSN of a taxpayer who claims to be current: that strongly suggests that I have a job or other taxable income and that I have enough in assets to pay my bills regularly. I just became an even more valuable commodity to the scammer.
4. If you hesitate, you may give the scammers an opening. The entire point of calling you is to solicit information. If you hesitate, that might be the opening that the thieves are waiting to try and trick you. The longer you stay on the phone, the more likely you are to inadvertently say or reveal something that gives the thieves an “in.” Hanging up quickly is a better idea.
5. When you make threats back, you might be offering valuable “out of wallet” information. It may be tempting to bring out the big guns like “I’ll get you, I’m a lawyer” or “How dare you, my dad is a cop” or “Just wait until my Army husband, Bill, gets home.” But think about what you’ve just said. Yes, more information about yourself. Those additional nuggets are helping form your profile. As law enforcement told me, pieces of data are matched to other data. Suddenly, you’re no longer just a random phone number. You’re Jane Smith, SSN 123-45-6789. You’re a lawyer, and your dad is a cop. You live at 123 Elm Street, Anytown, USA 12345 (since that address matches your phone number). Your spouse’s name is Bill, and he works for the government. That data – especially once it’s been paired with more data which can be found in other places, such as social media sites or from a recent hack – is incredibly valuable.
6. You might be breaking the law. But they called you, right? It might not matter. Under federal law, you can record phone calls with the consent of just one party to the call (18 U.S.C. § 2511). That’s also the law in most states: you can record a phone call or conversation so long as you are a party to the discussion. If you are not a party to the conversation, you can record a conversation or phone call only if at least one party consents and has full knowledge that the communication will be recorded. The statute also prohibits recording conversations with criminal or tortious intent. But in 15 states (California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Vermont, and Washington), you need the consent of both parties to record a call. There are exceptions to these rules for law enforcement investigations, emergency situations, or certain unlawful activities: scammers should fall into the latter category, but the rules aren’t always clear. I’m sure you’ve noticed that in the myriad of advice handed out from I.R.S., TIGTA, and other law enforcement, it does not include recording the call. If you haven’t been directed to record the call, don’t engage, and don’t record.
7. You’re never going to make them feel bad. I know that it makes you feel better to tell off a scammer, but at the end of the day, it doesn’t bother them. Understand that these people are thieves. They are preying on vulnerable people – typically the elderly, students, and immigrants – who they can bully. They often use threatening language to scare taxpayers into giving up information or money: in one instance, an older victim was so distraught as a result of threats from the scammer that he crashed his car on the way to pick up a wire. These are not nice people. Your threats, bad language, telling them off? They’ve likely heard – and said – worse. You’re not fazing them one bit. Don’t waste your time.

It’s important not to give away any personal information. Once identity thieves have your info, they can access your bank account, charge your credit cards, and open new accounts in your name. An identity thief can also file a tax refund in your name to get a bogus refund. It’s important not to play along. Don’t pick up calls from numbers you don’t recognize, and don’t trust caller I.D. (trust me: as we’ve learned firsthand, technology allows scammers to spoof businesses and government agencies). And never – ever – transfer money to a government agency by wire or gift card.

Rather than rely on tips from your Facebook friends, here’s advice from the professionals (I.R.S., TIGTA and law enforcement) about how to best deal with the scammers: If you receive a call from someone claiming to be from the I.R.S., and you do not owe tax, or if you are immediately aware that it’s a scam, don’t engage with the scammer and do not give out any information. Just hang up.

If you receive a phone call from someone claiming to be with the I.R.S., and you owe tax or think you may owe tax, do not give out any information. Call the I.R.S. back at 1.800.829.1040 to find out more information.

You can also contact TIGTA to report scam calls by calling 1.800.366.4484 or by using the “I.R.S. Impersonation Scam Reporting” form on their website. You may also want to report the scam to the Federal Trade Commission by using the “F.T.C. Complaint Assistant” to report persons pretending to be from the government; please add “I.R.S. Telephone Scam” in the notes.

The F.T.C. has even made a video about how to handle these kinds of calls: 

And while it won’t stop scammers, you can sign up on the National Do Not Call Registry to block telemarketers. Thirty-one days after your sign up, you can file a complaint against telemarketers that continue to call. 

Don’t fall for the tricks. Keep your personal information safe by remaining alert. For tips on protecting yourself from identity theft-related tax fraud, click here.