| TPP is designed to reduce identity theft fraud by verifying the identities of suspicious tax filers. But it has some holes. “TPP uses single-factor authentication procedures that incorporate one of the following authentication elements: ‘something you know,’ ‘something you have,’ or ‘something you are,’” GAO said. “TPP’s single-factor authentication procedures are at risk of exploitation because some fraudsters obtain the PII (personally identifiable information) necessary to pass the questions asked during authentication.” Criminals can find answers to at least one of those “somethings” by searching the web or even purchasing information from vendors. IRS did a risk assessment in 2012 and “determined that improper authentication through TPP posed low or moderate risks to both the agency and taxpayers, and therefore required no more than single-factor authentication.” But things move quickly in the world of cybersecurity and that 2012 assessment is out of date. It “may not reflect the threat that IDT (identity theft) refund fraud currently poses,” according to GAO. Multi-factor authentication would require knowledge of at least two “somethings.” “Strengthening TPP authentication could help IRS prevent millions of dollars from being paid to IDT fraudsters each filing season,” GAO said. IRS officials agreed with GAO’s recommendations for improvements to the Taxpayer Protection Program. “We realize more work needs to be done regarding taxpayer authentication and agree an updated risk assessment should be conducted for the TPP,” John M. Dalrymple, a deputy IRS commissioner, wrote in the agency’s response to the report. IRS recently created a new position, he added, “to lead in the development of our service-wide approach to authentication.” The GAO report was requested by four members of Congress, including Sen. Susan Collins (R-Maine), chairwoman of the Special Committee on Aging. “While the IRS has developed tools and programs to detect and prevent refund fraud due to identity theft,” she said in a statement, “GAO’s report shows that substantial improvement is still needed.” | 