Document text
Computer breaches like the one feared this week inside a vendor selling hunting and fishing licenses for Oregon and other states typically target Social Security numbers to file bogus income-tax returns that stiff the government and give victims headaches, federal agents say. About two-thirds of all identity theft cases these days are fraudulent tax returns usually sniffed out by Internal Revenue Service computer filters. But innocent citizens are often surprised to learn that crooks need just your name and Social Security number to file fake returns, the IRS says. "If all they have is your fishing-license number, that's not going to hurt you," says IRS Special Agent Ryan Thompson in Tacoma, Wash. "It's always the Social Security number. "There are a lot of folks out there trying to breach systems that they know have Social Security numbers," Thompson says. The Oregon Department of Fish and Wildlife has suspended internet sales of hunting and fishing licenses indefinitely while it and two other states investigate an apparent security breach of the private vendor used to sell online licenses. A self-professed computer hacker calling himself "Mr. High" sent an email Tuesday to ODFW and the vendor, Active Outdoors, claiming to have breached the system and warning them to fix the flaws. The email triggered probes by computer experts in Oregon, Washington and Idaho into whether any personal information, such as Social Security numbers, were exposed. So far, no data loss has been discovered from the records of the nearly 967,000 people who buy ODFW licenses annually, agency spokesman Richard Hargrave says. "For us right now, the good news is we haven't noticed anything unusual about our data," Hargrave says. "They'll continue to look, and hopefully that will remain the case as this plays out." A Mail Tribune email sent to the address Mr. High used was not immediately answered. Similar investigations are occurring in Washington and Idaho, states that use Active Outdoors, which is part of the Dallas-based Active Network. The Associated Press reported that Active Network released a software update to address the threat within 15 hours and hired a cybersecurity firm to conduct a review. The potential breach involved only the internet portal for buying ODFW licenses, through which about 18 percent of Oregon licenses are sold. Licenses are still available for sale at point-of-sale commercial outlets or ODFW offices. While Mr. High did not ask for a ransom or state that he or she was targeting sensitive data, large-scale "data hacks seem to happen every day" and the targets are virtually always Social Security numbers, Thompson says. A person's name and Social Security number is all that's needed to file fake tax returns seeking refunds that get funneled into bank accounts before the unsuspecting victims file a tax return, Thompson says. In some cases, individuals or groups file hundreds or thousands of fake returns, he says. "It's a fairly simple crime," Thompson says. "The risks are low and the rewards are high." The IRS has sophisticated computer filters that look for such things as multiple refunds sought for the same bank account to weed out false returns, and well over 90 percent are caught and stopped that way, Thompson says. "For the most part we catch them, but they're always evolving," Thompson says. Those whose tax returns are hijacked find out when they file their real return, then the IRS works with them to rectify it, but that takes time and delays in legitimate returns and refunds, Thompson says. People can help reduce their exposure to tax fraud by guarding their Social Security numbers closely and not giving them out even if it seems like a legitimate request, because the more places your number resides, the more susceptible you are to a data breach. "Protect that thing like gold," Thompson says. "Don't give it out flippantly. Don't carry your Social Security card." Also file your taxes as early as possible because the IRS system reads the first one it receives per number, Thompson says. The IRS computers typically begin accepting tax returns in late January or early February, but the actual date changes annually, he says. Also, check bank records online regularly, get regular credit checks and a locking mailbox, Thompson says. Avoid getting caught in so-called "phishing expeditions" in which callers pose as entities asking for you to verify your Social Security number. "Even if you think it's legit, don't give it out over the phone," Thompson says. Social Security numbers are tied to all of Oregon's hunting, fishing and shellfishing licenses because state and federal law since 2000 has required agencies like ODFW to collect those numbers to help track down dead-beat dads owing back child support, Hargrave says. The Social Security number is collected during the purchase of a person's first ODFW license, then he or she is given a hunter or angler ID number used to track all subsequent transactions, Hargrave says. Social Security numbers are not displayed on licenses or otherwise disclosed, and the ODFW computer system won't allow the use of Social Security numbers to search hunter/angler information, Hargrave says. Reach Mail Tribune reporter Mark Freeman at 541-776-4470 or [email protected] . Follow him on Twitter at www.twitter.com/MTwriterFreeman .