Around 175 million Americans are expected to receive a stimulus check in the coming weeks, but fraudsters may try to swipe those payments even before they even hit people’s bank accounts.
Since the coronavirus outbreak, more than 7,800 coronavirus scam complaints have been filed with the Federal Trade Commission. But the distribution of stimulus payments likely will mean a new wave of scams, experts said.
“For most Americans, the COVID-19 pandemic is a once-in-a-lifetime challenge,” said Shaun Barry, global leader of fraud and integrity at SAS. “For fraudsters, the pandemic is a once-in-a-lifetime opportunity.”
The CARES Act dedicates $250 billion to go directly to Americans’ wallets, up to $1,200 per person plus an extra $500 per child. While some of the payments have already been sent out, others may take weeks or months to arrive, giving thieves time to steal them.
“The criminals have gotten very sophisticated with the information they have about us,” said Thomas Edwards, special agent in charge of the San Francisco regional office for the U.S. Secret Service. “It's very easy to obtain a Social Security number on the dark web, and they'll use that information to take advantage of that stimulus check.”
Types of scams
Many fraudsters will use stolen identity credentials — such as your name, Social Security number, and address to file an income tax return on your behalf. The criminal will put down their bank account information, so any tax refund and stimulus check are deposited in their account.
The Internal Revenue Service is using direct deposit information it has on file to disburse the payments. Fraudsters know this, Barry said, and “that gives them even greater incentive to steal your identity.”
Unscrupulous people could also exploit the new online tool for non-filers that the IRS released recently, Barry said.
“Expect fraudsters to submit thousands of false applications, using stolen and synthetic identities,” he said.
Criminals may be able to get more than just the $1,200 check. Using stolen identities of children, the scammer may also try to get the additional $500 for qualifying children.
“People who have not yet filed their federal income tax returns are at greatest risk,” Barry said. “As well as minors and the elderly.”
Additionally, Americans may receive robocalls and phishing emails from criminals, promising to help you get the payments if you provide your financial data or your personal information, according to Edwards. Others may get emails or calls from fraudsters pretending to be their bank to try to take over your bank account.
“There have been over the last number of years enormous data breaches from credit bureaus to government databases, health insurance companies, and merchants,” said Lori Hodges, vice president of North America risk for Visa. “All of that rich information allows fraudsters to have quite a nice profile on us as consumers.”
How to protect yourself
File your taxes
The goal of some scammers is to file your taxes ahead of you and get a tax refund. One sure way to protect yourself is just to file your taxes as soon as possible, even though the tax deadline has been extended to July 15.
So far, 97.4 million tax returns have been filed this year. Last tax season, a total of 155.8 million returns were filed.
“File your return now, even if you owe money,” Barry said. “Clever fraudsters will target those people who haven’t yet filed.”
IRS won’t send emails
Email, phone calls or text messages linking to a website, are the most common way scammers will get in touch with potential victims, according to Mike Pappacena, co-head of cybersecurity and risk at ACA Compliance, a technology consulting practice.
But the IRS doesn’t request information from individuals in any of those ways. The IRS contacts taxpayers in two ways: by letter or in person. If the IRS calls you, it will only be after the agency contacted you first by mail.
If you get a call, ask for the caller’s name, badge number, and callback number. Call 800-366-4484 to verify if the caller is an IRS employee.
Additionally, the IRS will mail a letter about the stimulus payment to your last known address within 15 days after it’s paid, which will explain the payment method and how to report any problems.
Banks won’t ask for your personal information
Banks and credit unions won’t call you to ask for your personal information, Hodges said. Instead, they will authenticate your identity when you call them.
“The key is recognizing the call is coming to you,” Hodges said. “And they're asking for personally identifiable information.”
If someone calls you pretending to be your bank or credit union and asks for information like your PIN code or the three-digit code on the back of your card, this is a red flag and you should hang up.
‘Go back to the original source’
You may receive emails with a fake invoice or emails saying that you have to reset or confirm your bank account password which could potentially be scams.
If you’re getting suspicious emails from your bank, don't click on the links or the attachment in the body. Instead, type in the bank’s address in the browser yourself.
“You need to go back to the original source,” Edwards said. “Do not pay attention to that email. Contact the bank or the credit card company directly.”
If you’re contacted by phone, you should ask the caller for their name and call back using the number on the back of your credit card or on the bank website.
What to do if you’re a victim of a scam?
Reporting the scam as early as possible gives you a higher chance of stopping the scammers, Edwards said. If you realize you’re a victim of a stimulus check scam, reach out to your local law enforcement either by contacting the police or your local FBI office which normally has an outreach number.
Getting a replacement stimulus check may take some time, he said.
“The Treasury has to do an investigation into that particular instance,” he said. “It may be awhile for you to get a replacement check if it's stolen or somebody collects on it.”
Read more information and tips in our Taxes section