Greed Report: Tax hack—how to protect yourself from a crime that won’t go away

Law enforcement officials knew him only as "The Hacker" — a mysterious person (or was it more than one?) who was stealing millions of dollars in IRS tax refunds, then vanishing like the wind — along with the money — after threatening death to anyone who crossed him.

"We didn't know if he was even in the country," U.S. Postal Inspector James Wilson told CNBC's "American Greed." "We didn't know if he was Eastern European or somewhere in China or something."

It took an elaborate sting operation to finally unmask "The Hacker" as 27-year-old Daniel Rigmaiden, a reclusive computer whiz who hatched his $5 million scheme, including an ingenious money-laundering operation, largely from a campsite in the Los Padres National Forest in Northern California. After spending six years in prison fighting multiple fraud charges, he finally pleaded guilty in 2014 and was sentenced to time served.

But as wild as Rigmaiden's crime spree was, his basic offense — using stolen identities to file tax returns and collect fraudulent refunds — is frustratingly common. Authorities say all kinds of crooks do it, from small time gangbangers to organized crime figures. That's because it is a whole lot less dangerous than, say, armed robbery, and the returns are much greater.

Stolen identity refund fraud is costing taxpayers upwards of $6 billion per year. And while a 2015 government audit found the IRS did manage to block around $5 billion in fraudulent refunds in the prior year, experts say the situation is not much better than it was when CNBC first reported on the crime wave in 2012.

In some cases, crooks like Rigmaiden will use Social Security numbers from recently deceased taxpayers to claim refunds. But a stolen identity from a live taxpayer does the trick as well. And for every bogus refund Rigmaiden and the rest have collected through identity theft, there's a real taxpayer unable to claim a refund — or even file their taxes at all.

"There is a human face behind all of these data points," Eva Velasquez of the Identity Theft Resource Center told "American Greed." "There's so many zeros behind these statistics about the financial impact. But there's an emotional impact and a lost opportunity cost that occurs for the victims as well, because resolving this issue can take an extraordinary amount of time."

While the IRS has made strides in shortening response times for victims, Velasquez says there is much more work to be done.

"Unfortunately the time frame for resolution is wildly inconsistent. We do talk to some people that will have it resolved within a couple months, but then on the other end of the spectrum are the people that are still dealing with it a year later," she said.

"We hear from victims who have to actually plan their day according to how long they're going to be on hold to try to get in touch with the IRS."

To keep yourself out of that trap, particularly with the fall deadline approaching for taxpayers who filed for an extension on last year's returns, it's worth a refresher on some of the basic tips, courtesy of the Identity Theft Resource Center, the Federal Trade Commission and the IRS.

• Guard your identity, especially your Social Security number. It takes those nine digits — and little more — to claim a tax refund in your name not only from the IRS but also from dozens of states. Never carry your Social Security number with you, and never give it to anyone, not even your doctor. For Medicare recipients whose Social Security number is on their ID cards, the Privacy Rights Clearinghouse suggests only carrying the card when visiting a provider for the first time. Otherwise, carry a photocopy with the ID number removed.

• Keep your computer secure. That means keeping your software and virus protection up to date. And don't ever open an email attachment or click on a link unless you are absolutely sure what it is. A hacker could be trying to implant malware on your computer to steal your information.

• File your taxes early. Claiming your refund can unfortunately be a race between you and the identity thieves. Don't give them any more of a window of opportunity than you have to. "Our first tip is file first, beat the crooks," Velasquez said.

• Don't let your guard down. Identity protection is a year-round necessity, not just at tax time or tax extension time. Monitor your credit reports and every bank and credit card statement you receive for any unusual activity, such as transactions or accounts you don't recognize.

• Beware of the fake taxman. Authorities report a growing problem with individuals posing as IRS agents and calling or emailing taxpayers demanding information. Just hang up or hit delete, because it doesn't work that way, the agency says. "The IRS doesn't initiate contact with taxpayers by email to request personal or financial information," the agency says. "This includes any type of electronic communication, such as text messages and social media channels. The IRS does not call taxpayers with threats of lawsuits or arrests."

If you are a victim of identity theft, or even if you think you might become one because your wallet or computer was stolen, take action right away. That includes contacting the IRS along with your bank and credit card companies. In fact, you may want to contact the IRS first. You'll be directed to file IRS Form 14039, the identity theft affidavit, among other steps. Many taxpayers will be issued an identity protection PIN to be used when filing your taxes so the IRS can be sure it is really you.

In addition, the Federal Trade Commission offers its own checklist:

File a complaint with the FTC at identitytheft.gov.

Contact one of the three major credit bureaus to place a fraud alert on your credit records:

• Equifax, www.Equifax.com

• Experian, www.Experian.com, 1-888-397-3742

• TransUnion, www.TransUnion.com, 1-800-680-7289

Contact your financial institutions, and close any financial or credit accounts opened without your permission or tampered with by identity thieves.

Velasquez offers another tip. It won't prevent identity theft, but can minimize the damage if you are hacked.

"Structure your withholdings so that you aren't relying on a refund coming back to you," she said.

In other words, see to it that the government is taking as little as possible in taxes from your paycheck every week. That is also good financial advice, by the way. If you are getting a big refund, it means you gave that money to the government as an interest-free loan when you could have been investing it yourself. (Be sure to contact a tax professional, though, because having too little withheld could cost you a penalty.)

The IRS says it is taking new steps this year to combat the crime, including sharing more data with state taxing authorities, and adopting tougher password requirements for tax software accounts.

But in the end, it comes back to you. Guard your identity, because the next hacker may be coming for you.

See how the feds finally caught The Hacker, Daniel Rigmaiden, on an ALL NEW "American Greed," Thursday Aug. 25 at 10pm ET/PT on CNBC Prime.

More From CNBC

• Top News and Analysis
  

• Latest News Video
  

• Personal Finance