Fifteen Hillsdale College employees found that someone had submitted fraudulent tax returns to the Internal Revenue Service.
Wikimedia Commons | Courtesy
City and county police are investigating 15 fraudulent tax returns submitted in the names of Hillsdale College faculty and staff.
“It’s very unusual,” city of Hillsdale Detective Brad Martin said. “We’re surprised to have so many affected at one specific location.”
Martin and Hillsdale County Detective Lt. Lance Benzing are investigating the identity thefts, most of which were tax returns filed March 23. The police are attempting to get information from the Internal Revenue Service, but they have not obtained the information yet; it usually takes two to three weeks, Martin said.
“We have no idea how the information that was obtained was gleaned,” Martin said.
The source of the identity theft remains unknown, but the internationally recognized security consultant that Hillsdale College uses saw no evidence of a breach at the college, Aide to the Director of Human Resources Christine Emrick said in an email to faculty and staff April 13.
Chief Administrative Officer Rich Péwé said the college has done some internal investigations of those who have access to this personal information, as well.
“I would never rule out the possibility of some information getting leaked,” Péwé said. “We work pretty hard on our infrastructure and information system security, but we have policies in place for privacy and pretty severe penalties for employees that may abuse that.”
Péwé said the breach could be due to security breaches at the IRS. Since 2014, hackers have accessed data from more than 700,000 U.S. taxpayers from the IRS, according to a report from the Government Accountability Office.
One or two Hillsdale College employees had a problem filing their tax returns last year, Péwé said.
Martin said in the past three years, a few members in the community have had some problems with filing their tax returns, but the potential of having 15 complaints is unusual.
Péwé said Hillsdale College could be a target because it is the largest employer in Hillsdale County, and Martin said he has heard of other colleges that have had similar problems with tax returns.
In 2015, hackers did breach Anthem Blue Cross Blue Shield, Hillsdale College’s health care provider at the time, but the individuals who had their information stolen then did not overlap with those who had problem filing tax returns this year.
Those who had problems with their tax filing, such as Professor of Theatre George Angell, had to contact the IRS to file an identity theft affidavit and a paper tax return. Next year, they will receive a personal identification number to use in the future.
Angell submitted his tax return via TurboTax April 10. When it failed to submit, he rechecked his form and found no errors. He contacted TurboTax, and a representative informed him 99 percent of errors occur from mis-entered numbers.
Angell said he later phoned the IRS, and after an hour on hold, a “very nice and helpful” agent informed him that someone had already filed a joint tax return in his and his wife’s names on April 8. The submission included a fake W-2 tax form from Hillsdale College for him and his wife, who is not an employee of the school.
“I don’t know what they claimed we earned, but they certainly claimed a refund,” Angell said. “For my own part, I owed a little money. No refund for me.”
Whoever filed Angell’s tax return had his social security number and home and work addresses. He said he put out an extended fraud alert on his credit reports so that he will get a phone call to verify the transaction is his when anyone applies for credit in his name.
“The real worry is that these people could apply for any kind of loan, mortgage, credit card, car loan, or anything else in my name, since they have all my pertinent information,” Angell said. “This is the scary part.”
In other words, “they have the keys to the kingdom,” identity theft and scam expert Rob Douglas said. He also recommended the victims change the passwords to their accounts and look into doing a security freeze of their credit account with the three major credit reporting agencies — Equifax, Experian, and TransUnion — so that no one can take credit out in their name without first unfreezing it.
Péwé said he was unaware of any students that had problems with filing tax returns.
One or two of those with fraudulent tax returns also had social security filed under their name, Péwé said.
“Sometimes they hold onto this information and use it several times,” Péwé said.
Three people also have had problems with their Health Savings Accounts at County National Bank. One did have money taken from the account while two noticed some “weird activity,” like a charge of one cent as though someone were planning to use the HSA debit card, Péwé said. This, he said, allowed the employees to cancel their card and get a new one before further damage could occur.
Although HSA debit cards are usable like any other debit card, medical frauds can affect the information doctors have on patients, too.
“It creates a false medical record for the true person,” Douglas said. “There could be something on there about allergies that’s incorrect or medications that’s incorrect.”
The HSA identity theft does not appear to relate to the fake tax returns, Péwé said, adding that not everyone who had a fraudulent tax filing has an HSA card. Not every person who had troubles with the HSA cards also had problems with submitting tax returns, as well.
“Because of the nature of the information you need for filing, I’m not sure the two things are connected, but you never know,” Péwé said.
Péwé said when instances like this occurs, administrators notify college employees via email.
“If you have information that would be helpful to other people, you want to notify other people,” Péwé said.
Péwé would not disclose the name of the security group that works for the college but said they do regular, random tests to ensure security.
Looking forward, Péwé encouraged people to check their credit and debit card accounts and credit reports regularly.
Martin agreed and added that if someone notices something, they should contact the business involved in any false transactions or credit card accounts, file a report with a credit reporting agency, and complete a police report.
