" />

Uncle Sam doesn’t accept excuses for late tax returns,and neither do state governments. However, it seems both entities are going to be late with tax returns processing—and hence, the issuance of refunds—this year, data security specialist Brian Krebs reported in his Krebs on Security blog. The delays, Krebs said, stem from “more stringent controls enacted by Uncle Sam and the states to block fraudulent tax refund requests filed by identity thieves.” Complicating matters are the aftermath of a spate of corporate data breaches involving “phished” W-2 information and increased use of professional services to process large numbers of phony tax returns.


Krebs said the above-mentioned problems are spurring the IRS to take up to three times longer to review 2015 tax returns compared to past years. Meanwhile, he quoted Julie Magee, commissioner of Alabama’s Department of Revenue, as attributing much of this year’s delay at the state level to new “fraud filters” put in place with Gentax, a return processing and auditing system used by about half of U.S. state revenue departments. If the states cannot outright deny a suspicious refund request, Magee told Krebs, they will very often deny the requested electronic bank deposit and issue a paper check to the taxpayer’s known address instead.


“Many states decided they weren’t going to start paying refunds until March 1, and on our side we’ve been using all our internal fraud resources and tools to analyze the tax return(s),” Magee said.

The fraud filters work by seeking out patterns known to be associated with phony refund requests. Such patterns are related to the speed with which a given return was filed, or whether the same Internet address was seen completing multiple returns. Some states have reportedly been adding new fraud filters nearly every time they hear about another significant breach involving large numbers of stolen or phished employee W2 data. The theft of employee W2 data through phishing and other methods, Krebs wrote, has been a persistent problem this tax season, with myriad companies of all sizes forced to disclose data breaches in recent weeks.

As a result of the different breaches, individual states and the IRS alike have also been taking extreme measures to repeatedly filter tax returns. Whenever there is news of an additional breach, they begin the process anew, re-programming fraud filters as well as re-assessing tax returns that have yet to be fully processed and those that have not been processed at all. 

It looks like it’s going to be a very interesting remainder of the tax season—and beyond. Stay tuned.