FBI probes fraudulent state tax returns made with TurboTax

WASHINGTON - The FBI is investigating cases of fraudulent tax returns filed using TurboTax software.

The probe comes after a number of states, including Minnesota, Utah, Alabama and Georgia, reported a spike in potentially fraudulent tax returns being filed by scam artists attempting to steal tax refunds. State tax authorities investigating the fraud say it's too early to know whether the personal information was pulled from TurboTax or another database, but some states say it's clear the fraudsters had access to 2013 returns.

As first reported by The Wall Street Journal, the agency is working to determine whether a data breach allowed scam artists to obtain the personal information used to file the returns. It is trying to figure out whether the personal information was pulled from TurboTax or another source, the Journal reported, citing a person familiar with the case.

Several states have introduced new security measures in recent days while insisting that their own systems have not been breached. As many as 19 states may have been affected.

"We got a bigger spike than we normally get this time of year," said Charlie Roberts, spokesman for the Utah State Tax Commission, which as of last week had identified 8,000 potentially fraudulent returns, a number he says has grown. "The common thread in that was TurboTax."

Jeff Parish, who does marketing for a Virginia credit union, was surprised when he signed on to his TurboTax account over the weekend to prepare his tax return and found a message on the website congratulating him because the Internal Revenue Service had accepted his federal tax return.

Parish told The Washington Post that he had learned that someone had signed on to his account and filed a return about a week before, claiming a refund of roughly $5,000 - much larger than the $200 he normally receives - and directing it to be deposited to a reloadable debit card. Now, he must file on paper.

State tax authorities have held conference calls and are sharing information with one another to make it easier to spot bogus returns, said Gale Garriott, director of the Federation of Tax Administrators. The additional security measures may delay tax refunds.

Kentucky, for instance, says that after it temporarily stopped issuing refunds, state tax refunds could take up to 14 business days to be delivered, up from seven to 10 business days.

Last week, TurboTax stopped submitting state tax returns for about 24 hours while it investigated a rise in "suspicious filings" made using its software.

After looking into it, Intuit, the parent company for TurboTax, said that it did not think the fraud resulted from a breach of TurboTax's systems and that the personal information was obtained elsewhere. Intuit spokeswoman Julie Miller said Wednesday that the company was aware of the FBI investigation but added that "to the best of our knowledge, Intuit is not the target of that investigation."

The company also said last week that federal tax returns were not affected and it did not stop submitting those returns. But some state tax authorities reported seeing cases of fraudulent state and federal tax returns that appear to have information pulled from 2013 returns.

The IRS says it "added and strengthened protections in our processing systems this filing season to protect" taxpayers and prevent fraud.

But some improvements to the tax agency's identity-theft program were put off because of budget cuts, IRS Commissioner John Koskinen said last week in prepared remarks to the Senate Finance Committee. "This means, among other things, that aging IT systems will not be replaced and new taxpayer protections against identity theft will be delayed," he said.