Possible Data Link or Proseries hack?

[Bavic74]

Hello all,

We have experienced a large sample size of clients that have gotten the 5071C Notice. This is the notice that requires the client to confirm if they did in fact file a return because the IRS received a return with the clients SS#.

If we did file the return for the client we need to create an online account to confirm we did in fact file the return. If we did not file the return we need to go to the IRS.gov/VerifyReturn link to let the IRS we did not file a return.  If this is the case the return needs to be filed manually.  

We have had a larger than what we would consider normal amount of these notices sent to our clients.  

Has anyone else noticed a larger than normal amount of these notices going to their late filing clients?

[Just-Lisa-Now-]

Ive seen preparers in other groups mention theyve seen a higher than normal number off these 5071C notices, I havent had any of my clients call about this though, so I dont think its software related.

You may want to log into your PTIN account and make sure the number of returns IRS shows being filed by your EFIN you seems correct, just to make sure you dont have a problem on your end.

[Bavic74]

thanks for this idea. I just checked and the PTIN site matches the # of returns we have filed.  So it seems like it is something else.  

Do you have any other suggestions? Calling IRS/ProSeries to ask more about this?  Not sure what else to do to find out what is going on.

Thanks again.

[Just-Lisa-Now-]

Were these clients ones that had large refunds or refundable credits? 

The only clients Ive had that got hit with ID verification were ones that made estimated payments that we missed on the return and those ES payments created overpayments with large refunds.  But I know its common with returns that have large refundable credits as well.

[Bavic74]

these were for clients that had not been filed yet actually. Oddly enough all of them actually owed for 2023.  The only thing they all had in common was that they had not been filed yet through our office.  That is why were wondering if there was some type of data leak. That someone just filed a ton of returns and the rest that had been filed were rejected and the ones that had not been yet got through but the IRS somehow caught them and sent out the notice.  

[Accountant-Man]

There are groups of hackers out there that hack into Pro Series, set it up on their PCs, then copy client files and file fake returns with refunds.

The refunds are sent to the hackers' bank.

I assume this only works with not-yet-filed returns.

This happened several years ago with a CPA firm that helps IRS seminars discuss this.

[sjrcpa]

Have you considered the possibility that you/your system has been hacked, as opposed to ProSeries?

[abctax55]

Yikes... that updated info is scary.   As no other PS users are reporting anything similar (yet) I'd be concerned with:

1) YOUR system was hacked.

2) Possible insider job.

[Bavic74]

yes I have considered this. But just recently another client got a notice but for a return that had already been filed by us. So this would push the source to an outside player.

[sjrcpa]

1 out of how many?

[Bavic74]

5 total got letter. 

4 had not been filed, 1 had been filed. 

[sjrcpa]

Those 4 are victims of identity theft.

Do they have anything in common other than being your clients?

5 letters is not high in my opinion - unless you have very few clients.

I haven't seen any of these letters this year. Last year it was about 10. But all of those clients had filed returns.

[Bavic74]

office processes 550 returns.

I agree 5 out of 550 (less than 1%) is not bad. It was the fact that initially all had not filed yet and were my specific clients, vs. another preparer in the office.

[sjrcpa]

Have those 4 clients notified IRS they did not file those returns? That, to me, is a priority.