Mass. suspends refunds over fraud, ID theft

TurboTax is working with security company Palantir to investigate the problem.Associated Press/File

Massachusetts and Vermont state officials said Friday that they temporarily halted most tax refunds following widespread reports of identity theft and fraud tied to the country’s most popular tax preparation software, TurboTax.

The Massachusetts Department of Revenue said it is holding about 160,000 tax returns claiming refunds, which will undergo further scrutiny to ensure that the money is going to taxpayers rather than thieves who steal personal information to file false returns. In Vermont, more than 8,600 returns have been stopped in the pipeline.

The suspension of refund payments affects both paper and electronic returns. Tax officials in both states said they hope to send the refund checks out sometime next week.

“We want to minimize the impact to taxpayers,” Massachusetts Revenue Commissioner Amy Pitter said. “But it is essential that we take the necessary precautions to protect taxpayers and reduce the cost of fraud for the Commonwealth.”

The drastic step by Massachusetts and Vermont came as TurboTax, made by the California software firm Intuit, temporarily stopped processing state tax returns across the country Thursday. At least 18 states have reported a rise in fraudulent returns connected to TurboTax, primarily used by do-it-yourself filers. About 30 million state returns are filed through TurboTax each year.

TurboTax resumed its processing of state electronic filings Friday night after increasing the security of its system and putting in place multiple levels of authentication to identify users.

Julie Miller, a spokeswoman for Intuit, said most victims learned a fraudulent return was submitted in their name when they received a rejection notice after filing their tax forms. She said similar problems have not occurred with federal returns because the IRS has implemented stronger fraud detection policies.

Intuit, which is working with the global security company Palantir, said it does not believe its systems were hacked to obtain Social Security numbers, names, addresses, and other personal data. Miller linked the problem to recent security breaches at large companies, such as the financial services company JPMorgan Chase and retailers Home Depot and Target.

This week, Anthem Inc. said hackers gained access to the Social Security numbers, names, addresses, and other personal information of about 80 million people. ‘‘You have a pretty rich pool of data out there in the world,’’ said Miller.

Alison Foley, 32, of Boston, who used TurboTax to file her returns, said she always thought her tax and health information were among the most secure data in an environment where large cyber breaches increasingly occur. But last week, Foley, who has Anthem insurance, was notified about that company’s data breach.

Foley filed her state tax return Monday and expects her refund will be delayed.

“Up until now, I never really gave it any thought,” she said. “Now, I’m a little nervous.”

Tax fraud, using stolen Social Security numbers and taxpayer identities, is common. The Inspector General for Tax Administration reported last year that the Internal Revenue Service caught 236,313 fraudulent tax returns through the end of April. Last year, Massachusetts stopped $25 million in fraud.

But the volume of suspicious filings so early in the tax season caused many state revenue commissioners to raise alarms this week, eventually leading TurboTax to temporarily stop transmitting state filings.

Dave Karp, a vice president at Digital Guardian, a Waltham cybersecurity firm, said there is no easy solution to the problem. “It’s pretty hard to say what the definitive answer is, to keep this from happening,” Karp said.

Karp suggested that the best defense is to file tax returns early, before an identity thief can do it. “This is a race,” said Karp. “The first one to the end wins.”

In Vermont, Tax Commissioner Mary Peterson said state officials are adding extra layers of screening to identify fraud, so legitimate filings may get greater scrutiny, slowing the process of sending refunds.

In Massachusetts, if officials suspect a fraudulent return, they will require taxpayers to provide additional information to verify their identities before refunds are sent.

“It’s a balance of how quickly we can get the refunds out versus stopping fraudulent returns,” Peterson said. Delays, “are going to be an unfortunate outcome here.”