Update: Most unemployment benefits won't be taxed thanks to the new COVID relief package.

Millions of people who did not apply for state unemployment compensation last year—and did not get any money—are now dealing with the consequences of being identity theft victims.

Cybercriminals used stolen credentials to file fake unemployment claims, got the money, and left their victims stuck with the tax liability.

Until they received an unexpected 1099-G (Certain Government Payments) tax form in the mail—from one or more states—many victims had no idea bogus claims were filed in their names.

“When the criminals were filing these fraudulent unemployment claims, all communications from the states were going to the bogus emails they’d set up,” said Amy Nofziger with the AARP Fraud Watch Network. “But the 1099-G forms were sent to the legitimate mailing address of the victims. That's why a lot of people didn’t find out they were victimized until they got this tax form in the mail.”

Many people who’ve called the AARP Fraud Watch Network Helpline (877-908-3360) are “confused, because they know they didn't file for unemployment, and many of them have been retired for years,” Nofziger told Checkbook.

James, a retired engineer in Cleveland, was caught off guard when he received a 1099-G from Ohio’s Department of Job and Family Services showing he had been paid $3,200 in unemployment benefits.

It was “creepy and upsetting,” James told Checkbook. Now he worries about explaining to the IRS that he did not receive this money. “It’s taken a lot of time and emotional energy to deal with this,” he said. “Aside from the monetary threat, it’s just very aggravating.”

Billions Stolen, Millions of Taxpayers Affected

We still don’t know exactly how much state unemployment compensation the ID thieves have stolen, but it’s unprecedented. According to a report from the Labor Department’s Office of Inspector General released on Feb. 3, at least $63 billion in unemployment program funds could have been “paid improperly, with a significant portion attributable to fraud.”

For reference, $63 billion is more than the Department of Homeland Security’s budget ($54.9 billion) for fiscal year 2021.

Cybersecurity expert Blake Hall, co-founder and CEO of ID.me, believes the total heist was significantly more than $63 billion. His company is currently working with 21 states to reduce unemployment fraud.

Based on the data he’s seen, Hall believes the country lost at least $200 billion in pandemic unemployment assistance fraud. Hall told Checkbook at least 10 million Americans had their compromised identities used to steal this money.

“This is the largest cyber-attack in terms of fraud in American history,” Hall said. “You've had chronically underfunded workforce agencies that have 1980s technology. And then you have the pandemic unemployment assistance program, where there's no cross-referencing against employers about whether or not you're employed. You can literally take anyone's identity and turn it into tens of thousands of dollars. And so, every organized crime ring in the world is focused on these workforce agencies.”

California appears to be the hardest hit state, with fraud losses topping $11 billion, according to a report last week by the Associated Press.

What to Do When You Get an Erroneous 1099-G

If you received a 1099-G for unemployment benefits you did not get, you need to contact the appropriate state agency and request a corrected form that shows you did not receive any money. Because unemployment benefits are taxable income, the IRS gets a copy of that form.

Unfortunately, getting that corrected form may be a challenge. The state agencies that handle these claims are often understaffed and overwhelmed with the volume of fraud cases. And it’s not easy to find the status of your request for help.

Last May, when Reagan Dunn learned his personal information had been used to claim unemployment benefits, he filed a fraud report with the Washington State Employment Security Department. And yet, he still received a 1099-G form from the state in January showing that he had received $7,000 in benefits, which had been reported to the IRS.

“I was horrified,” he told Checkbook.

Dunn went online and filed an imposter report. That was Jan. 28, and he is still awaiting a response. Dunn filed his return, without reporting the benefits, and crossed his fingers.

“We risk being audited,” he said. “My wife and I are buying a home right now and we need that refund money for our downpayment. So, we’re just on a wing and a prayer that the IRS takes the return at face value.”

Dunn did the right thing. “Taxpayers who are unable to obtain a timely, corrected 1099-G form should still file an accurate tax return, reporting only the income they received,” the IRS explains in a news release.

You do not need to file an Identity Theft Affidavit (Form 14039) with the IRS regarding an incorrect Form 1099-G. The identity theft affidavit is used when a return filed electronically is rejected because a return using the same Social Security number was already filed.

But My Credit File Was Frozen, How Did the Crooks Do This?

Victims of identity theft often turn to the Identity Theft Resource Center (ITRC) for help. Eva Velasquez, ITRC president and CEO, says callers who’ve gotten an erroneous 1099-G “are really angry” because they can’t understand how this could happen.

Some wonder why freezing their credit files at the big three credit bureaus didn’t stop the fraud. While a security freeze can prevent some financial fraud (such as opening a new credit card in your name), it cannot stop criminals from stealing government benefits because a credit check is not required. If the fraudsters have your name and Social Security number, they can file a bogus claim for unemployment benefits. Unfortunately, you can do all the right things and still be the victim of identity theft.

What Victims Should Do to Prevent Future Hassles

A thief who has enough personal information to apply for unemployment benefits in your name might be able to access your financial accounts, so keep an eye on them. If you spot a problem, report it immediately. It would also be a smart move to change your passwords on those critical accounts.

Other things you should do:

• Request an Identity Protection Pin (IP PIN) from the IRS. This six-digit number, which only you and the IRS know, prevents someone else from filing a tax return electronically or by mail using your Social Security number.
  
  “The IP PIN is one of the most robust preventative steps you can take against tax ID fraud,” Velasquez told Checkbook. “It's not a panacea, but it's a great way to add a layer of security to your IRS tax filings, which have been a lucrative pathway for thieves.”
  
  In the past, the IRS would only issue an IP PIN to confirmed identity theft victims. Now, anyone can request one.
   
• Get a copy of your credit reports from each of the big three credit bureaus—Experian, Equifax, and TransUnion—by going to AnnualCreditReport.com. Look for anything suspicious, such as a new credit card that you didn’t apply for, or a checking account you didn’t open. By law, you are entitled to a free copy of your credit report every 12 months. Now through the end of April 2022 you can get one every week for free.
   
• Freeze you credit reports. If you’ve already done this, pat yourself on the back. If not, request a freeze from each credit bureau: Equifax, Experian, and TransUnion. A security freeze locks your credit file, so a criminal cannot open new financial accounts in your name.
   

A New Threat: Fake Unemployment Benefits Website

Just last week, the Justice Department warned that fraudsters are now “creating websites mimicking unemployment benefit websites,” including state workforce websites, in order to capture people’s personal information.

The fraudsters are pretending to be from these state agencies and sending spam text messages and emails that urge recipients to click on a link to apply for unemployment benefits. That link connects to the bogus website run by the scammers, the DOJ cautioned.