The federal government’s stimulus checks were designed to help people just like Krystle Phelps from Owasso, Okla.
She and her husband Christopher, who have two children, recently lost their income after Oklahoma closed the bars near Tulsa that they cleaned and supplied with vending machines. But when Ms. Phelps, 33, went to I.R.S. website To check the status of her family’s economic funds, she learned that someone else had filed taxes on her husband’s behalf and used his identity to receive the $ 3,400 payment.
“I cried all day,” said Ms. Phelps, who is about a month from unable to pay her mortgage and cut out everything but the basics, canceled cables, and snacks for the kids. “It’s a little relief, and then you find out that it doesn’t happen.”
“I’ve been in the field for over 30 years and haven’t seen anything like it in my entire career,” said Eva Velasquez, executive director of Identity Theft Resource Center, a nonprofit organization in San Diego that helps victims. “The scale, scale, speed and efficiency of the scams are breathtaking.”
Over the past few weeks, criminals have used people’s social security numbers, home addresses, and other personal information, many of which have been available online due to past data breaches, to impersonate them and get them out of their business cycle tests and unemployment benefits. As a result, overall traffic to Ms. Velasquez’s organization, including calls, emails, and visits to her website, was 850 percent higher in March than a year earlier, she said, and is still increasing.
The scale of the fraud was enormous, fueled by the economic crisis and the confusion surrounding the $ 2 trillion stabilization plan this president trump revealed last month. This was compounded by the lack of government security measures for those applying for economic stimulus payments, as the I.R.S. Website to get their checks that just need to enter some information that scammers can easily get.
The Federal Trade Commission recently reported that it had received four times as many complaints of identity fraud in the first weeks of April as in the past three months combined. And law enforcement officers issued Warnings about the discouraging ways in which criminals can exploit the corona virus.
Even before the outbreak, the losses from identity theft were enormous. criminal made around $ 16.9 billion According to the data company Javelin, this was the highest figure in the past half decade.
Many people’s personal information is easily accessible to hackers who have been composed of dozens of data breaches in recent years. Last month, Experian, the credit bureau, found a new amount of stolen data for three million people that contained all of the personal information a fraudster would have to submit for their stimulus checks.
The corona virus has made it even easier for fraudsters to get more information. Many bombard Americans with emails and phone calls that use the uncertainty surrounding the virus to spread malware and get people to reveal their banking information and other data that can then be used to defraud the same people. Google said it Intercepted 18 million such emails last week.
Now criminals are using these treasures of information to get their hands on the checks the federal government is sending to needy Americans. In the past month, more than 22 million people have Applied for unemployment benefit.
The economic stimulus programs are expected to go to around 150 million people separately. While the finance department electronically deposited the money for around 80 million people who deposited bank accounts with the government, the I.R.S. created an online portal for the approximately 70 million other recipients who had not saved this information.
Through the portal, users can enter a new bank account address through which the government can send their money. However, only a few data are required for the check: a social security number, an address, a telephone number and a date of birth.
Security experts said that the I.R.S. would have opened the door to fraud by using so little data to claim the money. “The stimulus site is a little bit like ringing the bell for hackers,” said Brian Stack, vice president of Dark Web Intelligence at Experian.
The I.R.S. did not respond to the request for a comment.
In forums on the Darknet, where criminals gather to buy and sell identity information and discuss tactics, fraudsters have openly discussed the opportunities offered by economic funds and unemployment benefits.
“Just a little warning, if those $ 1,200 fall into your account, keep your eyes open because I’m here for it! lol, ”said a message in a thread earlier this month about the stimulus checks found by security firm Sixgill.
According to security firm Check Point, 4,305 malicious website domains were set up last month to take advantage of people looking for new forms of government support. The fake websites with names like whereismystimulus and 2020 Relief Program generally ask people to enter their personal information with the promise that they can get information about their checks. But hackers then use the data against those who fall for the trick.
“This is El Dorado for hackers and hell for the victims,” said Adam Levin, founder of CyberScout, a company that helps companies protect and deal with identity theft.
Unlike many previous victims of identity theft, which were often randomly hit, those who are now under attack especially need the money.
Colin Chaplain, 21, of East Bridgewater, Massachusetts, found that he had lost his unemployment benefit to a fraudster the day after his month-long leave from his construction job that month. He made the discovery when he logged on to the state website to create a new profile and claim unemployment.
To his surprise, the website replied when he entered his social security number: “Welcome back.” It also showed the last two letters of the street name of the person who had already applied for their check, he said.
Mr. Chaplain has been waiting for more than 10 days for a police report that he needs to initiate the correction at the employment office. He said he had trouble getting through.
“I just let it ring and two hours pass and nothing,” Chaplain said, adding that he only had enough savings to get him through the next few weeks. “I don’t know what else to do.”
19-year-old Cortlyn Taylor, who lives in Fishers, Indiana, also tried to get help after she was fired from her job at Walmart last month. When she applied for unemployment benefits, she learned that an identity thief had hit her. At the I.R.S. On the website, she found that the same person had received the $ 1,200 stimulus check they needed to pay their rising bills.
In the past few weeks, Ms. Taylor has been trying to get an answer from the I.R.S. After hearing nothing back, one day she drove 10 hours to all three I.R.S. Offices in Indiana where she still couldn’t find anyone to help them.
Ms. Taylor lives with her 56-year-old mother, who is not working and has recovered from the corona virus. On Tuesday, Ms. Taylor said her checking account had dropped to $ 4.
She said the local police told her that they heard from many other people in the same situation. With all the backlogs and closed offices, the speed at which identity theft cases are usually resolved is likely to be even slower.
“I have to pause everything somehow,” she said. “I can’t get a car on my behalf as I planned. I won’t be able to do a lot of the things I planned.”