Identity Thieves Earn Cyber Cash, Stick Victims With Tax Bill
SAN FRANCISCO (KPIX) -- Imagine getting a bunch of tax documents telling you and the IRS about a large sum of money you made when, in fact, you never received a penny of it.
Why? Because someone stole your identity and used it to collect a big chunk of change, leaving you with the tax liability.
One Bay Area viewer has been living with this nightmare for the past five years with no apparent relief.
"It should be fairly straightforward for them to try to identify who the perpetrators are," said Richard. (KPIX agreed not to use his last name.)
Richard works full time as an investment banker at a major financial institution.
His ordeal began in 2017 when he got tax documents reporting money he supposedly received from a big tech company.
"Starting In 2017, I started receiving these 1099s from Google and I never worked for them. It was very suspicious," he explained.
Richard's identity had been stolen. He notified Google and federal authorities.
Google voided the tax reports. Even so, the 1099s keep coming.
"It's frustrating. I mean I can't even count the number of hours that I've spent trying to deal with this every year," Richard said.
Every year at tax time, Google sends Richard multiple 1099 reports that are mostly for miscellaneous income. He told KPIX that he is then forced to contact Google to void them.
The 1099s are mailed to an old address where relatives live. This year was by far the worst.
"They sent me seventeen 1099s," said Richard, gesturing toward a pile of documents.
We asked Richard about the grand total supposedly paid to someone who was using Richard's stolen identity.
"Over the last five years, around $100,000," he said.
The income is from advertising revenue provided by one of Google's programs known as AdSense.
If you agree to host ads on your website, you can earn money from the company. Someone using Richard's stolen identity signed up for the service and created multiple accounts. No taxes were withheld.
"My worst fear is just that there's all this income reported under my social security number and I actually didn't earn it, right? And the IRS comes after me a few years from now, audits me and says 'Hey, there is all this income you failed to report and you owe taxes on it,'" Richard said.
Richard is not the only victim.
"This 1099 had all of my credentials on it. I didn't put the credentials in. Somebody else did and scraped the money into their own account," said Patrick Reames, an expert in the energy and commodity trading industry..
Reames is founder and managing partner at Commodity Technology Advisory. The company provides expert analysis of commodity trading and risk management and technology market issues and trends.
He is a credited author on Amazon who writes textbooks about software. The books are sold online and generate a few hundred dollars a year.
Reames told KPIX that, in 2018, he got a 1099-MISC tax form from Amazon.
On it, the technology company reported to the IRS that it paid Reames a lot of money -- by his account tens of thousands of dollars.
The author went online and discovered someone was impersonating him and selling a very expensive paperback book for more than $500 a copy.
He took the online sneak peek inside the book and was surprised.
"It was just essentially computer-generated gibberish," Reames said.
He called Amazon for assistance. He told KPIX that the company told him it would not correct his 1099 because it could not prove that it was fraud.
Reames then asked Amazon to inform him which books the money was associated with or where Amazon sent the money. Amazon declined.
He too is very frustrated.
"I was stuck with a tax bill and received none of the royalties through some sort of identity theft," Reames said.
KPIX contacted a variety of federal authorities about the issue. None provided any statistics, however, one cyber security expert fears it's more common than not.
"Who knows how big this 1099 problem is? I think it's just the tip of the iceberg," said cybersecurity expert Andrew Grotto.
Grotto directs the program for geopolitics, technology and governance at Stanford University.
He was senior director for cybersecurity policy at the White House in both the Obama and Trump Administrations.
Grotto explained that tech platforms by their nature make it easier for criminals to maneuver and commit fraud.
"Some of it is the anonymity. Another part of it is the sheer vastness of the ecosystem that the platforms create and, you know, keeping tabs on every single transaction, every single app that's active on the platform is really, really hard," Grotto said.
KPIX contacted both Amazon and Google. They provided the following statements:
"We have measures in place to enforce our publishing guidelines and promptly investigate any reported issues."
-- Amazon spokesperson.
"Our policies and terms of service prohibit AdSense users from operating multiple AdSense accounts or providing inaccurate or fraudulent personal and payment information. After a review, we have disabled all AdSense accounts we believe are falsely affiliated with the viewer, for being in violation of our policies and terms of service."
-- Google spokesperson.
We asked both companies very specific questions about what happened to Richard and Patrick Reames, including whether the companies have ever been contacted by law enforcement, what obligations they have to prevent use of stolen identities on their platforms and what steps they take to assist individuals who have been victimized by identify theft on their platforms. They did not answer those specific questions.
Google did not directly answer if Richard would continue to receive 1099-MISC forms from them every year.
We showed the statement to cybersecurity expert Grotto for his opinion about whether Richard's nightmare was over.
"It doesn't seem like it is, no," Grotto replied.
We showed Google's statement to Richard. He was disappointed.
"I'm not confident that what they've done so far is going to prevent this from happening again," he said.
Richard can't understand why Google can't flag his social security number to stop crooks from using it in the future. He wants Google to catch those who have hacked his identity, are getting paid under his name and leaving him with the tax bill.