State IT leaders review Ponemon's 2018 Cost of a Data Breach study
September 21, 2018
Government agencies have lower data breach costs, but something less replaceable than cash at risk.
Officials say fraudulent claims fell off quickly after new technologies took the state off attackers' easy-target list.
Colin Wood is the managing editor of StateScoop. Before that, he was a staff writer for Government Technology magazine. Before that, he taught Engl...
With tax season comes attempted fraud, as crooks use false identities to try to trick all levels of government into sending them refund checks. There are ways to fight back, though, and Indiana is one of the states showing how analytics and other tools can make a big difference.
Adam Krupp, commissioner for the the state's Department of Revenue (DOR), told StateScoop that since Indiana heightened its vigilance in 2014, criminals have gotten the message. The state began using fraud monitoring software that year, catching $88 million in bogus refunds. This year so far, it has caught $1 million worth, as attempts have dwindled. The state reports a 97 percent reduction overall in tax fraud.
"The drastic drop we like to say is because folks are deterred now and they're not trying to penetrate the system or file fraudulent systems like they used to, because they're not successful. So they're packing up and moving somewhere else," Krupp said.
Protecting tens of millions of dollars annually makes a noteworthy difference for a state government whose annual budget hovers around $30 billion. Krupp said he wasn't with the state when it first began its partnership with LexisNexis Risk Solutions, Indiana's fraud monitoring vendor. He's still amazed by how much fraud went through undetected before 2014.
"My initial thought is, 'Wow, that's a lot of money,'" " Krupp said. "And then I think, 'How much was it the year before?'"
Many state and local governments have been shoring up their fraud defenses in recent years. Chicago's Cook County, Illinois has saved tens of millions with its software. In 2016, the State of Maryland began refining its analytics for a more accurate hit rate that eased the workload carried by its staff.
But for states that aren't using advanced monitoring, Krupp said it's time to bite the bullet. Indiana signed a three-year agreement with LexisNexis that would cost the state up to $15 million.
"If you don't have this tool or don't have one similar, you may have no idea of knowing how much money is going out the door that your state could be losing out on," he said.
Indiana's tool works by using analytics to detect abnormalities. A return with something suspicious or even just different than a past year could lead to additional screening. The state also added an additional layer consisting of an identity verification quiz. Those selected for additional screening receive a letter in the mail explaining that they must answer a four-question quiz — the same kind commonly used by banks or creditors.
The challenge states face is vast — Krupp said that for fraudsters, it's "a volume effort." They file as many fraudulent returns as they can and if just one goes through, they've made an easy buck. Many of the attacks are from overseas, he said, which is one of the ways they detect abnormalities — disparities between the filer's location, his supposed address and the bank's address that is to accept the return could indicate fraud.
Indiana sees two main types of fraudulent returns, Krupp said — creating a fake identity and filing a claim on it, and stealing someone else's identity and requesting a direct deposit. Some people also request funds on prepaid credit cards. But there are many more types of scams, as revealed regularly by the IRS — phishing, phone scams, identity theft, unscrupulous tax return preparers, fake charities, abusive tax shelters, and offshore tax avoidance are just a few techniques.
For many filing fraudulent claims, it's akin to a computer hack, but instead of hacking an old or vulnerable computer system, they're gaming an antiquated process with minimal oversight by a state government that has fallen behind on its technology.
In Indiana, two in-house LexisNexis workers help the state run the system and ensure that when bad actors come, they see Indiana's defenses and head elsewhere.
"It comes at a cost, but the return on the investment is exponential," Krupp said. "We've saved over $110 million since 2014. I can tell you we have not spent that much to prevent it going out the door."