Tough tax season for victims of Social Security hack

Crooks stole their benefits, but the victims received 1099s for reportable income

By Mary Beth Franklin

Feb 16, 2018 @ 11:05 am EST

As if discovering that someone fraudulently claimed Social Security benefits on your account wasn't bad enough, victims of recent identity theft now have to contend with another bureaucratic headache: 1099 forms documenting reportable income they never received.

Several readers wrote to me with their harrowing tales of ID thieves applying for benefits in their name, usually collecting the maximum allowable lump-sum payment of six months of retroactive benefits in the process.

Although the victims reported the thefts to the Social Security Administration, they now have to contend with the messy aftermath: contesting the tax forms they received reporting Social Security benefits that were paid out on their earnings record.

Up to 85% of Social Security benefits can be taxed at ordinary income rates. Taxable Social Security benefits can increase the amount of interest and dividend payments that are subject to capital gains taxes and can trigger higher Medicare premiums, which are based on income.

Calls to both the Social Security Administration and the Internal Revenue Service asking for guidance on how victims of ID theft should deal with the erroneous 1099 forms during the current tax season were not returned by the time of publication.

James Shambo, a retired CPA who has been included in lists of best U.S. financial advisers multiple times by both Worth magazine and Bloomberg, asked me to share his personal tale of hacked Social Security benefits and tips to help other identity theft victims mitigate the damage.

"After decades of helping my clients navigate and manage these important decisions, imagine my surprise when I received a letter in the mail shortly after my 67th birthday congratulating me on initiating my Social Security benefits," he wrote in a guest blog for the American Institute of CPAs.

"The trouble was, although I had entered the glory years of retirement, I had not yet applied for Social Security benefits, opting to wait until age 70 to receive my benefits," he wrote. "Further digging uncovered the unfortunate fact that a thief had received $19,236 of my benefits. I was dumbfounded."

Mr. Shambo suggested that theft of Social Security benefits of people who have reached full retirement age but who have not yet claimed benefits "may be the fastest rising fraud in the government" and urged me to spread the word among my readers.

"Do not think things are resolved by calling SSA," Mr. Shambo warned. "You must go to your local office and provide a written statement of the fraud.

"And don't forget to get copies of your statement that you make to them in writing and any printout from them showing your SSA account has been deactivated," he said. "In the meantime, you cannot set up a new account at, meaning you live in the dark."

The biggest problem is SSA has another site outside of MySSA that allows a person to apply for benefits.

"Whoever applied for my benefits appears to have used this site, which is not linked to my secure data on MySSA," Mr. Shambo said. "This is totally absurd and is a back door to fraud."

"Don't look for a letter to correct a 1009-SSA," he warned. "You must go to the local office to initiate the paperwork to get a correct 1099. As a retired CPA, I can tell you the only way to get the IRS to agree you do not have SSA income is to get a revised 1099. A letter is useless."

Mr. Shambo said he has visited his local Social Security office three times, the last time to address the issue of the 1099 form. "They have assured me I will get the revised 1099 by Feb. 25 — one month from my last visit." He promised to update me on his status.

"Of course, I can't file my tax return and then amend it as that would put me squarely in the eyes of Medicare premium surcharge territory," he lamented.

"So far, my three trips to SSA have cost me 10 hours of time and I really don't know yet if they will get it right," he said. "And who knows what they will say three years from now when I actually apply for benefits."

Consider this a cautionary tale for retirement age advisers and clients: Set up an online Social Security account to get estimated benefit statements and monitor it frequently. If you discover someone has fraudulently claimed benefits on your account, notify Social Security immediately — and buckle up for a bumpy ride.

Join the Discussion

Most Popular

Affluence Influencers