Law enforcement and the IRS are investigating an apparent tax breach involving University of Northern Iowa employees after some got error messages while filing their tax returns earlier this month.
So far, the apparent fraud has affected 50-plus UNI employees or their family members, said Scott Ketelsen, director of University Relations.
Those affected learned their information might have been compromised when they received error messages while trying to file their tax returns online, Ketelsen said. In follow up phone calls to the Internal Revenue Service, some of the employees were told their taxes already had been filed – meaning someone else did it on their behalf.
Not all of the error messages are suspicious, according to Ketelsen. In some cases, the filer might simply have made a typo in entering a social security number, for example.
“We do think there are some honest mistakes,” he said. “But we don’t have a good feel for how many are the very suspicious type of scenarios where their names are known vs. the honest errors.”
The first reports of possible fraud came on Feb. 6 from individuals struggling to electronically file their tax documents. In the weeks that followed, more folks began alerting UNI officials to the problems, Ketelsen said.
“We became aware of some folks who had filed and had it come back that someone had already filed for them,” he said. “That was a red flag.”
UNI involved the Cedar Falls Police Department and the Iowa Division of Criminal Investigation, who are working with the IRS to find the source of the breach.
“We don’t have any information about where the breach might have been,” Ketelsen said. “We don’t know at this point in time if it’s a Northern Iowa database or perhaps another source of data outside the institution.”
The university uses “many complex encryption protocols at multiple levels to protect sensitive data,” officials reported. And there is no evidence at this time that a UNI system has been compromised.
So far, Ketelsen said, no students have reported being affected by the apparent breach.
“That is really good news,” he said.
Two of the affected UNI employees have reported receiving government-issued tax returns before filing their taxes, according to Ketelsen. The assumption is that someone else filed for them, used a bank and routing number that didn’t match the person’s information, and the system caught the error and sent the check to the correct address, he said.
The entire faculty and staff has been notified of the breach and, in an email sent Wednesday, UNI officials offered one year of credit monitoring service for all employees.
The email provided instructions on how to use the complimentary membership to Experian’s ProtectMyID Alert system, aimed at detecting possible misuse of personal information and providing identify protection support.
“We are being vigilant,” Ketelsen said.
The university also created a website for information on the situation at www.uni.edu/tax-advisory, and an informational hotline at 319-273-5700. Anyone interested in finding out if they’re affected can call the IRS at 1-800-908-4490, ext. 245 between 7 a.m. and 7 p.m. Monday through Friday, according to UNI officials.