The federal government’s stimulus checks were meant to help people exactly like Krystle Phelps of Owasso, Okla.
She and her husband, Christopher, who have two children, recently lost their incomes after Oklahoma shut down the bars near Tulsa that she cleaned and that he supplied with vending machines. But when Ms. Phelps, 33, went to the I.R.S. website to check on the status of her family’s stimulus funds, she learned someone else had filed taxes on her husband’s behalf and used his identity to obtain their $3,400 payment.
“I cried all day,” said Ms. Phelps, who is about a month away from being unable to pay her mortgage and has cut out everything but the basics, canceling cable and eliminating snacks for the kids. “It is a little relief, and then you find out it isn’t happening.”
With the government doling out trillions of dollars to blunt the economic pain of the coronavirus pandemic, these are good times for thieves and dangerous times for those who actually need the money.
“I’ve been in this space for over 30 years and I have not seen anything like this in my entire career,” said Eva Velasquez, the chief executive of the Identity Theft Resource Center, a nonprofit based in San Diego that helps victims. “The scope, the scale, the speed and the efficiency of the scams is breathtaking.”
In recent weeks, criminals have used people’s Social Security numbers, home addresses and other personal information — much of which was available online from past data breaches — to assume their identities and bilk them out of their stimulus checks and unemployment benefits. As a result, calls to Ms. Velasquez’s organization were 850 percent higher in March than a year earlier, she said, and are still soaring.
The scale of the fraud has been enormous, fueled by the economic crisis and the confusion surrounding the $2 trillion stabilization plan that President Trump unveiled last month. That has been compounded by the government’s own lack of security measures for people claiming stimulus payments, with those going through the I.R.S. website to get their checks needing to input just a few pieces of information that scammers can readily obtain.
en four times as many complaints about identity fraud in the first few weeks of April as it had received in the previous three months combined. And law enforcement agencies have issued warnings about the daunting array of ways that criminals are exploiting the coronavirus.
Even before the outbreak, losses from identity theft were enormous. Criminals made around $16.9 billion from identity fraud last year, the highest total in the last half decade, according to the data firm Javelin.
Many people’s personal information is readily accessible to hackers, amassed from dozens of data breaches over the past few years. Last month, Experian, the credit reporting agency, found a fresh batch of stolen data for three million people, containing all the pieces of personal information that a scammer would need to file for their stimulus checks.
The coronavirus has made it even easier for fraudsters to get more information. Many are bombarding Americans with emails and phone calls that use the uncertainty around the virus to distribute malware and get people to divulge their bank information and other data, which can then be used to defraud the same people. Google said it intercepted 18 million such emails last week.
Now criminals are deploying those troves of information to get their hands on the checks that the federal government is sending to needy Americans. Over the last month, more than 22 million people have filed for unemployment benefits.
Stimulus funds are separately expected to go out to around 150 million people. While the Treasury Department electronically deposited the money for around 80 million people who have bank accounts on file with the government, the I.R.S. created an online portal for the 70 million or so other recipients who did not have that information on file.
Sign up to receive an email when we publish a new story about the coronavirus outbreak.
The portal allows people to enter a new bank account address for the government to send them their money. But it requires only a few pieces of data for verification: a Social Security number, an address, a phone number and a date of birth.
Security experts said that the I.R.S. had opened up the door to fraud by requiring so little data to claim the money. “The stimulus site is a little bit like ringing the dinner bell for hackers,” said Brian Stack, the vice president for dark web intelligence at Experian.
The I.R.S. did not respond to request for comment.
On forums on the darknet, where criminals gather to buy and sell identity information and discuss tactics, fraudsters have openly discussed the opportunities presented by the stimulus funds and unemployment benefits.
“Just a little warning that when that $1,200 drops in your account keep your eyes peeled because I am coming for that! lol,” said one message on a thread this month about the stimulus checks that was found by the security firm Sixgill.
Over the last month, 4,305 malicious website domains were set up to take advantage of people looking for new forms of government support, according to the security firm Check Point. The fake sites, with names like whereismystimulus and 2020reliefprogram, generally ask people to input their personal data with the promise that they can get information about their checks. But hackers then use the data against those who fall for the trick.
“This is El Dorado for hackers and pure hell for the victims,” said Adam Levin, the founder of CyberScout, a firm that helps companies protect against and manage identity theft.
Unlike many previous victims of identity theft who were often hit at random, those being targeted now are in particular need of the money.
Colin Chaplain, 21, in East Bridgewater, Mass., found out he had lost his unemployment benefits to a scammer the day after he was put on indefinite leave from his construction job this month. He made the discovery when he logged in to the state website to create a new profile and claim unemployment.
To his surprise, when he entered his Social Security number, the site responded, “Welcome back.” It also showed the last two letters of the street name of the person who had already claimed his check, he said.
Mr. Chaplain has since waited more than 10 days for a police report, which he needs to start the process of correcting things with the unemployment office. He said he’d had trouble getting through.
“I just let it ring, and two hours go by and nothing,” Mr. Chaplain said, adding that he had only enough savings to get him through the next few weeks. “I don’t know what else to do.”
Cortlyn Taylor, 19, who lives in Fishers, Ind., has also been trying to get help after she was laid off from her job at Walmart last month. When she applied for unemployment benefits, she learned an identity thief had beaten her to it. On the I.R.S. site, she found that the same person had grabbed her $1,200 stimulus check, which she needed to pay her mounting bills.
For the past few weeks, Ms. Taylor has been trying to get a response from the I.R.S. After not hearing back, she spent 10 hours one day driving to all three I.R.S. offices in Indiana, where she still could not find anyone to help.
Ms. Taylor lives with her mother, 56, who doesn’t work and has been recovering from the coronavirus. On Tuesday, Ms. Taylor said they were down to $4 in her checking account.
She said the local police had told her that they were hearing from lots of other people in the same situation. But with all of the backlogs and closed offices, she was told, the glacial speed at which identity theft cases are normally resolved was likely to be even slower.
“I kind of have to pause everything,” she said. “I can’t get a car in my name like I planned. I’m not going to be able to do a lot of things that I planned to do.”
The Coronavirus Outbreak
• Frequently Asked Questions and Advice
Updated April 11, 2020
o When will this end?
This is a difficult question, because a lot depends on how well the virus is contained. A better question might be: “How will we know when to reopen the country?” In an American Enterprise Institute report, Scott Gottlieb, Caitlin Rivers, Mark B. McClellan, Lauren Silvis and Crystal Watson staked out four goal posts for recovery: Hospitals in the state must be able to safely treat all patients requiring hospitalization, without resorting to crisis standards of care; the state needs to be able to at least test everyone who has symptoms; the state is able to conduct monitoring of confirmed cases and contacts; and there must be a sustained reduction in cases for at least 14 days.
o How can I help?
The Times Neediest Cases Fund has started a special campaign to help those who have been affected, which accepts donations here. Charity Navigator, which evaluates charities using a numbers-based system, has a running list of nonprofits working in communities affected by the outbreak. You can give blood through the American Red Cross, and World Central Kitchen has stepped in to distribute meals in major cities. More than 30,000 coronavirus-related GoFundMe fund-raisers have started in the past few weeks. (The sheer number of fund-raisers means more of them are likely to fail to meet their goal, though.)
o What should I do if I feel sick?
If you’ve been exposed to the coronavirus or think you have, and have a fever or symptoms like a cough or difficulty breathing, call a doctor. They should give you advice on whether you should be tested, how to get tested, and how to seek medical treatment without potentially infecting or exposing others.
o Should I wear a mask?
The C.D.C. has recommended that all Americans wear cloth masks if they go out in public. This is a shift in federal guidance reflecting new concerns that the coronavirus is being spread by infected people who have no symptoms. Until now, the C.D.C., like the W.H.O., has advised that ordinary people don’t need to wear masks unless they are sick and coughing. Part of the reason was to preserve medical-grade masks for health care workers who desperately need them at a time when they are in continuously short supply. Masks don’t replace hand washing and social distancing.
o How do I get tested?
If you’re sick and you think you’ve been exposed to the new coronavirus, the C.D.C. recommends that you call your healthcare provider and explain your symptoms and fears. They will decide if you need to be tested. Keep in mind that there’s a chance — because of a lack of testing kits or because you’re asymptomatic, for instance — you won’t be able to get tested.
o How does coronavirus spread?
It seems to spread very easily from person to person, especially in homes, hospitals and other confined spaces. The pathogen can be carried on tiny respiratory droplets that fall as they are coughed or sneezed out. It may also be transmitted when we touch a contaminated surface and then touch our face.
o Is there a vaccine yet?
No. Clinical trials are underway in the United States, China and Europe. But American officials and pharmaceutical executives have said that a vaccine remains at least 12 to 18 months away.
o What makes this outbreak so different?
Unlike the flu, there is no known treatment or vaccine, and little is known about this particular virus so far. It seems to be more lethal than the flu, but the numbers are still uncertain. And it hits the elderly and those with underlying conditions — not just those with respiratory diseases — particularly hard.
o What if somebody in my family gets sick?
If the family member doesn’t need hospitalization and can be cared for at home, you should help him or her with basic needs and monitor the symptoms, while also keeping as much distance as possible, according to guidelines issued by the C.D.C. If there’s space, the sick family member should stay in a separate room and use a separate bathroom. If masks are available, both the sick person and the caregiver should wear them when the caregiver enters the room. Make sure not to share any dishes or other household items and to regularly clean surfaces like counters, doorknobs, toilets and tables. Don’t forget to wash your hands frequently.
o Should I stock up on groceries?
Plan two weeks of meals if possible. But people should not hoard food or supplies. Despite the empty shelves, the supply chain remains strong. And remember to wipe the handle of the grocery cart with a disinfecting wipe and wash your hands as soon as you get home.
o Can I go to the park?
Yes, but make sure you keep six feet of distance between you and people who don’t live in your home. Even if you just hang out in a park, rather than go for a jog or a walk, getting some fresh air, and hopefully sunshine, is a good idea.
o Should I pull my money from the markets?
That’s not a good idea. Even if you’re retired, having a balanced portfolio of stocks and bonds so that your money keeps up with inflation, or even grows, makes sense. But retirees may want to think about having enough cash set aside for a year’s worth of living expenses and big payments needed over the next five years.
o What should I do with my 401(k)?
Watching your balance go up and down can be scary. You may be wondering if you should decrease your contributions — don’t! If your employer matches any part of your contributions, make sure you’re at least saving as much as you can to get that “free money.”
________________________________________