All it takes to claim someone’s refund is their name and SSN. The IRS will then send a paper check to whatever address listed — even if it doesn’t match the one you have on file. Or the agency will direct-deposit the money to whatever bank account number you provide. And that includes nearly untraceable prepaid debit cards — the throwaway kind you buy at gas stations.
It’s an old game of fraud. But it’s more prevalent than ever, former federal prosecutors say. Hackers are increasingly breaking into hospitals, insurers and governments to steal huge databases with millions of SSNs.