If you've been hacked, your first response might be disbelief. Then, maybe, denial and anger. It's time to wake up and get to work quickly on damage control. The fact is tax-related fraud and identity theft are growing at an alarming rate; millions of people have become targets of identity theft, and these crimes have grown exponentially in the last 3 years.

Just this month, IRS temporarily suspended the Identity Protection PIN tool on its website after security vulnerabilities were found in the service (which is intended to help victims). The reality is everyone is at risk. The good news is you can fight back... quickly.

What You Need to Do Now

Tax refund identity theft fraud often starts when your Social Security number and other information are used to file a fraudulent tax return. Taxpayers often discover the fraud when they later attempt to file their own returns, which is why it's important to file your taxes as soon as you can. Once you have filed, the criminals can't file another return.

Yes, this will help you next year, but this year if you know that your SSN has been compromised (or even suspect it), here's what you need to do immediately:

1. Complete IRS Form 14039, Identity Theft Affidavit, https://www.irs.gov/pub/irs-pdf/f14039.pdf

If you are respondingto an IRS notice, be sure to include a copy of the notice when you mail or fax this form. This gets the fraud on record with the IRS.

2. Respond immediately to any IRS issued notice. Call the number provided on the IRS notice and verify you are talking to an IRS employee. If you don't get a clear answer, call the IRS directly at 1-800-908-4490.

3. Call any companies where you suspect fraud has occurred, including any bank or credit institutions. Also, go to all of the companies where you do online business and change your passwords.

4. Contact one of the three major credit bureaus to place a 'fraud alert' immediately on your credit record and request a copy of your credit report.

* Equifax.com - 1-800-525-6285

* Experian.com - 1-888-397-3742

* TransUnion.com - 1-800-680-7289

5. Your next step to restore your personal information involves the Federal Trade Commission. Follow FTC's guidance at identitytheft.gov. This is the federal government's resource to help you report and recover from identity theft

6. Use the Federal Trade Commission's online complaint form at ftc.gov/complaint, or call the FTC at 1-877-438-4338, or TTY 1-866-653-4261. This is the step that can stop the fraudsters from doing this to someone else.

7. Continue to pay your taxes and file your tax return, even if you need do so by paper.

Cleaning up after this crime is messy and time-consuming. The faster you act to report this, the less damage these criminals can do.

How to Protect Yourself in the Future

Sure, hindsight is 20/20 and even top companies with impressive security measures get hacked. No security system is perfect, but you can protect your personal information at home and on your company computers and devices by using firewalls, anti-spam/virus software, and update security patches often.

  • If you must give personal information, make sure it's only over encrypted websites. For example, if you're shopping or banking online, stick to sites that use encryption to protect your information as it travels from your computer to their server. To determine if a website is encrypted, look for "https" at the beginning of the web address (the "s" is for secure). Some websites use encryption only on the sign-in page, but if any part of your session isn't encrypted, the entire account and your financial information could be vulnerable. Look for https on every page of the site you're on, not just where you sign in.
  • Change passwords for online Internet accounts on a regular basis. The longer the password, the tougher it is to crack. Use at least 10-12 characters, mixing letters, numbers and special characters. Try to be unpredictable--don't use your name, birthdate or common words and don't use the same password for many accounts. If it's stolen from you--or from one of the companies with which you do business--it can be used to take over all your accounts.
  • Don't routinely carry your Social Security card or any document with your SSN on it.
  • Every time someone asks for your personal information, think about whether or not you can really trust the request. Scammers will do everything they can to appear trustworthy, so don't give a business your SSN just because they ask--only provide it when absolutely necessary.
  • Don't give your personal information over the Internet, phone or mail unless you initiated the contact or know the person or business you are dealing with.
  • Review your credit report annually and your Social Security Administration earnings statement annually.

The IRS has teamed up with state revenue departments and leaders in the tax industry, including me, to make sure you understand the dangers to your personal and financial data. The Federal Trade Commission has also produced a 68-page document and more extensive checklist on Taking Charge: What To Do If Your Identity is Stolen. https://www.consumer.ftc.gov/articles/pdf-0009-taking-charge.pdf

Remember, the buck stops with you. It's ultimately up to you to protect your identity, so monitor your own information regularly and take action on suspicious activity immediately.

Scam artists are looking for easy targets--don't be one.