First, thieves obtain Social Security numbers and other personal information from insiders at hospitals, doctor's offices, car dealerships or anywhere the information is stored. Then, they file an online tax return using the real taxpayer's name and a fictitious income. In most cases, the criminals buy a debit card so the IRS can issue the refund on that card, although some thieves have also gotten their returns on actual Treasury checks.
The thieves know that the IRS does not verify the employer W-2s sent with the return until after the refund is issued.
It is a particular problem in the state of Florida, according to law enforcement officials.