For newlyweds Eric and Lauren Oxford, two teachers living on meager salaries in Massachusetts, their expected $3,500 tax refund meant everything.
They've been saving up diligently since 2013. Combined with their summertime lump pay, they'd have just enough to start shopping for their first home together. Instead, when their lease is up this month, they'll be moving in with his mom.
And it's all because someone stole Eric's Social Security number -- and claimed a refund in his name.
Now the couple's entire tax refund is being held at the IRS. The agency told them it could take six months to clear up. But similar cases have taken years. And they're now busy filling out government forms, forced to file via paper mail and not hearing any updates from the IRS.
"It's been super frustrating," Eric said. "We were really depending on that. It sets us back for sure."
The headache the Oxfords are experiencing now is being felt by people all over the country. There's a young, expecting mother in North Carolina who had hoped to offset the cost of a complicated pregnancy with her refund. Now she's buried in paperwork. There's an Iraq War veteran who just returned to be with his wife in Missouri and needs the cash to hold them over until he finds a civilian job. They just discovered his refund was stolen too.
Why is it happening?
All it takes to claim someone's refund is their name and SSN. The IRS will then send a paper check to whatever address listed -- even if it doesn't match the one you have on file. Or the agency will direct-deposit the money to whatever bank account number you provide. And that includes nearly untraceable prepaid debit cards -- the throwaway kind you buy at gas stations.
It's an old game of fraud. But it's more prevalent than ever, former federal prosecutors say. Hackers are increasingly breaking into hospitals, insurers and governments to steal huge databases with millions of SSNs.
There have been two major hacks of large health insurance companies so far in 2015. In January, insurance giant Anthem realized hackers had stolen personal information on 80 million. In March, health insurer Premera found that hackers had exposed data on another 11 million.
No one's been caught yet. And it's unclear if this data is being sold on the black market, the way that kind of stolen information usually is. But Eric suspects it was the Anthem hack that nailed him.
He gets Anthem's Blue Cross Blue Shield health insurance from work (teaching at a high school for troubled, at-risk teens). It was only after the hack, in February, that he discovered someone had already filed a tax return in his name. He got an error message while using TurboTax.
What followed were worried phone calls with TurboTax, Bank of America (BAC) and an hour-long wait on hold to speak to someone at the IRS. The end result? Just wait.
If you're a tax fraud victim, the IRS freezes your refunds. Investigations are so backed up, the government says the average wait time to clear up the matter is 120 days. But more than a dozen tax fraud victims spoke to CNNMoney and said the IRS is telling them the wait is 180 days.
Some have waited far longer than that.
Julianne Potter-Mical, who lives in a suburb of Milwaukee, Wisconsin, had her SSN stolen at the worst time. She was recovering from a car crash and dealing with a complicated metabolic disease that made her perpetually exhausted and weak. She hoped her refund would help pay the mounting medical bills. But her 2013 refund didn't show up until just this past November.
"It has been a nonstop nightmare since then. I never even got an acknowledgment that the IRS got my sensitive paperwork," she said. "If you don't have the energy to deal with this, whoo!"
Why the long wait? An IRS spokeswoman told CNNMoney tax fraud cases -- even small ones -- are among the most complex. Even after a real victim reports a stolen identity to the IRS, fraudsters sometimes call the agency themselves and claim the victim is actually an imposter.
The agency spokeswoman said the IRS recognizes it's painful for taxpayers. But the agency has trouble improving when its budget keeps getting cut. The agency is operating on $1.2 billion less than it did five years ago.
Mari Jo Kelly of Tampa, Florida waited nearly two years for her refund. She finally got her 2011 refund... in January 2014.
She was surprised that the IRS didn't spot the fraud when it happened. She's a meticulous, 73-year-old retired H&R Block (HRB) accountant who always calculates her payments so any refunds or taxes due are small. Her fraudster claimed a gargantuan $9,800 refund -- and got it.
"What an imagination!" Kelly said. "These people at the IRS don't check anything."
In reality, the IRS does review tax returns for fraud with automated fraud filters. For instance, the agency records the IP address of the computer you use to electronically file your taxes, and alarms go off if dozens of people's taxes get filed from the same spot.
That and other measures are how the the IRS spotted and halted $63 billion worth of fraudulent tax refunds between 2011 and 2014. But it's losing the battle. The agency paid identity thieves $5.2 billion in 2011 alone.
To combat fraud, the IRS is now issuing fraud victims like Eric Oxford a six-digit PIN. So far, 1.5 million Americans have PINs to file their taxes. Another 1.7 million taxpayers the IRS considers likely victims of identity fraud have been invited into the pilot program as well. Plus, anyone living in the top states for tax-related identity theft -- the 30 million people living in Florida, Georgia and the District of Columbia -- can get a PIN too.
But that's a whole other kind of annoyance. Once you're assigned a PIN, you can't file ever again without it. In fact, searching for her misplaced PIN was exactly what Kelly was doing while recalling her tax woes to CNNMoney.
"I know I've got it somewhere," she said while rummaging through her files.
