Many of the special personal identification numbers given out by the Internal Revenue Service to protect victims of identity theft may have been stolen, according to a security research site.

The site Krebs on Security reported Tuesday that a South Dakota CPA, Becky Wittrock, had her Identity Protection PIN stolen. She works as ‎CFO at GeoTek Engineering Testing Services in Sioux Falls. The IRS issued her an IP PIN in 2014 after her identity was stolen and thieves tried to file tax returns under her name. However, when she tried to use the IP PIN to file her taxes this tax season, she learned that identity thieves had struck again and filed a tax return using her IP PIN. She contacted the IRS and was asked a long series of security questions. She discovered someone had filed a return in her name only three weeks earlier and claimed a large tax refund.

“The guy said, ‘Yes, I do see a return was filed under your name on Feb. 2, and that there was the correct IP PIN supplied,’” Wittrock told Krebs On Security. “I asked him how can that be, and he said, ‘You’re not the first, we’ve had many cases of that this year.’”

In addition to informing her there were many such cases, the IRS representative told her that it would not be using the six-digit IP PIN next year and would use a different authentication method next year.

Accounting Today asked an IRS spokesman for comment and received the following statement, referring back to a data breach last year involving the IRS’s online Get Transcript app, which affected hundreds of thousands of taxpayers (see IRS Finds ‘Get Transcript’ Data Breach Was More Widespread).

“After the Get Transcript incident last year, we began a review of IRS.gov tools that use e-authentication procedures, including the IP PIN application,” said the IRS statement. “Unlike Get Transcript, the IP PIN tool is available to a limited number of taxpayers who must have special markers on their tax accounts to successfully access the tool. Most taxpayers receive their IP PIN via mail and never use the tool. For certain taxpayers, the tool is their only alternative to access an IP PIN. This includes IP PIN holders who lose their numbers, taxpayers in our pilot locations and taxpayers we invite to use IP PIN because they have non-tax identity theft issues. We recognized additional safeguards were needed for the IP PIN application, given the amount of personally identifiable information already in criminals’ hands. This filing season, we took appropriate actions in our processing systems and filters to identify and stop those fraudulent returns with IP PINs obtained from the tool. There are extra protections for taxpayers with IP PINs inside our processing systems. The IRS has a number of protections to monitor traffic on IRS.gov, and we continue to closely monitor the IP PIN situation.”

Bill Fleming, a managing director in PricewaterhouseCoopers’ income tax side, told Accounting Today that some of his clients are having a different problem with their IP PINs.

“A lot of our clients who had their identities stolen with the 2014 return have gotten PINs,” he said. “But there were some typos on the IRS PIN notices. We had to straighten that out, and now we’re just wondering what about the refunds from ’14 that we’ve applied to 2015 and whether they’ll be released in time for the tax return. We did have one client who got a note from the IRS that said the processing of his ’14 return is going to be hung up, so he might want to make some payments. He had a $40,000 refund, so the IRS was suggesting he throw another $40,000 in.”

Unfortunately, the client didn’t have an extra $40,000 to give the IRS until it straightened out the problem. “We’re wondering whether these refunds that we applied from the ’14 returns are going to make it to ’15, or we’re going to have a lot of IRS notices going back and forth because the refunds are in limbo,” said Fleming. “But the ’15 returns will be filed.”

He said the problem with the IP PIN notices has turned out to be a major challenge for the IRS. “We should be sympathetic to them because I think they’re getting a lot of electronic stuff that been filed incorrectly so they’ve got to work to clean all that up, and that’s a major job,” said Fleming. “I have a lot of sympathy for them, but we’re just waiting to see what’s going to happen and wondering how much of it is going to be OK and how much of it is not going to be OK.”