New users accessing the Get Transcript service are required to answer a number of security questions—questions that the IRS believed only the legitimate taxpayer would have the answers to. The perpetrators of this breach made about 200,000 attempts to access the system in this manner, and they were successful about half the time. In other words, the perpetrators thought they had collected enough personal information on 200,000 taxpayers to make it through the security question gauntlet, and they were correct with 100,000 of them.

Looked at yet another way, the IRS breach was actually step 2 in this crime. Step 1 was collecting enough personal information on tens of thousands of taxpayers to execute the breach. Exactly how or where that data was collected has yet to be determined, but consider this example:

Mother's maiden name has been a common security question for decades. How easy is it to figure out someone's mother's maiden name?

Suppose for a moment that you have a Facebook account. And suppose for a moment that you've identified a particular Facebook “friend” as your mother. And suppose for a moment that to make it easier for childhood friends to find her on Facebook, your mother has included her maiden name in her Facebook profile. And finally, assume for a moment that neither you nor your mother has adjusted the Facebook security settings so that currently anyone subscribed to Facebook can see both profiles.

That would mean that your mother's maiden name is just a couple of mouse clicks away for anyone with any interest in finding it.

Whether or not the perpetrators of the IRS breach used this particular technique to harvest data remains to be seen. However, it's fairly certain that all of this started with taxpayers who were sloppy with the protection of their personal information in one way or another.

No matter how innocuous the information seems, when matched up with many other equally innocuous data points, a cybercriminal can create a significant and damaging profile of any credit union member. As your members' trusted financial partner, you have a responsibility to keep those members informed and educated to help them avoid such situations.

The odd thing about crime prevention is that there's no real way to know what you've actually prevented. You may be helping your members in ways they'll never really know.