Get Transcript PART_OF irs.gov
Get Transcript was introduced as a feature of the irs.gov website.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 26 Details
“they made a new feature to irs.gov website called Get Transcript”
Episode
15 November 2018 Official episode · Official transcript
cybercrime
The episode examines identity-tax-refund fraud enabled by stolen personal information and weaknesses in the IRS Get Transcript knowledge-based authentication system.
Topics: Knowledge-based authentication and authentication bypass using breached personal information, Identity theft tax-refund fraud, Unauthorized access to IRS tax transcripts, Account registration and email-address abuse, Identity Protection PINs, Money-mule recruitment and laundering, Legacy and unsupported government systems, Security monitoring coverage gaps, Denial-of-service-like traffic caused by automated transcript requests, Use of stolen W-2 and credit-record data, Credit freezes and stronger identity verification
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Get Transcript PART_OF irs.gov
Get Transcript was introduced as a feature of the irs.gov website.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 26 Details
“they made a new feature to irs.gov website called Get Transcript”
Internal Revenue Service USES Instant knowledge-based authentication
The IRS used instant knowledge-based authentication to verify users of Get Transcript.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“The irs.gov website is different. They use something called instant KBA, or knowledge-based authentication.”
Internal Revenue Service ASSOCIATED_WITH Equifax
Jack says the IRS partnered with a major credit reporting company such as Equifax to obtain identity information for KBA.
Uncertain Confidence 88% · Jack Rhysider EP 26 Details
“The IRS partners with one of the big credit reporting companies like EquiFax”
National Institute of Standards and Technology ASSOCIATED_WITH Instant knowledge-based authentication
NIST specifically commented on the privacy risks of instant KBA, stating that involuntary exposure is inappropriate unless the risk is nearly zero.
Attributed Confidence 98% · Jack Rhysider EP 26 Details
“NIST, a government-ran standards board, comments on this specifically”
IRS Get Transcript breach INVOLVES Get Transcript
The IRS breach involved attackers using the Get Transcript feature to obtain taxpayer records.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“The thieves successfully used the Get Transcript feature of the irs.gov website to obtain the tax records of 100,000 people.”
IRS Get Transcript breach INITIAL_ACCESS_VIA Get Transcript
The attackers initially accessed taxpayer information by navigating through the Get Transcript authentication process.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“They simply found a way to navigate through the authentication system”
IRS Get Transcript breach INVOLVES Instant knowledge-based authentication
Attackers defeated the IRS's instant KBA by using personal information obtained from other breaches.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“probably by using some personal information they obtained from other breaches”
IRS Get Transcript breach INVOLVES Stolen identity tax refund fraud
The breach was connected to fraudulent tax returns filed using stolen taxpayer identities.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“only 13,000 possibly fraudulent returns were filed for tax year 2014”
IRS Get Transcript breach INVOLVES Money mule
The fraud operation involved networks of money mules used to receive and transfer stolen tax refunds.
Explicit Confidence 96% · Jack Rhysider EP 26 Details
“Then they had to set up a whole network of money mules”
IRS Get Transcript breach INVOLVES Internal Revenue Service
The incident concerned unauthorized access to taxpayer records held by the IRS.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“The unauthorized attempts to access information using the Get Transcript application”
IRS Get Transcript breach DISCOVERED_BY Internal Revenue Service
The IRS security center discovered the suspicious activity and later identified the unauthorized access.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“our cyber-security team noticed unusual activity on the Get Transcript application”
IRS Get Transcript breach RELATED_TO Anthem breach
Jack suggests that information stolen in the Anthem breach may have enabled the Get Transcript fraud, but he does not establish this as certain.
Uncertain Confidence 82% · Jack Rhysider EP 26 Details
“This would probably be enough to pass the KBA and do the Get Transcript.”
IRS Get Transcript breach ATTRIBUTED_TO Russia
News reports indicated that the identity thieves may have been in Russia; this attribution was explicitly presented as uncertain and incomplete.
Uncertain Confidence 91% · Jack Rhysider EP 26 Details
“News reports indicate that the recent IRS identity thieves may have been in Russia.”
Identity Protection Personal Identification Number USES Get Transcript
The IRS issued IP PINs as an additional safeguard for IRS accounts after the breach; attackers later targeted the PIN-recovery process.
Explicit Confidence 93% · Jack Rhysider EP 26 Details
“we’re also giving them the opportunity to obtain an Identity Protection Personal Identification Number”
IRS Criminal Investigation Division PART_OF Internal Revenue Service
The IRS Criminal Investigation Division is described as a department within the IRS.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“Within the IRS is a whole department called the IRS Criminal Investigation Division”
Kazeem USES Get Transcript
Kazeem used the Get Transcript website process with purchased personal information to support fraudulent tax returns.
Explicit Confidence 99% · Jack Rhysider EP 26 Details
“Kazeem then used this information to do Get Transcript on the irs.gov website”
Kazeem USES Identity Protection Personal Identification Number
Kazeem obtained IRS IP PINs through the website and used them in filing fraudulent tax returns.
Explicit Confidence 98% · Jack Rhysider EP 26 Details
“and also get the PINs from the website to submit tax returns for those people”
In the song quoted by Jack, J-Creek identifies TurboTax as a tool used in the tax-fraud activity being described.
Explicit Confidence 88% · Jack Rhysider EP 26 Details
“He even said what tools he used, Turbo Tax.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:13:52.833344+00:00