NEW YORK (CBSNewYork) — Even if you haven’t filed your taxes yet, your refund may already be spent.

As CBS2’s Kristine Johnson reported, it could happen if you become a target of the refund ripoff.

Jeweler Bob Zagaros said every year he typically ends up owing the government income tax rather than getting a refund.

You can imagine his surprise when he got a letter from the IRS.

“That said, ‘Congrats on your refund,” he recalled.

Especially because he hadn’t even filed his taxes yet.

“So we knew that something was up,” he said.

A thief had gotten ahold of Zagaros’ personal information — including his Social Security number — filed a fraudulent return, and then directed the refund to go to some unknown address.

“It’s a fairly easy crime to commit. It’s lucrative, and it’s hard to catch the individual who committed it,” Brian Lapidus explained.

Lapidus is with Kroll — a cyber security and investigations firm — he said there are countless ways thieves can get their hands on this information.

“You see criminals diving into dumpsters to get paper files. You see criminals putting malware on networks and accessing employee files,” he said.

“You will get an unsolicited email asking you to confirm your social security number or enter your debit card in order for the IRS to be able to process your tax return. They are simply trying to steal your information,” IRS spokesperson Anny Pachner explained.

Pachner said scam artists aren’t just going after individual taxpayers.

“They’re actually targeting corporations, non-profit organizations, schools,” she said.

Zagaros might have been on the hook for the payment, but his phony return was flagged by new filters put in place by the IRS. He also subscribes to ID Shield — a monthly service that protects his identity.

“We can guide the victim through the steps the victim needs to take. We can open up a restoration case. If there are any other issues with their social security number or any other accounts. This gives the victim a sense that they have something on their side,” Ellen Abbot explained.

Zagaros still doesn’t know how his information was breached.

“If you think it’s not going to happen to you, you’re crazy. It can happen to anybody,” he said.

Last tax season the IRS thwarted nearly $6.8 billion in fraudulent tax refunds.

This year, agents are hopeful they’ll catch even more cases.