No one at IRS sees the payments, of course -- they're all processed by banks with lockbox operations.  But the vouchers have a four-letter name ID on them, don't they?  So IRS should be able to move them to the right account, and might have already done so.   Your concern, of course, should be whether the taxpayer with the SSN that was used, is going to file and receive an unexpectedly large refund.  

The best way to avoid identity theft and phishing scams is to not own a computer.  We don't know if the client is a yuppie with the latest iPhone, or a war veteran who remembers the first president whose four-letter name check was TRUM. They changed the name of Internal Revenue from Bureau to Service, because its job is to make life easier for taxpayers, not for taxpayers to make life easier for the government.  Pay your taxes, and do it online if that feels comfortable, but don't always ask "how high" when asked to jump.