IRS and Taxpayers May Not Discover Refund or Employment Fraud until after Legitimate Tax Returns Are Filed

The number of tax-related identity theft incidents (primarily refund or  employment fraud attempts) identified by IRS has grown:  51,702 incidents in 2008, 169,087 incidents in 2009, and  248,357 incidents in 2010.

		Refund Fraud Delays Innocent Taxpayers’ Refunds

Refund fraud can stem from identity theft when an identity thief uses a  legitimate taxpayer’s name and Social Security Number (SSN) to file a  fraudulent tax return seeking a refund. In these cases, the identity thief  typically files a return claiming a refund early in the filing season, before  the legitimate taxpayer files. IRS will likely issue the refund to the identity  thief after determining the name and SSN on the tax return appear valid  (IRS checks all returns to see if filers’ names and SSNs match before  issuing refunds). IRS often first becomes aware of a problem after the  legitimate taxpayer files a return. At that time, IRS discovers that two  returns have been filed using the same name and SSN, as shown in figure  1. The legitimate taxpayer’s refund is delayed while IRS spends time  determining who is legitimate.

		Employment Fraud Exposes Innocent Taxpayers to Enforcement Actions for Unreported Income

Employment fraud occurs when an identity thief uses a taxpayer’s name  and SSN to obtain a job. IRS subsequently receives income information  from the identity thief’s employer. After the victim files his or her tax  return, IRS matches income reported by the victim’s employer and the  thief’s employer to the tax return filed by the legitimate taxpayer, as  shown in figure 2. IRS then notifies the taxpayer of unreported income  because it appears the taxpayer earned more income than was reported on  the tax return. Employment fraud causes tax administration problems  because IRS has to sort out what income was earned by the legitimate  taxpayer and what was earned by the identity thief.

		To Date, Known Cases of Identity Theft Have Occurred outside IRS

The name and SSN information used by identity thieves to commit refund  or employment fraud are typically stolen from sources beyond the control  of IRS. IRS officials told us they are unaware of any incidents where  information was stolen from IRS and used to commit employment or  refund fraud. However, there are risks at IRS. In a recent audit, we found  that although IRS has made progress in correcting previously reported  information security weaknesses, it did not consistently implement  controls intended to prevent, limit, and detect unauthorized access to its  systems and information, including sensitive taxpayer information. In  2009, we also reported that third-party software used to prepare and file  returns may pose risks to the security and privacy of taxpayer  information. IRS agreed with our recommendations to address these and  other issues. We recently followed up with IRS on this issue and learned  that IRS has begun monitoring adherence to security and privacy  standards in the tax software industry.

	IRS Has Taken Multiple Steps to Resolve, Detect, and Prevent Employment and Refund Fraud

In 2004, IRS developed a strategy to address the problem of identity theft– related tax administration issues. According to IRS, the strategy has  evolved and continues to serve as the foundation for all of IRS’s efforts to  provide services to victims of identity theft and to reduce the effects of  identity theft on tax administration.
Indicators—account flags that are visible to all IRS personnel with  account access—are a key tool IRS uses to resolve and detect identity  theft. IRS uses different indicators depending on the circumstances in  which IRS receives indication of an identity theft–related problem. Once  IRS substantiates any taxpayer-reported information, either through IRS  processes or the taxpayer providing documentation of the identity theft,  IRS will place the appropriate indicator on the taxpayer’s account and will  notify the taxpayer. IRS will remove an indicator after 3 consecutive years  if there are no incidents on the account or will remove an indicator sooner  if the taxpayer requests it.
The three elements of IRS’s strategy are resolution, detection, and  prevention.
Resolution. Identity theft indicators speed resolution by making a  taxpayer’s identity theft problems visible to all IRS personnel with account  access. Taxpayers benefit because they do not have to repeatedly explain  their identity theft issues or prove their identity to multiple IRS units.  Indicators also alert IRS personnel that a future account problem may be  related to identity theft and help speed up the resolution of any such  problems.
Since our 2009 report, IRS developed a new, temporary indicator to alert  all IRS units that an identity theft incident has been reported but not yet  resolved. IRS officials told us that they identified a need for the new  indicator based on their ongoing evaluation of their identity theft  initiatives. The temporary indicator’s purpose is to expedite problem  resolution and avoid taxpayers having to explain their identity theft issues  to multiple IRS units.
As discussed in our 2009 report, taxpayers with known or suspected  identity theft issues can receive assistance by contacting the Identity  Protection Specialized Unit. The unit operates a toll-free number  taxpayers can call to receive assistance in resolving identity theft issues.
Detection. IRS also uses its identity theft indicators to screen tax returns  filed in the names of known refund and employment fraud victims. During  the 2009, 2010, and 2011 filing seasons, IRS screened returns filed in the  names of taxpayers with identity theft indicators on their accounts. There  are approximately 378,000 such taxpayers. In this screening, IRS looks for  characteristics indicating that the return was filed by an identity thief  instead of the legitimate taxpayer, such as large changes in income or a  change of address. If a return fails the screening, it is subject to additional  IRS manual review, including contacting employers to verify that the  income reported on the tax return was legitimate. In addition to U.S.  taxpayers with indicators on their accounts, IRS officials also told us that  they screened returns filed in the name of a large number—about  350,000—of Puerto Rican citizens who have had their U.S. SSNs  compromised in a major identity theft scheme.
As of May 12, 2011, 216,000 returns filed in 2011 failed the screens and  were assigned for manual processing. Of these, IRS has completed  processing 195,815 and found that 145,537 (74.3 percent) were fraudulent.
In January 2011, IRS launched a pilot program for tax year 2010 returns  (due by April 15, 2011) using a new indicator to “lock” SSNs of deceased  taxpayers. If a locked SSN is included on a tax return, the new indicator  will prompt IRS to automatically reject the return. PIPDS officials told us  they intend to expand the pilot to include more SSNs of deceased  taxpayers after analyzing the results of the initial pilot.
A program IRS uses to identify various forms of refund fraud—including  refund fraud resulting from identity theft—is the Questionable Refund  Program. IRS established this program to screen tax returns to identify  fraudulent returns, stop the payment of fraudulently claimed refunds, and,  in some cases, refer fraudulent refund schemes to IRS’s Criminal  Investigation offices.
Prevention. As described in our 2009 report, IRS has an office dedicated  to finding and stopping online tax fraud schemes. IRS also provides  taxpayers with targeted information to increase their awareness of identity  theft, tips and suggestions for safeguarding taxpayers’ personal  information, and information to help them better understand tax  administration issues related to identity theft. Appendix I summarizes  information IRS and FTC provide to taxpayers to protect themselves  against identity theft.
Since our 2009 report, IRS began a pilot program providing some identity  theft victims with a 6-digit Identity Protection Personal Identification  Number (PIN) to place on their tax return. IRS officials told us they  created the PIN based on their ongoing evaluation of their identity theft  initiatives. When screening future years’ returns for possible identity theft,  IRS will exclude returns with a PIN, which will help avoid the possibility  of a “false positive” and a delayed tax refund. IRS sent letters containing  an identity theft PIN to 56,000 taxpayers in the 2011 filing season. IRS will  provide taxpayers a new PIN each year for a period of 3 years following an  identity theft.

	IRS’s Ability to Address Identity Theft Issues Is Constrained by Law, Timing, and Resources

		Privacy and Other Laws Limit IRS’s Coordination with Other Agencies and Taxpayers

IRS’s initiatives to address identity theft are limited in part because tax  returns and other information submitted to and, in some cases generated  by, IRS are confidential and protected from disclosure, except as  specifically authorized by statute. As discussed in more detail in our 2009  report, IRS can disclose identity theft–related events that occur on a  taxpayer’s account to the taxpayer, such as the fact that an unauthorized  return was filed using the taxpayer’s information or that the taxpayer’s  SSN was used on another return. However, IRS cannot disclose to the  taxpayer any other information pertaining to employment or refund fraud,  such as the perpetrator’s identity or any information about the  perpetrator’s employer. Additionally, IRS has limited authorities to share  identity theft information with other federal agencies. When performing a  criminal investigation, IRS can make only investigative disclosures, that is,  the sharing of specific, limited information necessary for receiving  information from other federal agencies that might support or further  IRS’s investigation. Disclosure of taxpayer information to state and local  law enforcement agencies is even more limited.

		IRS Is Often Unable to Detect Suspicious Cases until after the Fraud Has Occurred

Because of the timing of tax return filing, IRS is often unable to detect  suspicious cases until well after the fraud occurred. Validating the identity  theft and substantiating the victim’s identity takes further time. For  example, IRS may not be able to detect employment fraud until after the  following year’s tax filing deadline of April 15 when it matches income  reported by employers against taxpayers’ filed returns. It is only after IRS  notifies a taxpayer of unreported income that IRS may learn from the  taxpayer that the income was not the taxpayer’s and that someone else  must have been using his or her identity. By the time both the victim and  IRS determine that an identity theft incident occurred, well over a year  may have passed since the employment fraud.

		IRS Does Not Pursue Criminal Investigations in Every Case of Potential Refund and Employment Fraud because of Resource Priorities

IRS officials told us that IRS pursues criminal investigations of suspected  identity thieves in only a small number of cases. IRS’s Criminal  Investigations (CI) Division’s investigative priorities include tax crimes,  such as underreporting income from legal sources; illegal source financial  crimes; narcotics-related financial crimes; and counterterrorism financing.  In fiscal year 2010, CI initiated 4,706 investigations of all types, a number  far smaller than the total number of identity theft–related refund and  employment fraud cases identified in that year.
Also, the decision to prosecute identity thieves does not rest with IRS. CI  conducts investigations and refers cases to the Department of Justice  (DOJ), which is responsible for prosecuting cases in the federal courts.  IRS officials said that the small number of tax-related identity theft cases  that they investigate recognizes that DOJ has to conclude that the case is  of sufficient severity that it should be pursued in the federal courts before  it will be prosecuted. According to data from CI included in our prior  report, the median amount of suspected identity theft–related refunds  identified in the 2009 filing season was around $3,400.
CI has investigated tax-related identity theft cases that DOJ has  successfully prosecuted. In our prior report we cited the example of a  former Girl Scout troop leader serving 10 years in federal prison for  stealing the SSNs of girls in her troop and then claiming more than $87,000  in fraudulent tax refunds.

	Improved Detection of Employment and Refund Fraud Must Be Balanced against Burdens on Innocent Taxpayers and Costs

Options exist, now and in the future, to improve detection of identity  theft–related tax fraud, but they come with trade-offs.
Known identity theft victims. IRS could screen returns filed in the  names of known identity theft victims more tightly than is currently done.  More restrictive screening may detect more cases of refund fraud before  IRS issues refunds. However, more restrictive screening will likely  increase the number of legitimate returns that fail the screenings (false  positives). Since returns that fail screening require a manual review, this  change could harm innocent taxpayers by causing delays in their refunds.  Using more restrictive rules would also place additional burden on  employers because IRS contacts employers listed on all returns that fail  screening.
All taxpayers. Beyond screening returns with known tax-related identity  theft issues, screening all tax returns for possible refund fraud would pose  similar trade-offs, but on a grander scale. For example, as noted above,  one way to check for identity theft is to look for significant differences  between current year and prior year tax returns, but this could be  confounded by a large number of false positives. IRS officials told us that  in 2009 there were 10 million address changes, 46 million changes in  employer, and millions of deaths and births. Checking all returns that  reflect these changes for possible refund fraud could overwhelm IRS’s  capacity to issue refunds to legitimate taxpayers in a timely manner.
Looking Forward. IRS’s identity protection strategy and the creation of  PIPDS were part of an effort to more efficiently identify refund and  employment fraud as well as to assist innocent taxpayers. Since adopting  the recommendation in our 2009 report regarding using performance  measures to assess effectiveness, IRS has followed through, using its  improved performance information to identify additional steps it could  take. These include the new indicators for taxpayer accounts, improved  routing of suspect returns, and PIN numbers. However, none of these  steps will completely eliminate refund or employment fraud. By  continuing to monitor the effectiveness of its identity theft initiatives, IRS  may find additional steps to reduce the problems faced by both taxpayers  and IRS.
Looking further forward, other long-term initiatives underway at IRS have  at least some potential to help combat identity theft–related fraud. In April  2011, the Commissioner of Internal Revenue gave a speech about a long- term vision to increase up-front compliance activities during returns  processing. One example is to match information returns with tax returns  before refunds are issued. Before this could happen, IRS would have to  make significant changes. Third-party information returns would have to  be filed with IRS earlier in the filing season. IRS would also have to  improve its automated processing systems; IRS’s current Customer  Account Data Engine (CADE 2) effort is one key step. While these efforts  are part of a broad compliance improvement vision, they could also detect  some identity theft–related fraud. If, for example, IRS could match  employer information to tax returns before refunds are issued, identity  thieves could not use phony W-2s to claim fraudulent refunds.
Chairman Nelson, Ranking Member Crapo, and Members of the  Subcommittee, this completes my prepared statement. I would be happy to  respond to any questions you may have at this time.

	Contacts and Acknowledgments

For further information on this testimony, please contact James R. White  at (202) 512-9110 or whitej@gao.gov. In addition, contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this statement. In addition to the individual named above,  David Lewis, Assistant Director; Shannon Finnegan, analyst-in-charge;  Michele Fejfar; Donna Miller; Erika Navarro; Melanie Papasian; and  Sabrina Streagle made key contributions to this report.

Appendix I: Things Taxpayers Can Do to Protect Themselves if They Suspect Identity Theft

Both the Internal Revenue Service (IRS) and the Federal Trade  Commission (FTC) provide helpful information to taxpayers to deter,  detect, and defend against identity theft. IRS provides taxpayers with  targeted information to increase their awareness of identity theft, tips and  suggestions for safeguarding taxpayers’ personal information, and  information to help them better understand tax administration issues  related to identity theft. For example, IRS has published on its website the  list in table 1 below.
The FTC operates a call center for identity theft victims where counselors  tell consumers how to protect themselves from identity theft and what to  do if their identity has been stolen (1-877-IDTHEFT ; TDD:  1-866-653-4261; or www.ftc.gov/idtheft). The FTC also produces  publications on identity theft, including Take Charge: Fighting Back  Against Identity Theft. This brochure provides identity theft victims  information on  1. immediate steps they can take, such as placing fraud alerts on their  credit reports; closing accounts; filing a police report; and filing a  complaint with the FTC;  2.  their legal rights;  3.  how to handle specific problems they may encounter when clearing  their name, including disputing fraudulent charges on their credit card  accounts; and  4.  minimizing recurrences of identity theft.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

Identity theft is a serious and growing problem in the United States. Taxpayers are harmed when identity thieves file fraudulent tax documents using stolen names and Social Security numbers. In 2010 alone, the Internal Revenue Service (IRS) identified over 245,000 identity theft incidents that affected the tax system. The hundreds of thousands of taxpayers with tax problems caused by identity theft represent a small percentage of the expected 140 million individual returns filed, but for those affected, the problems can be quite serious. GAO was asked to describe, among other things, (1) when IRS detects identity theft based refund and employment fraud, (2) the steps IRS has taken to resolve, detect, and prevent innocent taxpayers' identity theft related problems, and (3) constraints that hinder IRS's ability to address these issues. GAO's testimony is based on its previous work on identity theft. GAO updated its analysis by examining data on identity theft cases and interviewing IRS officials. GAO makes no new recommendations but reports on IRS's efforts to address GAO's earlier recommendation that IRS develop performance measures and collect data suitable for assessing the effectiveness of its identity theft initiatives. IRS agreed with and implemented GAO's earlier recommendation.

What GAO Found

Identity theft harms innocent taxpayers through employment and refund fraud. In refund fraud, an identity thief uses a taxpayer's name and Social Security Number (SSN) to file for a tax refund, which IRS discovers after the legitimate taxpayer files. In employment fraud, an identity thief uses a taxpayer's name and SSN to obtain a job. When the thief's employer reports income to IRS, the taxpayer appears to have unreported income on his or her return, leading to enforcement action. IRS has taken multiple steps to resolve, detect, and prevent employment and refund fraud: Resolve--IRS marks taxpayer accounts to alert its personnel of a taxpayer's identity theft. The purpose is to expedite resolution of existing problems and alert personnel to potential future account problems. Detect--IRS screens tax returns filed in the names of known refund and employment fraud victims. Prevent--IRS provides taxpayers with information to increase their awareness of identity theft, including tips for safeguarding personal information. IRS has also started providing identity theft victims with a personal identification number to help identify legitimate returns. IRS's ability to address identity theft issues is constrained by (1) privacy laws that limit IRS's ability to share identity theft information with other agencies; (2) the timing of fraud detection--more than a year may have passed since the original fraud occurred; (3) the resources necessary to pursue the large volume of potential criminal refund and employment fraud cases; and (4) the burden that stricter screening would likely cause taxpayers and employers since more legitimate returns would fail such screening.