Identity Theft Issues at IRS

Identity thieves can obtain a legitimate taxpayer’s name and Social  Security number (SSN) in a variety of ways. They can obtain identity  information by hacking into a computer system or paper files at one of the  many entities that use names and SSNs in their records (e.g., employers,  schools, or financial institutions). Thieves can trick the taxpayer into  revealing such information, or they can steal it from the taxpayer. Armed  with the stolen identity, the thief can then file a fraudulent tax return  seeking a refund. The thief typically files a return claiming a refund early  in the filing season, before the legitimate taxpayer files. If IRS determines  the name and SSN on the tax return appear valid (IRS checks all returns  to see if filers’ names and SSNs match before issuing refunds) and it  passes through IRS’s other filters, IRS will issue the refund to the thief.
IRS often becomes aware of a problem after the legitimate taxpayer files  a return. At that time, IRS discovers that two returns have been filed using  the same name and SSN, as shown in figure 1. The legitimate taxpayer’s  refund is delayed while IRS spends time determining who is legitimate.
As we have previously reported, IRS has taken multiple steps to detect,  resolve, and prevent identity theft-based refund fraud. IRS developed  new filtering processes in 2012 to detect identity theft based on the  characteristics of incoming tax returns that do not rely on a duplicate filing  or self-identification by filers. Identity theft indicators—also known as  account flags—are a key tool used to resolve and detect identity theft.  Identity theft indicators speed resolution by making a taxpayer’s identity  theft problems visible to all IRS personnel with account access. In some  cases, IRS uses its identity theft indicators to screen tax returns filed in  the names of known identity theft victims. If a return fails the screening, it  is subject to additional IRS manual review, including contacting  employers to verify that the income reported on the tax return was  legitimate.
IRS uses the Identity Protection Personal Identification Number (IP  PIN)—a single-use identification number sent to victims of identity theft  that have validated their identities with IRS—to prevent refund fraud.  When screening returns for possible identity theft, IRS excludes returns  with an IP PIN, which helps avoid the possibility of a “false positive” and a  delayed tax refund. If a taxpayer was issued an IP PIN and does not use  it when filing electronically, IRS rejects the electronically filed return and  prompts the taxpayer to file on paper. Taxpayers that do not use an IP  PIN or enter an incorrect IP PIN filing on paper experience processing  delays as IRS verifies the taxpayers’ identity. As of June 30th, IRS  reported providing more than 251,500 IP PINs to taxpayers in 2012 and  of those, 150,506 taxpayers filed using an IP PIN. Of filers that filed using  an IP PIN, 8.6 percent (12,936) used an invalid IP PIN. IRS officials told  us their review of a sample of these cases found that the majority of the  invalid IP PINs were due to transposition or keying errors. Details on  other IRS actions can be found in our previous reports.
Other steps taken in 2012 include temporarily reallocating hundreds of  staff from other business units to resolve duplicate filing cases and issue  refunds to legitimate taxpayers. Officials in IRS’s accounts management  function told us that in October 2012 there were more than 1,700 staff  working to resolve identity theft cases. Also, in April 2012, IRS began the  Law Enforcement Assistance Pilot Program in Florida to help state and  local law enforcement agencies obtain tax return data vital to local identity  theft investigations. The pilot allows taxpayers to give their permission for  IRS to provide state and local law enforcement with the returns submitted  using their SSN in certain cases. IRS expanded the pilot to eight  additional states in October 2012. As of September 2012, 49 state and  local agencies participated in the pilot. We did not independently assess  IRS’s 2012 efforts.

	Much Remains Unknown about the Extent and Nature of Identity Theft

The full extent and nature of identity theft-based refund fraud is not  known, but IRS data indicate that it is a large and growing problem. The  data show that in the first 9 months of 2012, the number of known tax- related identity theft incidents has already more than doubled over 2011  (see table 1).
Understanding the extent and nature of identity theft-related refund fraud  is important to crafting a response to it. Program officials said that one of  the challenges they face in combating this type of fraud is its changing  nature. The officials said that when they discover and shut down one  vulnerability, thieves often change tactics. The hidden nature of the crime  means it is not reasonable to expect perfect knowledge about cases and  who is committing the crime. However, the better IRS managers’  understanding of the problem, the better they can respond and the better  Congress can oversee IRS’s efforts.
IRS officials described several areas where the extent and nature of  identity theft is unknown.
Total number and cost of fraudulent returns. IRS does not know the  full extent of the occurrence of identity theft. Officials said that they  count the refund fraud cases that IRS identifies but that they do not  estimate the number of identity theft cases that go undetected. IRS  officials explained that “we don’t know what we don’t know,” because  if a fraudulent return goes through IRS’s identity theft models and  other programs, they are unable to tell if they failed to detect the  fraudulent return. Officials explained that it is very difficult to detect a  fraudulent return when an identity thief uses a correct SSN and has  enough identifying information to make the return “look” like it came  from the legitimate tax filer. The tax return appears to be legitimate as  it has been filed with a name and SSN that match. Detecting identity  theft can also be challenging because some legitimate filers  mistakenly file duplicate returns. For example, IRS officials told us that  in some cases, taxpayers intending to amend their return are  confused and file a second Form 1040. In such a case, IRS has to  investigate whether the duplicate filing is due to taxpayer confusion or  identity theft.
IRS captures data on the amount of money it recovers from all types  of fraudulent returns, but it does not distinguish whether the type of  fraud was identity theft or some other type of fraud. In some cases,  external entities, such as banks or other agencies, may notify IRS of  potential refund fraud, including suspected identity theft-based refund  fraud. IRS reported it had received information from 116 banks and  external leads on more than 193,000 accounts between January 1  and September 30, 2012, for all types of refund fraud. IRS reported  that banks and other external entities returned almost $754 million  dollars during this period. These cases are ones where fraudulent  returns passed through IRS processes and refunds were issued. W&I  officials told us they analyze data from such cases to identify  characteristics of the fraudulent returns to improve their screening for  identity theft and other types of refund fraud. The officials told us that  the procedure for banks to notify IRS of suspected refund fraud is not  new, but more financial institutions have now begun doing so.
Identity of the thieves. Unless IRS pursues a criminal investigation,  IRS generally does not know the real identity of the thieves. An  investigation is necessary because the only identity information IRS  has on the fraudulent tax return is that of the identity theft victim, not  the thief. Officials responsible for processing returns said that they do  not have the sort of information that would be needed to even begin  such an investigation.
CI has substantially increased efforts to criminally investigate identity  theft cases in fiscal year 2012; however, as with other forms of fraud,  CI focuses its investigative resources on the most serious cases. The  number of identity theft investigations opened and time spent  investigating identity theft cases have increased from fiscal year 2010  to fiscal year 2012, as shown in table 2. Although identity theft is one  of CI’s investigative priorities, the number of investigations initiated is  substantially less than the number of identity theft incidents confirmed  by IRS in 2012. CI officials told us that while other IRS functions share  leads with CI, not all of these leads meet CI’s criteria for developing a  case for prosecution. CI officials told us they generally focus their  investigative resources on the most egregious and significant identity  theft cases, as measured by volume and refund amounts.
Whether a fraudulent return is an individual attempt or part of a  broader scheme. W&I and CI officials told us the two units work  closely to utilize the information they obtain from identity theft cases.  They use this information to improve their measures to identify new  identity theft-based refund attempts and to identify especially  significant or egregious cases to consider for possible criminal  investigations. When either W&I’s analysis of identity theft cases or CI  investigations lead to the identification of new schemes, that  information is reported to the Return Integrity and Correspondence  Services unit so it can strengthen its identity theft filters. Identifying  new schemes or significant cases, such as one identity thief using  numerous taxpayer identities, depends on analysts noticing patterns  or other indications that a few cases may be part of a larger scheme.  As a result, some schemes or cases involving multiple taxpayers may  go undetected.
Characteristics of known identity theft returns. IRS officials told us that  the agency does not systematically track characteristics of known  identity theft returns, including the type of return preparation (e.g. paid  preparer or software), whether the return is filed electronically or on  paper, or how the individual claimed a refund (e.g. check, direct  deposit, or debit card). They added that the form in which a refund is  claimed would be particularly hard to track using the current  processes. Officials noted that they can identify the Internet protocol  address of computers used to electronically file returns, which is  helpful in detecting potential identity theft.
While much remains unknown about identity theft, IRS has taken steps to  collect program data on its identity theft detection and resolution efforts.  IRS developed the internal Refund Fraud and Identity Theft Global Report  (Global Report) in July 2012 to consolidate and track existing information  about identity theft incidents from multiple sources within IRS. IRS  officials said that the information in the report is not new, but that they  saw the need for consistency in identity theft-related information drawn  from several data sources. The report is used to provide information to  IRS senior management and the Identity Theft Advisory Councilidentity theft metrics and to provide a standard source of information for  responding to data requests from external entities, according to PGLD  officials.
Officials also stated that because the Global Report is new, they are  working to improve its quality. In a selective review of the Global Report,  we found that it had many of the attributes we have previously found to be  useful for program monitoring. For example, the report covers key program activities and generally provides names, definitions, and data  sources. However, we also found some areas where additional  information or clarification of information currently in the report could  make it more useful, as explained in table 3.
The Global Report is a useful step towards providing IRS management  and other entities with up-to-date, consistent information about identity  theft-based refund fraud and IRS efforts to address it. However, it could  be improved with the inclusion of additional information about data  limitations, definitions, data sources, and the frequency of data updates in  some areas. With such additional information, IRS management or other  entities that use the report would have a clearer picture of not only what is  known about identity theft-based refund fraud, but the strengths and  limitations of the available information. The quality of the report will also  be enhanced by the institution of process controls to help ensure  consistency in how the data in the report are compiled, verified, and  validated.

	Conclusions

Identity theft-related tax fraud is a terrible problem for the victims and a  growing problem for tax administration. For this reason, legislators,  government officials, and the public want to know about IRS efforts to  address identity theft. The nature of identity theft-related tax fraud means  that it will be very difficult, if not impossible, to develop a complete picture  of the extent and nature of the problem, which in turn makes it difficult to  assess IRS’s progress in combating it. While not a direct attack on the  problem itself, IRS’s new Global Report could be a useful management  tool. It is a recognition of the fact that IRS is devoting significant  resources to the identity theft problem and that consolidated and more  consistent program information could assist in management oversight and  decision making. In reading the report, we identified some improvements  that could help users better understand the information provided.

	Recommendations for Executive Action

To improve the identity theft information available to IRS management  and Congress, we recommend that the Acting Commissioner of Internal  Revenue update the Refund Fraud and Identity Theft Global Report to: provide definitions, data sources, and the frequency of data updates  for data elements where such information is missing; document procedures used to compile and validate data; and describe limitations of the data presented.

	Agency Comments and Our Evaluation

IRS officials provided oral comments in response to our draft findings,  conclusions, and recommendations. The Director of PGLD stated that she  agreed with our recommendations and plans on implementing our  recommendations to improve the information provided in the Global  Report. The Director of CI, Refund Crimes said that the discussion of CI’s  investigation of identity theft could be interpreted to suggest that CI is  expected to work every case of identity theft. We revised language in the  report to emphasize that, like other forms of fraud, CI focuses its identity  theft-related refund fraud investigations on the most serious cases.
Chairman Platts, Ranking Member Towns, and Members of the  Subcommittee, this completes my prepared statement. I would be happy  to respond to any questions you may have at this time.

	Contacts and Acknowledgements

For further information on this testimony, please contact James R. White  at (202) 512-9110 or whitej@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. In addition to the individual named above, David Lewis,  Assistant Director; Shannon Finnegan, Analyst-in-Charge; Michele Fejfar;  Sarah McGrath; Donna Miller; Amy Radovich; and Sabrina Streagle made  key contributions to this report.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

Identity theft is a growing and evolving problem that imposes a financial and emotional toll on its victims. As of September 30, 2012, IRS had identified almost 642,000 incidents of identity theft that impacted tax administration in 2012 alone, a large increase over prior years. A taxpayer may have his or her tax refund delayed if an identity thief files a fraudulent tax return seeking a refund using a legitimate taxpayer's identity information.
GAO was asked to describe identity theft issues at IRS and limits to what is known about the extent of identity theft. GAO updated its analysis on identity theft with current data on identity theft cases and interviewed IRS officials. GAO also reviewed past GAO reports to identify key attributes of successful performance measures and compare information provided by the Global Report

What GAO Found

Understanding the extent and nature of identity theft-related refund fraud is important to crafting a response to it, but Internal Revenue Service (IRS) managers recognize that they do not have a complete picture. Program officials said that one of the challenges they face in combating this type of fraud is its changing nature and how it is concealed. While perfect knowledge about cases and who is committing the crime will never be attained, the better IRS understands the problem, the better it can respond and the better Congress can oversee IRS's efforts. IRS officials described several areas where the extent and nature of identity theft is unknown.
Total number and cost of fraudulent returns. IRS does not know the full extent of the occurrence of identity theft. Officials said that they count the refund fraud cases that IRS identifies but that they do not estimate the number of identity theft cases that go undetected.
Identity of the thieves. Unless IRS pursues a criminal investigation, IRS generally does not know the real identity of the thieves.
Whether a fraudulent return is an individual attempt or part of a broader scheme. Identifying new schemes or significant cases, such as one thief using numerous taxpayer identities, depends on analysts noticing patterns or other indications that a few cases may be part of a larger scheme. As a result, some schemes or cases involving multiple taxpayers may go undetected.
Characteristics of known identity theft returns. IRS officials told us that the agency does not systematically track characteristics of known identity theft returns, including the type of return preparation (e.g., paid preparer or software), whether the return is filed electronically or on paper, or how the individual claimed a refund (e.g., check, direct deposit, or debit card).
While much remains unknown about identity theft, IRS has taken steps to organize what it knows in a newly developed Refund Fraud and Identity Theft Global Report (Global Report). The Global Report consolidates and tracks information about identity theft incidents and IRS detection and resolution efforts from multiple sources within IRS. The report provides information to IRS senior management and a standard source of information for responding to data requests from external entities. GAO's selected review of the Global Report against key attributes of successful performance measures found that it had many of the attributes useful for program monitoring, but also had some areas where additional information or clarification would make the report more helpful. Updating the Global Report to provide information on definitions, data sources, and limitations such as the unknown number of undetected fraudulent returns, could help ensure users have a more complete picture of the data and its strengths and limitations. The quality of the report will also be enhanced by the institution of process controls to help ensure consistency in how the data in the report are compiled, verified and validated.

What GAO Recommends

To improve information available to IRS management and Congress, GAO recommends that IRS update the Global Report to provide definitions and data sources, where such information is missing; document procedures used to compile and validate the data; and describe limitations of the data presented.
IRS officials agreed with our recommendations. Based on their comment, we revised language in the report to clarify that, like other forms of fraud, IRS conducts criminal investigations only in the most serious identity theft-related refund fraud cases.