a

GAO

United States General Accounting Office

Testimony

Before the Subcommittee on Oversight and Social Security, 

Committee on Ways and Means, House of Representatives

For Release on Delivery

Expected at 10 a.m. EDT

Thursday, March 10, 2004

INTERNAL REVENUE 

SERVICE

Individual Taxpayer 

Identification Numbers 

Can Be Improperly 

Obtained and Used

Statement of Michael Brostek,

Director, Tax Issues

GAO-04-529T
www.gao.gov/cgi-bin/getrpt?GAO-04-529T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Michael 

Brostek at (202) 512-9110 or 

brostekm@gao.gov. 

Highlights of GAO-04-529, a report to a 

testimony to the House Ways and Means 

Subcommittees on Oversight and on 

Social Security 

March 2004

INTERNAL REVENUE SERVICE

Individual Taxpayer Identification 

Numbers Can Be Improperly Obtained 

and Used 

IRS created the ITIN in 1996 to improve tax administration. IRS needed a 

better way to identify the tax reporting of those who could not obtain an 

SSN to use on tax returns and other tax documents. The cumulative number 

of ITINs issued exceeded 7 million by the end of 2003. 

IRS receives ITIN applications from the mail, applicants walking into IRS 

offices, and authorized non-IRS entities. In December 2003, IRS made 

changes to improve its ITIN controls. However, IRS remains limited in its 

ability to verify applicants’ identities. For instance, IRS staff does not see 

most applicants and IRS does not verify the validity of documents. 

Before December 2003, GAO staff obtained an ITIN by submitting bogus 

documents through the mail and used the ITIN to open a bank account and 

obtain an ATM card. Staff also fabricated an ITIN and used it to obtain a 

voter registration card. While limited, this test indicates that IRS’s controls 

could be bypassed and that an ITIN could be used for nontax purposes. 

Despite the December changes, the weaknesses GAO exploited remain. 

Resolving these limitations could be challenging. 

IRS has concluded that most resident aliens who have ITINs and earn wage 

income are not legally employed in the United States. Given this context, the 

use of ITINs raises various issues. Employers have raised concerns that 

when they identify employees and their work eligibility, they could have 

conflicting obligations to IRS, SSA, and DHS. These concerns appear to be 

largely unfounded if employers do what is specifically required. Data 

sharing—especially of IRS data—may help DHS to target immigration 

enforcement, but, among other things, officials cited legal restrictions and 

the potential for employment to be hidden from tax administrators as 

affecting their decisions about sharing data. 

Number of ITINs Issued Annually and Cumulative Total, Calendar Years 1996 Through 2003 

The Internal Revenue Service (IRS) 

issues Individual Taxpayer 

Identification Numbers (ITINs) to 

those who are not eligible for a 

social security number (SSN) from 

the Social Security Administration 

(SSA). ITIN-related concerns 

include whether any weaknesses in 

IRS’s controls would allow ITINs to 

be issued and used for illegal 

purposes and possible security 

breaches, whether employers are 

confused about their 

responsibilities to IRS, SSA, and 

the Department of Homeland 

Security (DHS) for identifying their 

employees, and how IRS, SSA, and 

DHS share data when illegal 

resident aliens receive ITINs. 

Because of these concerns, GAO 

was asked to: (1) describe why IRS 

created the ITIN, (2) describe IRS’s 

processes and controls for issuing 

ITINs, (3) do a limited test of IRS’s 

processes and controls, and (4) 

describe certain concerns and 

problems for employers and 

government agencies when ITINs 

are issued to illegal resident aliens. 

Although GAO is not making 

recommendations, this hearing is a 

useful venue for Congress to 

consider whether to provide IRS, 

SSA, and DHS guidance on how to 

address concerns about ITIN 

issuance controls and policies for 

dealing with illegal resident aliens. 
Page 1 GAO-04-529T 

Messrs. Chairmen and Members of the Subcommittees:

I am pleased to participate in the hearing today on various issues related to 

the Individual Taxpayer Identification Number (ITIN) issued by the Internal 

Revenue Service (IRS). As you requested, my statement today describes 

why IRS created the ITIN, the processes and controls IRS has in place for 

issuing ITINs, the results of our limited test of the controls over issuing an 

ITIN, and certain concerns and problems for employers and government 

agencies that ensue when ITINs are issued to illegal resident aliens.1

IRS issues ITINs to individuals who are required to have a U.S. taxpayer 

identification number (TIN) but who are not eligible to obtain a social 

security number (SSN) from the Social Security Administration (SSA). An 

ITIN has nine digits formatted like an SSN (NNN-NN-NNNN) but beginning 

with the number “9”.2

 IRS issues ITINs for tax processing purposes only. 

Having an ITIN does not affect a holder’s immigration status, or authorize 

the holder to work or receive Social Security benefits. 

In requesting this testimony, you sought a better understanding of the 

vulnerabilities in the ITIN issuance process, including whether weaknesses 

allow ITINs to be issued and used for illegal purposes and possible security 

breaches. You also expressed interest in the extent to which employers 

may be confused by their responsibilities vis-à-vis IRS, SSA, and the 

Department of Homeland Security (DHS) in ensuring the identity of their 

employees, and whether federal agencies are sharing information to deal 

with illegal resident aliens who may be issued ITINs.

Today’s statement is based on interviews, reviews of agency documents 

and various publications, and limited tests of the ITIN issuance controls. 

Specifically, to address the four areas, we interviewed officials from IRS 

including the Taxpayer Advocate Service, SSA, and the Departments of the 

Treasury, Homeland Security, and Labor. We reviewed documents from 

these agencies as well as other literature. In addition, our Office of Special 

1

In this testimony, we use the term alien to mean a foreign-born individual who has not been 

naturalized and is still a subject or citizen of a foreign country. A resident alien is someone 

meeting this definition but also considered a resident of the United States for tax purposes, 

as described later in this testimony. A nonresident alien does not reside in the United States, 

but may have a need to interact with IRS. For this testimony, we defined an illegal resident 

alien is a resident alien who is not legally in the United States and also may refer to them as 

illegal aliens, undocumented workers, or unauthorized resident aliens.

2

SSA officials said that they also receive other identification numbers that start with “9”.
Page 2 GAO-04-529T 

Investigations (OSI) did limited testing of IRS’s controls to determine 

whether it could fraudulently obtain an ITIN by mailing or presenting bogus 

identity documents to IRS. OSI used an IRS-issued ITIN and a fake ITIN it 

generated for nontax purposes. We did our work in Washington, D.C. from 

September 2003 through February 2004 in accordance with generally 

accepted government auditing standards and we performed our 

investigative work in accordance with standards prescribed by the 

President’s Council on Integrity and Efficiency.

Our results in these four areas showed that:

• IRS created the ITIN in 1996 to improve tax administration. IRS needed 

a better way to identify and track the tax reporting of noncitizens that 

could not obtain an SSN for use when filing tax returns. Beyond the 

filing of tax returns, ITINS have other legitimate tax uses, such as for 

filing documents other than tax returns and for claiming benefits related 

to a tax treaty. According to IRS, most ITINs have been used at least 

once on a tax return and ITINs also have been used for other legitimate 

tax purposes. 

• IRS made changes to improve its processes for issuing ITINs in 

December 2003, but continues to have limited controls to verify the 

identity of ITIN applicants. For example, the majority of ITIN applicants 

apply by mail and IRS cannot be sure the applicant is the same 

individual described by the documentation submitted. IRS also does not 

verify with third parties the validity of the documents submitted with 

the ITIN applications. 

• Before IRS changed its procedures in December, we obtained an ITIN by 

applying with bogus documents through the mail. We also created a 

bogus ITIN without applying to IRS. Using the IRS-issued ITIN, we 

opened a bank account and obtained an ATM card. We used the bogus 

ITIN to obtain a voter registration card. While very limited, this test 

illustrates weaknesses in IRS’s ITIN controls, which have not been 

completely addressed by the changes made in December, and shows 

that ITINs can be used for nontax purposes, such as blending into 

society under a false identity. Resolving the continuing limitations in 

IRS’s ITIN issuance controls would be challenging.

• Although precise data are not available, hundreds of thousands of ITINs 

are issued to aliens who subsequently earn wage income. IRS and the 

Treasury Inspector General for Tax Administration (TIGTA) have 
Page 3 GAO-04-529T 

concluded that these individuals are illegal resident aliens. Given this 

context, employers have raised concerns about potentially conflicting 

obligations to IRS, SSA, and DHS when they identify employees and 

their work eligibility. These concerns appear to be largely unfounded if 

employers do what is specifically required. Sharing IRS data with DHS 

may provide enhanced information to target enforcement of 

immigration laws, but to differing degrees, officials cited such factors as 

legal restrictions and the potential for employment to be hidden from 

tax administrators as affecting their decisions about whether and how 

to share data.

Background IRS requires a unique TIN to process any tax return or tax-related 

document, and associate the return or document with a taxpayer’s history. 

A TIN allows IRS to better manage a host of tax administration functions—

such as crediting tax payments, and verifying compliance in filing returns, 

reporting income, and paying taxes. IRS also needs it to process 

information returns filed by employers and financial institutions to report 

certain types of payments (e.g., wages or interest) made to individuals.

One type of TIN is the SSN, which SSA is authorized to issue to United 

States citizens, aliens allowed to work in the United States, or others, in 

limited cases, for nonwork purposes. For example, according to SSA, if an 

applicant only needs an SSN to obtain certain government benefits as 

specified in SSA regulations, SSA must issue an SSN and social security 

card but the card specifically states that it is not valid for work purposes. 

Individuals must use an SSN when filing a required tax return, unless they 

cannot legally obtain an SSN. 

For those who cannot obtain an SSN but need a TIN for tax purposes, IRS 

created the ITIN. IRS’s 2003 training manual on ITINs identifies such 

individuals, as shown below. 

• An alien who does not reside in the United States and who is filing a U.S. 

tax return to (1) claim a tax treaty benefit, (2) claim a tax refund, or (3) 

file a joint tax return with a spouse who is a U.S. citizen or resident.

• An alien who lives in the United States and who is filing a U.S. tax 

return.

• Individuals claimed on a U.S. tax return as a (1) dependent, or (2) 

spouse.
Page 4 GAO-04-529T 

An alien is a resident for tax purposes if the individual (1) is a lawful 

permanent resident (green card test3

) in the United States for any time 

during the year, (2) is present in the United States for 31 or more calendar 

days during the current year and for a substantial time—183 or more 

weighted days—during a 3-year period weighted toward the current year 

(substantial presence test), or (3) elects to be treated as a U.S. resident 

(first-year election test). 4

IRS does not believe that it has the legal authority to distinguish between 

legal and illegal resident aliens for tax purposes. Individuals who meet the 

definition of a resident alien are generally taxed in the same manner as U.S. 

citizens and holders of green cards, meaning that they are taxed on their 

worldwide income. One exception is that resident aliens who have ITINs 

are ineligible to claim the refundable earned income tax credit, which 

requires a valid SSN issued for work purposes. A nonresident alien is 

subject to tax on income from U.S. sources but generally not on foreign 

source income. 

IRS Created the ITIN to 

Improve Tax 

Adminstration

IRS created the ITIN in July 1996 to improve tax administration for 

individuals who were ineligible to obtain an SSN. IRS needed a better way 

to identify and track tax filing and reporting by these individuals and by 

employers and financial institutions that file other tax documents related to 

the individual’s income. 

Each individual taxpayer is to use a unique and permanent TIN, which 

allows IRS to associate their filed tax returns with their tax records and 

with information returns on payments made to them, and to more 

effectively use programs to enforce tax filing and reporting compliance. 

For individuals who lacked an SSN, IRS did not have a permanent TIN to 

use in tracking their tax obligations and history prior to the ITIN.

Prior to July 1996, IRS used a system of temporary TINs when a taxpayer 

did not have an SSN to facilitate one-time processing of a tax return. The 

temporary TIN was assigned to a return filed without an SSN rather than to 

a taxpayer. However, IRS had to post returns with temporary TINs to the 

3

A green card is an identity document issued to lawful permanent residents by DHS that 

attests to the permanent residence status of an individual in the United States. 

4

26 U.S.C. §7701(b)(1)(A).
Page 5 GAO-04-529T 

invalid segment of IRS’s masterfile because these returns could not be 

associated with a valid taxpayer account.5

 Posting to the invalid segment 

created problems for IRS enforcement programs, such as negating income 

verification through document matching. Because the temporary TINs 

were unique to IRS, IRS could not easily match the amounts of income and 

withheld taxes reported on these tax returns against information returns 

submitted by third parties to report such amounts. 

In 1995, we reported that accounts in the invalid segment had more than 

doubled the growth rate compared to those in the valid segment from 1986 

through 1994. We also reported that IRS refunded $1.4 billion for tax year 

1993 returns posted to the invalid segment. 6

 Although no one knows how 

much of this $1.4 billion may have been erroneously refunded, the risk was 

higher because IRS had less certainty about these filers’ identities absent a 

valid TIN and about the accuracy of their returns absent the ability to 

match a filed return with third-party data. 

Also, prior to December 1996, SSA was issuing “nonwork” SSNs to 

individuals who had tax obligations but were not authorized to work or 

were not otherwise part of the social security system. With the growth in 

the earnings suspense file—SSA records that could not be associated with 

a wage earner, SSA decided to reduce the number of nonwork SSNs. 

Starting in December 1996, SSA tightened restrictions on who could apply 

for a nonwork SSN. 

In response to these events and the needs of tax administration, IRS 

created the ITIN as a permanent TIN assigned to individuals who needed to 

file a tax return but were ineligible to obtain an SSN. Among other things, 

IRS was concerned that information returns could not be matched with a 

tax return. Such returns report third-party payments made to those such as 

nonresident aliens who invested in companies or real estate in the United 

States, or received rent and royalty payments. 

5

The masterfile is a record of transactions in a taxpayer’s account. If a taxpayer has a TIN, 

IRS posts account information to the valid segment of the masterfile. Otherwise, IRS posts 

the information to the invalid segment. 

6

United States General Accounting Office, Tax Administration: IRS Could Do More To 

Verify Taxpayer Identities, GAO/GGD-95-148 (Washington, D.C.: Aug. 30, 1995).
Page 6 GAO-04-529T 

IRS issued its first ITINs in July 1996. Figure 1 shows that IRS has issued 

over 7.2 million ITINs through December 2003 and over 1 million ITINs 

annually in more recent years.7

 

Figure 1: Number of ITINs Issued Annually and Cumulative Total, Calendar Years 

1996 to 2003

Note: 1996 does not cover a full calendar year because the ITIN program began in July 1996. 

According to IRS, most of the ITINs issued have been used for legitimate 

tax purposes such as on tax returns and other tax-related documents. IRS 

analysis in 2003 showed that about 75 percent of the ITINs issued since its 

inception through September 2003 have been used at least once on filed tax 

returns as a required identification number. The actual portion of ITINs 

used for tax purposes would be higher than 75 percent if IRS had computed 

the frequency of uses beyond return filing such as to: (1) obtain treaty 

benefits or exemptions from withheld tax, and (2) file information returns 

7

IRS issued 60,682 ITINs in 1996; 1,363,071 in 1997; 566,745 in 1998; 615,413 in 1999; 818,392 

in 2000; 1,088,837 in 2001; 1,493,284 in 2002; 1,229,097 in 2003; and 77,759 through Feb. 13, 

2004.

0

1

2

3

4

5

6

7

8

1996 1997 1998 1999 2000 2001 2002 2003

Number issued annually

Cumulative total

Number of ITINs (in millions)

Source: GAO analysis of IRS data.
Page 7 GAO-04-529T 

on payments made, such as Forms W-2 (Wage and Tax Statement) for wage 

income. IRS does not track the frequency of these other uses.

IRS Provides Multiple 

Ways to Obtain an ITIN 

but Its Controls to 

Verify the Correctness 

of Issuance and Use 

Are Limited

IRS provides multiple avenues to apply for an ITIN, all of which result in 

IRS reviewing the applications and documents to establish an individual’s 

identity. However, IRS’s controls over the issuance and use of ITINs are 

limited. IRS made changes to improve its controls in December 2003, but 

the changes did not fully address the control limitations. Among other 

limitations, IRS does not see most applicants, documents are not verified 

with third parties, and few staff can translate or verify foreign language 

documents. 

ITIN Application Process Individuals apply for ITINs by filing a Form W-7 (Application for IRS 

Individual Taxpayer Identification Number) with IRS. As of December 17, 

2003, applicants must provide the tax return for which an ITIN is needed, 

and documentation and a photograph to verify their identity and foreign 

status, such as a passport, driver’s license, or identity card. 

The ITIN application can be mailed to IRS, submitted at an IRS walk-in, 

taxpayer assistance center, or submitted through an acceptance agent. 

Each way has slightly different procedures and requirements.

• An applicant can mail Form W-7 and supporting documents to the 

Philadelphia Service Center (campus). The documents must be 

originals or notarized copies. Under IRS procedures, the documents are 

to be examined by an ITIN unit employee and originals are to be 

returned to the applicant while IRS is to retain notarized copies. 

According to IRS, this mail option historically accounts for about 70 

percent of the applications.

• An applicant can apply at an IRS taxpayer assistance center that 

provides walk-in assistance. An IRS employee is to review the 

application and documents submitted. If the employee deems the 

documented proof to be satisfactory, the employee is to make an 

appropriate notation on Form W-7, copy the documents, and return 

them to the applicant. The employee is to transmit Form W-7 and the 

copied documents to Philadelphia for final review and issuance of the 

ITIN. If the employee deems the documents to be suspect or 

unsatisfactory, the employee is to return them to the applicant. 
Page 8 GAO-04-529T 

According to IRS, about 20 percent of applicants use this walk-in option.

• An applicant can use the services of an IRS-approved acceptance agent.8 

Agents include colleges, financial institutions, and accounting firms, and 

can be located outside of the United States. Acceptance agents help 

prepare a Form W-7 and must submit this form and related 

documentation to IRS. Certified acceptance agents are authorized to 

also certify whether the documented proof is adequate. They are 

required to keep copies of the documents for 3 years after making an 

appropriate notation on the Form W-7 and forwarding it to IRS. Less 

than 5 percent of applicants use an acceptance agent—whether or not 

certified.

Limited Controls Over ITIN 

Issuance 

IRS has limited controls to verify ITIN applicants’ identities. Among the 

key limitations in the issuance process are that IRS employees do not have 

to see the applicant in most cases to verify their identity, applicants’ 

documents are not verified with third parties, and IRS has few staff able to 

translate or verify foreign language documents.

IRS’s ability to establish the applicant’s identity is hindered when IRS 

employees do not see the applicant as they review identifying information 

and photographs submitted. This is the case for applications that are sent 

through the mail, which account for 70 percent of applications. A similar 

problem can arise for “walk in” applications because third parties can 

submit a Form W-7 for ITIN applicants. As long as the Form W-7 is signed 

and documentation is provided, IRS does not require applicants to appear. 

IRS employees may have difficulty in determining the validity of an 

unfamiliar document submitted with a Form W-7 to verify identity. An IRS 

letter to state motor vehicle departments in August 2003 indicated that IRS 

generally accepts documents submitted with a Form W-7 at face value 

without validating their authenticity with issuing agencies, or, as discussed 

above, requiring applicants to appear in person. As of December 17, 2003, 

IRS listed 13 types of documents that could be used, such as a passport,

8

A list of acceptance agents that are available to the general public is available on the IRS 

Web site (www.irs.gov).
Page 9 GAO-04-529T 

foreign voter registration card, visa, or U.S. or a foreign driver’s license.9 

Prior to that, IRS had listed 40 types of documents. IRS reduced the list, in 

part, because of the difficulty for IRS employees who see low volumes of 

Forms W-7 to know all types of documents. 

Even with this reduction in the number of acceptable types of documents, 

IRS employees still can encounter many variations to consider for each 

type of document. For example, an IRS research study completed in 

October 2003 indicated that 17 countries accounted for 85 percent to 87 

percent of the ITIN applicants during 1999 through 2001. In each of these 

years, Mexican citizens accounted for 54 percent to 57 percent of the ITIN 

applications submitted to IRS. The remaining ITIN applicants can come 

from many other countries. Each country could have unique formats for 

each type of acceptable document, which may be unfamiliar to IRS 

employees.

IRS employees have limited capability to interpret documents submitted in 

a foreign language. IRS does not track how many documents are submitted 

in a foreign language but as noted above, ITIN applicants can come from 

many countries. As of October 2003, 10 of the 230 employees at the ITIN 

Philadelphia site were bilingual---6 in Spanish, 1 in Chinese, 1 in Korean, 1 

in Japanese, and 1 in Ukrainian/Polish, according to IRS.

Nor does IRS generally require ITIN applicants to provide translated copies 

of documents submitted in a foreign language. According to the Form W-7 

instructions, the applicant may be required to provide a certified 

translation of the foreign language document to obtain an ITIN. IRS states 

that it will attempt to translate any foreign documents provided. If IRS 

cannot translate it, IRS’s procedure is to ask the applicant for the required 

translation. 

Even if documents can be read, some IRS employees do not have much 

experience in judging whether the documents are genuine. According to 

IRS officials, much of this knowledge comes from on-the-job experience--

employees that see more documents are more likely to be able to spot an 

invalid or bogus document. Each IRS employee that provides taxpayer 

assistance receives the standard 8-hour IRS training on ITIN, including 

9

Other documents include an identification card issued by U.S. or foreign military agencies, 

a state, or a national government; a DHS photo identification; birth certificate; and medical 

or school records for dependents.
Page 10 GAO-04-529T 

document identification and validation, given to all employees when hired--

whether the employee handles ITIN applications in Philadelphia or at a 

walk-in site. 

IRS Is Attempting to 

Improve ITIN Issuance 

Controls

Knowing of weaknesses in its ITIN processes and controls, IRS has made 

some changes to improve its controls and is considering other 

improvements. IRS’s concern about the large number of ITINs issued 

prompted creation of a task force in 2002 to conduct an in-depth review of 

ITINs. The task force identified many problems and recommendations in 

its September 2002 final report. IRS designated 22 recommendations as 

high priority, and created an ITIN office to study their feasibility and 

oversee any implementation. 

We did not have time to review the implementation status of all 22 

recommendations but know that action has been taken on some of the 

recommendations. For example, IRS has started a campaign to educate 

states, employers, financial institutions, and other government agencies on 

the appropriate use of ITINs. To this end, IRS sent letters in August 2003 to 

the directors of all state motor vehicle departments asking them to not 

accept ITINs for drivers’ license purposes. IRS also has considered 

legislative proposals to make ITIN use illegal for nontax purposes, and to 

assess information return penalties for improper Form W-7 filings. 

IRS announced three other recommendations that took effect on December 

17, 2003. First, to help eliminate the nontax use of ITINs, the applicant will 

have to show a federal tax purpose for seeking the ITIN. A Form W-7 

application without proof that an ITIN is needed for federal tax purposes is 

to be rejected. IRS is requiring taxpayers to attach the tax return for which 

an ITIN is needed to a Form W-7.10 Nonresident aliens who need an ITIN for 

tax purposes other than filing a tax return, such as to obtain tax treaty 

benefits, will need to prove ownership of the asset that is eligible for a 

benefit when they file the Form W-7. Second, as mentioned earlier, IRS 

reduced to 13 from 40 the number of documents that it will accept as proof 

of identity to obtain an ITIN. Third, IRS will no longer issue an ITIN card, 

reasoning that the card could be mistaken for an SSN card. Rather, it will 

issue an authorization letter. Although these changes appear to have the 

potential to better ensure that ITINs are issued for valid tax-related 

10Applicants who are not authorized to work but report wage income on the tax return could 

still qualify for an ITIN, as discussed elsewhere in this testimony.
Page 11 GAO-04-529T 

purposes, we do not know how much these changes may improve IRS’s 

controls over issuance.

Weaknesses in ITIN 

Controls Can Contribute to 

Tax Fraud 

Weak controls over the issuance of ITINs can contribute to tax fraud by 

individuals seeking to obtain a tax refund that is not truly owed to them. 

For example, if an individual uses bogus documentation to obtain an ITIN 

under a false identity, that individual could use that ITIN to file fraudulent 

tax returns that claim tax refunds. In such situations, the individual could 

attach a bogus Form W-2 to the tax return to create support for any wages 

claimed on the fraudulent return, even though ITIN holders generally are 

not authorized to have SSNs and earn wages in the United States.11 

IRS has not measured how often such tax fraud schemes related to ITINs 

have been used but has some anecdotal data. IRS has found that ITINs 

have been used in schemes that resulted in millions of dollars in fraudulent 

tax refunds. For 1999 through 2003, IRS found 12,241 tax returns, that used 

an ITIN with bogus Form W-2s attached that claimed refunds in excess of 

$22.1 million. IRS was able to stop $18 million of these refunds. One 

scheme in California over these four years accounted for 9,664 of these 

false returns. 

IRS’s ITIN Controls 

Can Be Circumvented 

to Obtain ITINS and 

Use Them for Non-tax 

Purposes

Before IRS instituted the changes during December 2003, we did a limited 

test to assess the security of the ITIN program controls. We attempted to 

improperly obtain and use ITINs for nontax purposes during September 

through November 2003. We were able to obtain an ITIN from IRS using 

fake identity documentation and use this ITIN as well as a bogus ITIN we 

created for nontax purposes. Although IRS changed its procedures after we 

obtained and used the ITINs, the changes made do not fully address the 

weaknesses we exploited, such as IRS’s limited ability to verify the validity 

of documents. Overcoming these weaknesses would be challenging.

We applied for an ITIN using two methods. First, we mailed an ITIN 

application to IRS’s Philadelphia Service Center using a bogus foreign birth 

certificate as proof of identity. Second, we submitted bogus foreign 

11By analyzing a sample of tax returns filed in tax years 1999 and 2000 with an ITIN 

for the primary filer, IRS estimated that more than 90 percent of the returns also 

reported wage income.
Page 12 GAO-04-529T 

documentation as proof of identity at an IRS taxpayer assistance site. After 

we obtained an ITIN through the mailed application, we used it to open a 

bank account and obtain an ATM card. We did not receive the ITIN from 

the application submitted at the walk-in site because we already received 

an ITIN for that individual through the mailed application; IRS apparently 

followed its procedure to not issue multiple ITINs to the same individual.

We also created a bogus ITIN displayed on a fake ITIN card. We used the 

bogus ITIN in lieu of a required SSN to obtain a Virginia voter registration 

card. Virginia requires an SSN to register to vote but presumably voter 

registration officials did not verify the number we put on the application.12

Only U.S. citizens are eligible to obtain a voter registration card. We were 

twice unsuccessful in using the bogus ITIN to open a bank account in the 

District of Columbia. Officials at both banks told our staff that they could 

not validate this ITIN based on their access to a credit reporting agency 

database.

Our test of IRS’s ITIN issuance controls and whether an individual can use 

an ITIN for nontax purposes was too limited to show the extent to which 

ITIN issuance controls prevent improperly issued ITINs. Nor does the test 

show the magnitude of any abuse, in either receiving ITINs under false 

pretenses or using them for nontax purposes. Rather, the test indicates 

that IRS’s ITIN process and controls could be circumvented, and that a 

person who obtains an ITIN using bogus documentation may have little 

difficulty in using the ITIN for certain nontax purposes. 

Although IRS revised its procedures for issuing ITINs subsequent to our 

test, the changes made do not completely address the control weaknesses 

we exploited. On one hand, IRS staff will need to review fewer types of 

documents and will be further trained in 2004 on document validation and 

document inspection equipment to help identify questionable documents. 

Also, because IRS switched to a letter from an SSN-like card to help clarify 

that the issued ITIN is not an SSN, using an ITIN to obtain other documents 

may be more difficult. On the other hand, IRS will neither require 

applicants to appear in person nor verify documents with third parties such 

as the country issuing them. Thus, IRS remains limited in its ability to 

12Given the limited time to do our work, our test only included Virginia. We do not know 

whether other states also would have issued us a voter registration card in this manner. 

Since we did our test, Virginia has announced changes to strengthen its checks of 

identification documentation such as for a driver’s license.
Page 13 GAO-04-529T 

ensure that the documents submitted with an ITIN application are valid and 

that the applicant is the same individual described by those documents. 

IRS officials said that requiring ITIN applicants to apply in-person and 

verifying documents with third parties would pose challenges, such as 

significantly delaying the issuance of ITINs and processing of returns that 

are now to be attached to ITIN applications. According to IRS, requiring inperson appearances would significantly burden IRS and applicants for 

various reasons. First, IRS locations that accept applications do not have 

the capacity, space or staffing to handle the increased ITIN traffic. Second, 

not all ITIN applicants live near such IRS locations and those in foreign 

countries would have virtually no place to go. Third, assistance to 

customers with other tax issues would be diminished, particularly when 

the ITIN workload now only represents about 7 percent of the customers 

assisted. IRS also noted that verifying identification documents would be 

burdensome on customers and costly for IRS, particularly when a 

significant proportion of the documents come from foreign sources. 

Difficult Issues Arise 

When Illegal Resident 

Aliens Receive ITINS, 

Become Employed, 

and Receive Wage 

Income

Because many ITINs are provided to aliens who are not authorized to work 

but who nevertheless do, employers and government agencies face many 

difficult issues. Often, these issues center on what role employers and 

agencies have, or should have, in furthering the federal policy that 

immigrants should only be in the United States legally. 

Employees who are illegal resident aliens likely provide employers 

inaccurate TINs, which could be either SSNs or ITINs. In this context, 

employers’ concerns that they might be penalized if they provide 

inaccurate wage reports to IRS and SSA appear largely unfounded if they 

do what they are required to do. Employers also appear to have been 

concerned about what they are expected to do under the government’s 

broader policies on illegal immigration. However, if employers do what is 

required in verifying the identity and work eligibility of employees, they 

appear to limit the likelihood of needing to take additional actions under 

DHS guidance related to possible illegal resident aliens. 

When illegal resident aliens obtain employment and earn wages, IRS has 

data that could provide DHS enhanced information to use in targeting its 

enforcement efforts. However, to differing degrees, officials cite limited 

resources, other data sources available to them, legal restrictions, and 

potential impact on voluntary compliance as factors affecting their 

decisions about whether and how to share data.
Page 14 GAO-04-529T 

Tax Returns Using ITINs 

Often Involve Illegal 

Resident Aliens and Their 

Associated Wage 

Statements Likely Show Up 

in SSA’s Earnings Suspense 

File

IRS and TIGTA have concluded that many of the taxpayers who file tax 

returns with ITINs are illegal resident aliens. Although estimates are not 

precise, according to TIGTA, hundreds of thousands of the tax returns filed 

with ITINs each year likely involve employed illegal resident aliens. 

Because a substantial portion of these returns have forms W-2 attached 

with SSNs as the identifying number, they likely lead to hundreds of 

thousands of new records being added annually to SSA’s earnings suspense 

file—a large and growing file of wage earnings for which SSA cannot 

identify the owner.

In a December 2003 letter that responded to a TIGTA report,13 IRS 

concluded that most resident aliens who have ITINs and also report wage 

income were not legally employed in the United States because they used 

an ITIN instead of a valid SSN on their tax returns. If these individuals had 

qualified for an SSN, they would not need to file with an ITIN. Further, IRS 

said that it believes that most ITIN holders whose wages are reported on 

Forms W-2 are using stolen or fabricated SSNs.

In this report, TIGTA had estimated for tax year 2000 that 353,000 resident 

aliens who were not authorized to work in the United States filed a tax 

return with an ITIN and also reported wages. TIGTA concluded that these 

individuals likely were unauthorized resident aliens (i.e., illegal resident 

aliens) since they did not use an SSN as their identifying number on the tax 

return. TIGTA estimated that at least 265,000 of these returns had Forms 

W-2 attached that did not use valid SSNs. 

These illegal resident aliens can contribute to the size of SSA’s earnings 

suspense file when they work and provide their employers an incorrect 

identification number and/or name. New employees are supposed to fill 

out an IRS Form W-4 (Employee’s Withholding Allowance Certificate) 

when they begin employment to identify how many, if any, exemptions to 

claim for income tax withholding, and must provide their name and SSN. 

The employer uses the W-4 information to help complete a Form W-2 to 

report wages the employee earned and the amount withheld for income tax 

purposes for the calendar year. The Form W-2 is sent to SSA, which uses 

the form to record the employee’s earnings for use in determining future 

benefits. After recording the wages, SSA forwards the Form W-2 

13Internal Revenue Service’s Individual Taxpayer Identification Number Creates 

Significant Challenges for Tax Administration, Treasury Inspector General for Tax 

Administration, Jan. 2004, Reference Number 2004-30-023.
Page 15 GAO-04-529T 

information to IRS so that IRS can match the wages reported on the W-2 to 

those reported by the taxpayer on a tax return.

If an illegal resident alien provides an ITIN or an SSN (someone else’s or an 

SSN-like number that was made up) on the W-4 and the employer records 

the name and number on a W-2 form, those numbers will show up as 

“mismatches” when SSA attempts to validate that the employee’s name and 

number match those in SSA’s records. In these cases, SSA posts a record 

of the wage earnings into its suspense file.

Although it is difficult to compute their precise impact, ITIN mismatches 

represent a very small portion of the postings to the earnings suspense file 

since it was created and since the ITIN was created. Based on a 

preliminary analysis in 2002 of SSA data for 1996 (when the ITIN was 

created) through 2000 (the most recent year of available data then), the 

suspense file contained roughly 119,000 numbers that looked like ITINs14

and wages of about $936 million. The entire file contained over 230 million 

postings and more than $365 billion in uncredited wages through 2000. For 

those same years (1996 through 2000), about 38 million additional postings 

(with about $166 billion in wages) entered the suspense file.15 Thus, the 

initial computation of about 119,000 numbers with wages reported under 

likely ITINs represented about 0.3 percent of new postings and about 0.6 

percent of new wages added to the suspense file between 1996 and 2000.

Illegal resident aliens’ use of SSNs that are not valid for employment 

purposes likely accounts for more of the growth in SSA’s suspense file than 

does their use of ITINs. We did not attempt to compute the growth in the 

suspense file that may be due to illegal resident aliens improperly using an 

SSN. However, as discussed earlier, for tax year 2000, TIGTA estimated 

that at least 265,000 tax returns16 had W-2s attached that used invalid SSNs, 

which is higher than the 119,000 likely ITINs in the suspense file since 1996. 

14We did not confirm that each Form W-2 actually reported an ITIN because we did not cross 

match the SSA records with an IRS file of issued ITINs. Rather, we counted all numbers in 

the suspense file that appeared to be an ITIN due to their ITIN-like format.

15For a number of reasons, the number of suspense file accounts fluctuates daily, making a 

precise count difficult. While new accounts enter the suspense file, others are withdrawn. 

SSA has the ability to resolve certain types of identification problems for some of the 

accounts. Also, individuals come to SSA to report errors in their earnings records. These 

numbers on the accounts in the suspense file cover through tax year 2000, as of November 

2003.
Page 16 GAO-04-529T 

If Employers Do What Is 

Required, They Appear to 

Face Little Likelihood of 

Being Penalized

Employers’ concerns about potentially being penalized by IRS if they 

submit inaccurate wage reports—which can occur when illegal resident 

aliens provide them ITINs or SSNs upon obtaining employment--appear to 

be largely unfounded if employers do what is required. Further, if 

employers do what is required of them, they also appear to minimize their 

responsibilities to take additional actions under DHS regulations related to 

possible illegal resident aliens. 

Employers have responsibilities to IRS, SSA, and DHS when they hire 

employees. In addition to the Forms W-4 and W-2 responsibilities, 

employers are responsible under DHS regulations for verifying employees’ 

identity and employment eligibility. Employers must ensure that 

employees fill out a DHS Form I-9 (Employment Eligibility Verification 

Form) when they start work. Employers must review documents provided 

by employees establishing their identity and eligibility to work and retain 

the Form I-9 for 3 years after a person begins work or 1 year after a 

person’s employment is terminated. 

Pursuant to your interest, we contacted two groups that represent 

employers to better understand what concerns, if any, they may have about 

their responsibilities to these agencies. Officials from those groups did not 

provide us any examples where the guidance of IRS, SSA, and DHS were 

directly in conflict. 

However, based on our review of two IRS letters,17 it appeared that some 

employers may have believed that (1) they had greater responsibilities than 

they actually do under IRS guidance and those perceived responsibilities 

might lead to penalties, and (2) following one agency’s advice may put them 

at risk with another agency. Representatives of one of the employer groups 

we spoke with said that IRS’s responses, as partially described below, 

allayed their concerns by clarifying actions employers are required to 

undertake. 

16In its report, TIGTA stated that computed the margin of error for this estimate was plus or 

minus 17,732.

17On July 24, 2002, the American Society for Payroll Management sent a letter and IRS 

responded to their concerns on January 13, 2003. A set of follow-up questions produced 

another IRS response on September 23, 2003. 
Page 17 GAO-04-529T 

The Information Reporting Program Advisory Committee (IRPAC), which 

represents those (such as employers) who have interests in IRS’s 

information returns programs, asked IRS about any advantage or 

disadvantage to using IRS’s TIN matching program or SSA’s SSN 

verification systems18 for purposes of information reporting accuracy 

penalties.19 The inference from this question appeared to be that some 

employers believed they were required or expected to use these systems to 

verify that the SSN provided by an employee was correct. IRS’s response 

clarified that (1) the TIN-matching program was not available to employers 

for this purpose due to statutory restrictions and (2) employers only have 

to ask an employee fill out a Form W-4 and then can rely on the SSN as 

provided on that form. IRS clarified that under its rules employers have no 

responsibility to verify the accuracy of the SSN provided by the employee. 

In general, IRS informed employers that they must solicit an SSN from the 

employee when the employee is hired by having the employee fill out a 

Form W-4. The employer should retain the Form W-4 in its records and use 

the SSN provided on the Form W-4 when completing a W-2 to report wages 

paid to the employee. If IRS subsequently notifies the employer that the 

SSN is invalid, the employer may need to solicit an SSN from the employee 

once or twice more. The employer may rely on the SSN provided by the 

employee with no further verification. 

The employers’ questions to IRS also implied that they were concerned that 

fulfilling their responsibilities to IRS might create the need to take action to 

comply with DHS requirements. In its letter to IRS, IRPAC noted that 

federal immigration representatives had told some employers that if an 

employer used SSA’s SSN verification system or IRS’s TIN matching 

program, a mismatch notice would constitute constructive notice of a 

possible work authorization issue. In general, if questions arise about an 

employee’s work authorization, DHS guidance provides that an employer 

might need to take certain actions, such as providing the employee another 

opportunity to provide proper Form I-9 documentation. We did not verify 

18TIN Matching is an IRS program that allows payers who submit certain information returns 

subject to backup withholding taxes when the payee does not provide a TIN to match payee 

TIN and name combinations against IRS records prior to submitting information returns. 

SSA’s verification system is a system that employers may choose to use in an effort to verify 

that an SSN matches a given individual’s name. 

1926 U.S.C. §6721 provides for a penalty for failure to file a complete and accurate 

information return, including a failure to include the correct TIN (or SSN). The penalty is 

$50 per return up to $250,000 per year.
Page 18 GAO-04-529T 

whether a mismatch could be constructive notice of a work authorization 

issue. However, because employers cannot use the TIN matching program 

for this purpose and are not required to use SSA’s SSN verification system, 

employers can avoid possibly having constructive notice of a work 

authorization issue by simply not verifying an employee’s identity.

Greater Data Sharing 

Regarding ITIN Taxpayers 

Might Help DHS Identify 

Illegal Immigrants, But 

Several Issues Affect Any 

Decision to Increase Data 

Sharing

Enhanced sharing of IRS data might help DHS in addressing illegal 

immigration, but whether and how to share data is a complex policy issue. 

Such data sharing could provide DHS additional information to use in 

targeting its enforcement efforts. However, to differing degrees, officials 

cite limited resources, other data sources available to them, legal 

restrictions, and potential impact on voluntary compliance as factors 

affecting their decisions about whether and how to share data.

Among IRS’s principal responsibilities, IRS is to ensure that all taxpayers 

meet their tax obligations, including illegal resident aliens who are not 

authorized to work in the United States but who have a tax obligation. 

Among SSA’s responsibilities is ensuring that individuals who have paid 

social security taxes on their covered earnings receive credit. Such credit 

is important so that workers will receive the benefits to which they are 

entitled based on their work, even persons with such earnings from 

unauthorized work. In addition to other responsibilities, DHS is 

responsible for enforcing the nation’s immigration laws, including deterring 

illegal immigration and locating and deporting illegal resident aliens.

As discussed earlier, IRS data may identify hundreds of thousands of 

individuals who are likely to be illegal resident aliens. Individuals who 

obtain ITINs and report wage income on a tax return may be illegal resident 

aliens. IRS has data that could be used to identify illegal resident aliens 

and/or their employers. The data would include such specifics as an 

individual’s name, address, and place(s) of employment in the last calendar 

year.

Although DHS officials we spoke with said that IRS data might be useful in 

carrying out their responsibilities, they noted that they have other sources 

of data on illegal immigrants and have limited resources to pursue all 

potential leads on illegal immigration. Further, they recognized that 

current statutory restrictions on sharing tax data would need to be 

modified to permit sharing of IRS data with them.20
Page 19 GAO-04-529T 

IRS officials similarly noted a number of issues that relate to increasing 

data sharing among the agencies. IRS officials said that they cannot share 

these data with DHS under current statutory restrictions on the sharing of 

tax data. IRS officials also said that any consideration of additional sharing 

of tax data with federal agencies requires substantial justification and 

should be considered in rare circumstances because the confidentiality of 

tax data is considered to be fundamental to taxpayers’ willingness to 

voluntarily and accurately report their tax obligations. Finally, IRS officials 

also noted a potential adverse effect of increased data sharing. To the 

extent that illegal resident aliens become aware of greater sharing of 

information by IRS with other agencies, some of the individuals may move 

into “underground” jobs and avoid their tax obligations. Thus, IRS faces a 

fundamental tension in considering steps that might further other agencies’ 

achievement of their missions but that potentially undercut IRS’s ability to 

ensure that all taxpayers, regardless of their legal immigration status, meet 

their tax obligations. 

Concluding 

Observations

IRS’s creation of the ITIN helped it resolve several tax administration 

challenges. However, in creating the ITIN, IRS opened an avenue for 

individuals to use to establish an identity and to blend into society. IRS’s 

controls over the issuance of ITINs have been limited and consequently, we 

had little difficulty obtaining an ITIN with bogus documents and then using 

that ITIN, as well as a completely made up ITIN, to take additional steps to 

blend into society. IRS’s recent efforts to improve its ITIN issuance 

process—which changed the application procedures from those we tested-

-might make it somewhat more difficult to obtain an ITIN with bogus 

information but do not fully address the weaknesses we exploited. 

Because a significant but not precisely known number of ITIN holders are 

illegal resident aliens, tax return data that IRS receives could potentially 

assist DHS in carrying out enforcement of immigration laws. However, 

agency officials have not aggressively sought to enhance data sharing, 

citing limited resources, legal restrictions, and possible voluntary 

compliance impacts. Changing the current statutory provisions that limit 

the sharing of tax-related data with agencies or emphasizing enhanced 

20Section 6103 of the Internal Revenue Code allows IRS to disclose taxpayer information to 

federal agencies and authorized employees of those agencies, but only under specific 

conditions. Section 6103 does not currently authorize data sharing between IRS and DHS 

specifically for immigration enforcement. 
Page 20 GAO-04-529T 

efforts by IRS, SSA, and DHS to address the presence of illegal resident 

aliens are difficult policy issues. For instance, to what extent would 

increased data sharing undermine the willingness of taxpayers to 

voluntarily and accurately report information IRS needs to administer tax 

laws? What priority should these agencies place on addressing illegal 

resident aliens versus their other responsibilities? Given the legal, 

budgetary, and policy issues attendant to increased data sharing, this 

hearing is one opportunity for Congress to consider whether to provide 

new guidance to the agencies on how to proceed.

Messrs. Chairman, this concludes my prepared statement. I would be 

happy to respond to any questions you or other Members of the 

Subcommittees may have at this time.

For further information on this testimony, please contact Michael Brostek 

at (202 512-9110) or brostekm@gao.gov. Individuals making key 

contributions to this testimony include George Guttman, Jay Pelkofer, and 

Tom Short.

(450265)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The General Accounting Office, the audit, evaluation and investigative arm of 

Congress, exists to support Congress in meeting its constitutional responsibilities 

and to help improve the performance and accountability of the federal government 

for the American people. GAO examines the use of public funds; evaluates federal 

programs and policies; and provides analyses, recommendations, and other 

assistance to help Congress make informed oversight, policy, and funding 

decisions. GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and fulltext files of current reports and testimony and an expanding archive of older 

products. The Web site features a search engine to help you locate documents 

using key words and phrases. You can print these documents in their entirety, 

including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and 

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site 

daily. The list contains links to the full-text document files. To have GAO e-mail this 

list to you every afternoon, go to www.gao.gov and select “Subscribe to 

e-mail alerts” under the “Order GAO Products” heading.

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. A check 

or money order should be made out to the Superintendent of Documents. GAO 

also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single 

address are discounted 25 percent. Orders should be sent to:

U.S. General Accounting Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Public Affairs Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800

U.S. General Accounting Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548