text: Background Authentication Provides IRS Reasonable Assurance That It Is Interacting with Legitimate Taxpayers IRS authenticates taxpayers to provide the agency with reasonable assurance that it is interacting with the legitimate taxpayer. IRS verifies that it is interacting with the legitimate taxpayer through identity proofing and authentication. Identity proofing is the process of first establishing that people are actually who they claim to be. Authentication is the process of verifying that returning users are who they say they are by requiring the use of one or more authenticators—such as a password, a cryptographic key, or a fingerprint—before allowing them access to sensitive data or a resource. In this report, we refer to both steps collectively as “authentication.” For high-risk interactions, such as access to prior year tax information, authentication can help IRS avoid improperly disclosing PII or issuing a fraudulent refund. Authentication is particularly important for combatting IDT refund fraud, which occurs when a fraudster obtains an individual’s SSN, date of birth, or other PII and uses it to file a fraudulent tax return seeking a refund. IDT refund fraud can also affect businesses. Specifically, fraudsters can use business information to file a fraudulent corporate return requesting a refund. According to IRS officials, fraudsters can file false employer Form W-2, Wage and Tax Statements (W-2) to support fraudulent individual returns seeking refunds. We have previously reported that when IRS suspects that a tax return is fraudulent, it will stop the return from further processing, and attempt to notify and authenticate the taxpayer before issuing the refund. Authentication can be accomplished using different methods depending on the risk of the interaction. Single-factor authentication: Useful when someone wants to access a low-risk system or service, this method may require only a user name and password. Multi-factor authentication: For high-risk interactions such as access to systems that include PII or financial information, this method requires at least two of the following: “something you know” (e.g., a user name and password); “something you have” (e.g., a mobile phone or cryptographic key); or “something you are” (e.g., a fingerprint or other biometric data). Designing authentication programs involves a balancing act—IRS needs to prevent fraudsters from passing authentication using stolen taxpayer information, but it must balance that against the burden on legitimate taxpayers who must also authenticate. If IRS makes the authentication process too stringent, legitimate taxpayers may not be able to successfully authenticate to, for example, access their prior year tax information or have IRS release a frozen refund. Conversely, if the process is too easy, fraudsters will likely be able to authenticate as easily as legitimate taxpayers. Industry representatives told us that identity proofing and authentication are becoming more difficult with the wide availability of PII. Further, according to NIST, it is challenging for organizations to authenticate users remotely via a web application because the processes and technologies to establish and use digital identities offer multiple opportunities for impersonation or other attacks. These interactions may become even more difficult and risky for organizations like IRS, who may interact with a taxpayer only once a year. As shown by the data breaches discussed at the beginning of this report, fraudsters are persistent in their efforts to exploit weaknesses in online systems and, in the context of IRS, access sensitive taxpayer information. For example, IRS reported that, between January and March 2017, fraudsters were able to use PII to access information from 100,000 taxpayer accounts through IRS’s Data Retrieval Tool. According to the Treasury Inspector General for Tax Administration, identity thieves may have used PII obtained outside the tax system to start the Free Application for Federal Student Aid (FAFSA) application process and access tax information through the Data Retrieval Tool. Further, we have previously reported that fraudsters can use PII obtained in a data breach to more easily create fraudulent returns that resemble authentic tax returns, making it more difficult for IRS to detect potential fraud. Even as IRS has adapted its IDT defenses, fraudsters have developed more complex and sophisticated methods to bypass those defenses and commit fraud undetected. IDT refund fraud affects IRS, state revenue offices, tax preparers, tax software companies, and financial institutions. According to industry representatives, as these entities improve security in one area prone to fraud, fraudsters’ methods evolve to target a weaker area. For example, in March 2016, IRS alerted payroll and human resource professionals of a phishing e-mail scheme in which fraudsters posed as company executives and requested personal information on employees via e-mail, including W-2s. With this information, fraudsters can imitate the legitimate taxpayer and file fraudulent tax returns seeking refunds. In January 2018, IRS reported that the agency received about 100 reports of W-2 phishing schemes in 2016 and about 900 reports in 2017. IRS also reported that more than 200 employers, affecting hundreds of thousands of employees, were victimized by W-2 phishing schemes in 2017. IRS Has Broad Efforts Underway to Address IDT and Authentication Challenges IRS is working to address these challenges, in part, by collaborating with industry—including tax software companies, the tax preparer community, and financial institutions—as well as state partners. In March 2015, the former IRS Commissioner convened a Security Summit with industry and states to improve information sharing and fraud detection and to address common challenges. The Summit led to the creation of seven workgroups to combat IDT refund fraud across multiple platforms. Each workgroup is led by three co-leads—one each from IRS, state departments of revenue or state associations, and industry partners. These workgroups collaborate on initiatives to improve IDT refund fraud prevention and detection, including authentication. In 2015, IRS also established the Identity Assurance Office (IAO) to increase insight into authentication and fraud detection needs agency- wide, including authentication services delivered via four channels: telephone, online, in-person, and correspondence (i.e., postal mail— hereafter referred to as mail—or fax). Among other responsibilities, IAO works with stakeholders across IRS to review the agency’s various authentication programs, including assessing risks of current and planned authentication efforts across the four channels and identifying ways to mitigate these risks. In December 2016, IAO released its IRS Identity Assurance Strategy and Roadmap (Roadmap) for developing a modern and secure authentication environment for all taxpayers, regardless of how they interact with IRS. NIST Established New Requirements for Digital Authentication Among other things, the National Institute of Standards and Technology (NIST) develops and maintains standards, guidelines, recommendations, and research on the security and privacy of information and information systems. In June 2017, NIST released guidance on digital authentication to help agencies improve the security of their identity-proofing and authentication programs. In its new guidance, NIST breaks down the digital identity environment into three separate components of assurance: 1. Identity proofing: establishing that the person is actually who they 2. Authentication: establishing that the person attempting to access a service is in control of one or more valid authenticators associated with that person’s identity; and 3. Federation: the concept that one set of user credentials can be used to access multiple systems. The guidance directs agencies to assess the risk for each component of identity assurance, rather than conducting a single risk assessment for the entire process. According to NIST officials, this new approach provides flexibility in choosing identity proofing and authentication solutions; aligns with existing, standards-based market offerings; is modular and cost-effective; and enhances individual privacy. In addition to NIST’s new requirements for authentication, recent technology advances and private-sector innovation are providing new options for identity proofing and authenticating users, including in cases where, for example, IRS interacts with taxpayers once a year. Some examples of these technologies include physical biometrics, such as facial recognition, as well as behavioral biometrics, such as voice patterns, computer keystroke or mouse use patterns, swipe patterns, and gait analysis. IRS Incorporates Risk and Other Factors to Guide Authentication Decisions for Taxpayer Interactions IRS Identifies Interactions that Require Authentication and Estimates Risk to Determine Authentication Approach According to IRS documents and discussions with officials, the agency considers risks to both the taxpayer and IRS when making decisions about how to approach authentication, which is consistent with federal guidelines. In making these decisions, IRS considers how individuals would be affected by the unauthorized release of sensitive information. IRS also considers the impact on the agency, including the potential for financial loss or harm to IRS programs or services, and loss of public trust. In 2016, IRS identified over 100 interactions between the agency and taxpayers that require authentication. The interactions range in risk level and IRS categorized them based on the potential for incorrect payment of refunds, disclosure of taxpayer information, and critical impacts on IRS operations. High-risk interactions include when an individual taxpayer establishes an online account with IRS, which provides access to prior year tax information and other PII, or when a taxpayer is asked to confirm his identify before IRS processes what the agency considers to be a potentially fraudulent tax return. Lower-risk interactions include paying a tax bill online. According to IRS, as the risk level of taxpayer interactions increases—for example, interactions that involve sensitive financial information—the authentication process becomes more rigorous. This enhanced security helps reduce the possibility that a fraudster can successfully authenticate. Further, if tax professionals want to conduct business with IRS online, such as when working on behalf of a client to file a return or request a prior year’s tax transcript, they must establish an account and authenticate their identity. IRS Can Authenticate Taxpayers through One or More Channels According to IRS, the agency determines the means by which a taxpayer or tax professional can authenticate his or her identity and what data are required during the authentication process to appropriately minimize risk to the agency. IRS officials told us that the agency works to balance potential risks against its resources and mission to provide all taxpayers access to IRS services and support. IRS performs authentication through the following channels. Telephone. Taxpayers can authenticate via telephone with a customer service representative (CSR) for selected higher-risk interactions with IRS, such as in cases of suspected IDT refund fraud. Telephone authentication can require taxpayers to respond to knowledge-based questions that a fraudster would not likely know. For example, for high- risk interactions, taxpayers must answer additional tax return-related questions. Taxpayers who fail to respond correctly to these questions are then required to authenticate in person at a Taxpayer Assistance Center. For certain lower-risk interactions, taxpayers can authenticate through an automated telephone system. In-person. For some interactions with IRS, taxpayers can authenticate their identity directly with an IRS employee at 1 of IRS’s approximately 400 Taxpayer Assistance Centers located throughout the country. Taxpayers may need to present one or more government-issued forms of identification and other documents, such as a utility statement, depending on the level of authentication required for the specific interaction. Online. IRS authenticates taxpayers online for both high-risk and lower- risk interactions. For high-risk interactions such as requesting a tax transcript or looking up an Identity Protection Personal Identification Number (IP PIN), taxpayers must pass a multi-factor authentication process using IRS’s Secure Access platform. IRS launched Secure Access in June 2016 following the Get Transcript data breach and, as of April 2018, was using it for 11 applications including authentication for Get Transcript, IP PIN, and the online account. Officials told us they plan to implement Secure Access for other IRS applications in 2018. Taxpayers authenticating through Secure Access establish an account by providing IRS with a valid e-mail address, basic personal information, and personal financial information. Taxpayers then provide IRS a mobile phone number and IRS sends the phone an activation code that the taxpayer enters online. This step validates that the taxpayer possesses the mobile phone. IRS authenticates returning users via a security code. For lower-risk interactions, taxpayers may authenticate online by answering several knowledge-based questions, such as questions about their current return to learn the status of their refund. Correspondence. In some cases, taxpayers can submit documents or request tax information via correspondence, which are then reviewed by IRS and authenticated by matching against information in IRS’s systems. This method can require that IRS send the requested documents (such as a tax transcript) only to the taxpayer’s address of record, or require the taxpayer to include a photocopy of identification. For example, in some instances, taxpayers who cannot authenticate via telephone and cannot travel to a Taxpayer Assistance Center in person may be able to authenticate by mail. Each authentication channel requires different IRS resources. These resources include IRS staff and overhead; contracts with vendors that provide identity verification services; and costs inherent to the specific channel, such as mailing costs. Figure 1 summarizes IRS’s authentication channels and illustrates a number of the interactions that taxpayers or tax professionals can accomplish through one, or several, channels. It also illustrates the differences in costs per transaction. According to IRS data, in-person authentication at a Taxpayer Assistance Center is the most expensive way to authenticate taxpayers (about $89 per interaction), followed by telephone (about $54 per interaction). Online authentication costs the least, at less than $1 per interaction. According to the National Taxpayer Advocate, while requiring the appropriate level of authentication is necessary to protect IRS against fraudsters, the agency also needs to offer taxpayers a range of options for interacting with IRS. IRS’s Authentication Programs and Services Are Designed to Reduce Fraud In this report, we focus on four key IRS programs and services that require authentication: Taxpayer Protection Program (TPP). Through TPP, IRS reviews tax returns that are flagged by IRS’s IDT filters as potentially fraudulent, such as when a return includes characteristics of known fraud schemes. IRS sends a letter notifying taxpayers that they must authenticate their identity before IRS will process the return or issue a refund. According to IRS, in fiscal year 2017, more than 1.9 million taxpayers received such a notification, and IRS authenticated about 1.17 million of them. These taxpayers could verify their identity via telephone, in-person, and correspondence. In August 2016, IRS suspended its TPP online authentication service because of potential system security weaknesses. In mid-March 2018, IRS relaunched the first phase of a more secure TPP online authentication service, which is discussed later in this report. Get Transcript. This service allows individual taxpayers to request and receive a copy of their prior years’ tax information. The transcript contains information from the taxpayer’s tax filing history, such as information from Form 1040, U.S. Individual Income Tax Return, that can be used, for example, when applying for a mortgage or student loan, or to electronically file (e-file) an upcoming tax return. Taxpayers can request the transcript online or in-person (to be delivered online or via mail); over the telephone (to be delivered via correspondence); or by correspondence (to be delivered via mail). Taxpayers must provide authentication information before IRS will process their request. According to IRS, in fiscal year 2017, IRS delivered about 26.4 million transcripts, with about 59 percent of transcripts delivered online. IP PIN. IRS assigns each victim of IDT a single-use identification number to be used to file a future electronic or paper tax return. IRS also offers taxpayers in Florida, Georgia, and the District of Columbia the option to request an IP PIN to help prevent IDT in these high tax- related IDT locations. IRS automatically rejects e-filed returns if they do not include the IP PIN and will delay paper returns for extra examination when taxpayers file without the IP PIN. According to IRS, the agency mailed 3.5 million IP PINs to be used during the 2017 filing season. IRS’s Online Services. IRS has developed a number of online services that require taxpayers and tax professionals to authenticate before accessing information online. For example, taxpayers who have established a verified online account can set up an online payment plan. Taxpayers can also check the status of their refund, as well as update their address of record. Taxpayers can also use IRS’s mobile application for some of these actions, such as checking the status of a refund or making a payment to IRS. Similarly, through IRS’s e-Services, tax professionals who have been vetted and approved by IRS can manage their e-file accounts, file tax returns on behalf of clients, and view their clients’ tax return information. As noted in figure 2, the volume of taxpayers authenticated for each IRS program or service varies by channel. Further, although TPP costs IRS more than Get Transcript and affects far fewer taxpayers, IRS reported that TPP helped prevent $5.3 billion in lost tax revenue in calendar year 2016. IRS Has Made Progress on Its Authentication Efforts, but Has Not Prioritized Authentication Improvements and Is Not Sufficiently Assessing and Monitoring Risks for All Channels IRS Has Begun to Implement Its Authentication Strategy, but Has Not Articulated Priorities and Resource Needs IRS has identified high-level strategic campaigns, or efforts to enhance identity assurance, in its Identity Assurance Strategy and Roadmap (Roadmap) and has established a business process to support these efforts. However, IRS has not articulated relative priorities for the foundational initiatives supporting its strategic efforts or the resources it will require to complete them. As discussed earlier, IRS’s 2016 Roadmap is the agency’s plan for developing a modern and secure authentication environment for all taxpayers regardless of how they interact with IRS. The Roadmap outlines six core authentication objectives, followed by 10 high-level strategic efforts, and 14 foundational initiatives to help IRS address its authentication challenges and identify opportunities for future investment. (See appendix II.) Further, IRS has identified about 90 activities to support its foundational initiatives and the responsible organizations and general duration to complete them. These initiatives include, for example, implementing a risk assessment framework that can be applied across all authentication channels and services; developing a framework of identity proofing and authentication requirements for third parties accessing and using IRS data and services; and improving taxpayer assurance by sending automated electronic alerts to taxpayers, such as when they file a return. To support implementation of these initiatives, IRS established a 12- member executive governance board. Board members are senior executives from business units across IRS, including the Identity Assurance Office (IAO), IT Applications Development, IT Cyber Security, and Wage and Investment. The board helps to monitor progress, risks, and challenges associated with implementing its Roadmap, and has generally met monthly since January 2017. Our prior work on government performance has identified several leading practices for planning at the program or initiative level. Among other things, these practices call for strategic plans to contain the goals and objectives of a program and the human, financial, and information resources required to complete them. Leading practices also call for agencies to develop estimates of benefits and costs to help prioritize new investments. Following these practices can help agencies establish priorities in a complex environment. IRS has made progress on some of the strategic efforts identified in its Roadmap. For example, consistent with its core objectives, IRS has taken steps to enhance fraud detection by improving telephone authentication procedures and expanding its online authentication services. In October 2016, IRS implemented a new process for high-risk telephone authentication, which includes generating questions for the taxpayer using data from internal IRS systems instead of from third-party data or credit reporting agencies. In addition, in March 2018, IRS launched the first phase of its improved online authentication service for TPP, called ID Verify. According to IRS officials, the first phase of the service will be available to taxpayers who did not file the return in question and appear to be victims of IDT refund fraud. The second phase, which IRS plans to implement later in 2018, will expand the service to all taxpayers selected for TPP. While IRS’s Roadmap demonstrates the breadth of the agency’s strategic vision and core objectives, it does not articulate the resources IRS needs to implement any of its 14 foundational initiatives and their supporting activities. For example, one of IRS’s foundational initiatives is to send event-driven notifications to taxpayers, such as when they file a return or request a tax transcript. Such notifications could help IRS detect potentially fraudulent activity at the earliest stage and improve authentication of tax returns. The Roadmap identifies seven supporting activities for this foundational initiative. One is to provide taxpayers with greater control over their online accounts. Another supporting activity is to determine methods for sending notifications to taxpayers about activity on their account. However, IRS has not identified the resources required to complete these activities, and the Roadmap notes that six of the seven activities will take between 6 months to 3 years to complete. In December 2017, IRS officials stated that they had developed business requirements for the foundational initiative to give taxpayers greater control over their online accounts. However, IRS has not identified funding for the initiative’s other supporting activities—such as developing requirements to send push notifications to taxpayers—and implementing them will depend on the availability of future resources. Further, while IRS has developed a business process that would help the agency prioritize initiatives, the process has not been fully implemented. In 2015, we recommended that IRS estimate and document the costs, benefits, and risks of possible options for taxpayer authentication, in accordance with OMB and NIST guidance. Consistent with our recommendation and its Roadmap, IRS developed a process to assess the costs, benefits, and risks of current and potential authentication tools. In May 2017, IRS implemented its business decision model to analyze and improve its online taxpayer authentication services and provided us with results from an analysis for implementing a text-to-voice functionality for IRS’s Secure Access online authentication platform. This function would allow taxpayers the option of receiving an automated voice code for authentication on a verified landline (instead of a text message on a mobile phone). As a result of this analysis, IRS approved the proposal to implement this tool. However, in December 2017, IRS officials stated that the text-to-voice tool is not moving forward because of other competing IT improvements and funding constraints. Further, IAO has not yet applied the business decision model to other potential authentication initiatives, such as those identified in its Roadmap. In December 2017, IRS officials stated that each of the strategic efforts and foundational initiatives identified in the Roadmap are a high priority, and they are working to address them concurrently while balancing the availability of resources against the greatest threats to the tax environment. We recognize that a strategy is necessarily high-level and that IRS must remain flexible and use necessary resources to respond to unexpected threats. At the same time, clearly identifying resources and prioritizing its initiatives and activities will help clarify the relationships between IRS’s authentication efforts and resource needs relative to expected benefits. Further, such efforts may also help IRS establish clearer timelines and better respond to unexpected events. IRS Has Not Established a Policy to Assess Risks for Telephone, In-Person, and Correspondence Authentication While IRS has generally performed regular risk assessments on its online authentication applications, it does not perform comparable assessments to identify, assess, and mitigate risks for its telephone, in-person, and correspondence authentication channels. Federal guidance directs agencies to regularly assess and address the risks of government IT systems. Specifically, OMB requires agencies to conduct annual risk assessments on IT systems performing remote authentication. The assessments should also be conducted when the agency plans to modify its business processes or technology. This includes reviewing new and existing electronic transactions to ensure that authentication processes provide the appropriate level of assurance outlined in NIST guidance. While federal guidelines broadly require agencies to identify and manage risks and establish specific requirements for programs using online authentication, no corresponding federal guidelines exist for telephone, in-person, and correspondence authentication, although we have previously reported that federal guidance and standards are applicable to IRS’s phone authentication. Similarly, our Framework for Managing Fraud Risks in Federal Programs directs agencies to conduct fraud risk assessments at regular intervals and when there are changes to the program operating environment, as assessing fraud risks is an iterative process. Previously, such risk assessments have helped IRS identify security weaknesses and, in some cases, have led the agency to take an authentication service offline. For example, in response to a recommendation we made in May 2016, IRS performed an updated risk assessment on TPP’s online authentication service, a key defense against IDT refund fraud. Based on the results of this assessment, IRS disabled its online authentication service until it could appropriately address the security weaknesses that it identified. Consistent with federal guidance, IRS has identified and analyzed risks associated with services and programs requiring online authentication, including TPP, Get Transcript, and IP PIN, among others. Further, IRS has made recent progress in updating risk assessments and improving security for its online authentication applications. Specifically, between June 2017 and April 2018, IRS reassessed authentication risk levels for some online applications, mitigated risks by moving additional applications behind its Secure Access authentication platform, and identified other compensating controls to appropriately protect its systems. In December 2017, IRS officials stated that they were working to bring remaining authentication applications in line with their most recent risk assessment. They expected to complete this work by the last quarter of fiscal year 2018. IRS has efforts underway to identify risks for telephone, in-person, and correspondence authentication, but has made limited progress implementing its process for assessing risks for all taxpayer authentication channels. As previously discussed, in 2016, IRS identified over 100 interactions that require taxpayer authentication and categorized these into three high-level risk outcomes. According to IRS’s risk assessment process, the next step is for IRS business units to assess the effects of incorrect authentication for each interaction or program, identify gaps in existing processes, and develop options to address the gaps. IRS officials stated that this process involves conducting scenario-based workshops with subject matter experts. However, as of March 2018, this process has only been applied to TPP and one other IRS business practice. In early 2017, IRS conducted a 2- day, internal, scenario-based workshop to assess risks and impacts and to identify gaps for TPP authentication. Workshop participants identified 45 short-, medium-, and long-term potential enhancements to TPP’s authentication processes. However, IRS had not performed similar risk impact assessments for other programs that rely on telephone, in-person, and correspondence authentication—including Get Transcript and IP PIN—and officials do not have a plan or timeline for conducting these assessments. Further, IRS has not developed a plan with time frames to address the deficiencies it identified for TPP. In December 2017, IRS officials stated they are reviewing the 45 TPP enhancements identified by workshop participants, but have no clear plans to implement them because of resource constraints. IRS has made limited overall progress on this front because it does not have a policy that requires regular assessments and timely mitigation of identified issues for telephone, in-person, and correspondence authentication, as is required for online authentication programs and services. IRS also does not have guidelines for mitigating authentication risks to these channels in a timely manner. In late November 2017, the Director of IAO stated that IAO alone does not have the authority to create and implement a policy that compels other IRS business units to use its risk assessment process or mitigate issues in a timely manner. Officials from other IRS business units stated that they continually assess risks to telephone, in-person and correspondence authentication, even without a policy to do so. However, IRS could not provide evidence of such prior risk assessments or risk mitigation plans. IRS’s Roadmap states that it will implement a secure authentication platform for taxpayers regardless of how they interact with IRS—online, via telephone, in- person, or correspondence—to help ensure that information is secure and that the agency is interacting with a legitimate taxpayer. Without a policy for conducting risk assessments for these channels and addressing deficiencies in a timely manner, IRS may underestimate known risks and overlook emerging threats to the tax environment. As a result, these channels may be more vulnerable to fraudulent activity, including unauthorized attempts to access taxpayer information. IRS Lacks Internal Controls to Effectively Monitor Telephone, In- Person, and Correspondence Authentication IRS has established internal controls including procedures and mechanisms to monitor performance of online authentication, but does not have similar controls in place to monitor the performance of telephone, in-person, and correspondence authentication. Federal standards for internal control call for agencies to design their information systems in a way that meets operational needs and allows the agency to respond to risks. Further, agencies are to collect and use quality information to make informed decisions. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Further, to have an effective internal control system, agencies should also establish procedures to monitor and evaluate the performance of programs and systems as part of the normal course of operations. To this end, monitoring should be performed on an ongoing basis, and any deficiencies the agency has identified should be addressed in a timely manner. Monitoring activities are even more critical in an environment where the risk of fraud is high because such efforts allow an agency to quickly respond to emerging risks to minimize the impact of fraud. Further, IRS’s Strategic Plan calls for its organizations to use analytics and research to improve program effectiveness and foster a timely, data-driven decision-making environment. According to IRS documentation and discussions with officials, the Secure Access online authentication platform allows IRS to conduct near real-time monitoring of taxpayer authentication outcomes. Specifically, for each online service using Secure Access, IRS is able to monitor on a daily basis how many taxpayers registered for an account; rates of successful and unsuccessful identity proofing and verification; and suspicious user patterns, such as multiple login attempts. IRS is also able to monitor system error codes for specific steps in the authentication process, such as when the secure messaging process fails. IRS officials stated that this enhanced performance monitoring of online authentication began in June 2016, and it is helping IRS determine where in the authentication process taxpayers may be having difficulties and potential causes of the problem. However, IRS does not have comparable procedures and mechanisms to monitor authentication outcomes for telephone, in-person, and correspondence authentication, particularly for TPP, one of IRS’s key defenses against IDT refund fraud. Further, since August 2016, taxpayers have been able to authenticate using only these channels. IRS currently uses its Account Management Services (AMS) to capture telephone and in-person authentication outcomes for TPP; however, as discussed below, this is not an effective mechanism for monitoring authentication outcomes. AMS is IRS’s primary application for recording, storing, and retrieving information on all types of taxpayer interactions over time. IRS’s customer service representatives (CSR) use AMS to, among other things, record information related to taxpayer authentication performed over the phone or in person for TPP. According to IRS documentation, AMS includes a field where the CSR is to enter the authentication outcome and also an area where the CSR enters notes on the details of the taxpayer interaction. In the context of TPP, IRS officials stated that CSRs use the notes field to record, for example, the reason why the taxpayer failed the authentication process, and other information important for other CSRs to know. IRS also relies on another application to review the status of TPP cases, such as if a case is open or closed. To better understand how CSRs are implementing procedures to capture TPP authentication outcomes in AMS, we analyzed data in AMS from January through October 2017. The result of our analysis and related discussions with IRS officials indicate three primary internal controls issues. First, IRS does not have a reliable, direct mechanism to collect data on the number of taxpayers who pass and fail telephone, in-person, and correspondence authentication. Second, data quality issues make it difficult for IRS to understand why taxpayers may be failing these authentication processes. Third, the IRS organizations responsible for monitoring these channels do not have access to complete AMS data, making it difficult for IRS to identify potential authentication issues and develop solutions to address them. No mechanism to collect reliable, direct data on authentication passes and failures. As previously discussed, when a taxpayer calls IRS or visits a Taxpayer Assistance Center in regard to a TPP letter, the CSR is to enter the result of the authentication (i.e., pass or fail) into AMS with one of nine codes that accurately reflects the authentication outcome. However, AMS does not have a separate, discrete field where the CSR is to enter this information. The field available to capture authentication information is shared with 68 other issue codes, increasing the likelihood that the CSR may select a more generic issue, such as “identity theft” instead of one of the nine codes designated for TPP. Further, one of the TPP outcome codes, called “other issue,” may be too broad for useful analysis. Of the data we reviewed, we found that about one-third of TPP authentication cases were categorized as “other issue,” which provides no information on the authentication outcome. According to IRS’s procedures, this category is to be used in various scenarios, including when IRS does not have enough information to generate questions for authenticating the taxpayer, and in other cases when a taxpayer fails telephone authentication and must go to a Taxpayer Assistance Center. However, by combining all of these issues into one broad category, IRS has limited insight into the size of each particular problem and may be underestimating the number of taxpayers who fail TPP authentication. Further, IRS does not directly capture the results of correspondence- based authentication in AMS and is therefore unable to monitor pass and failure rates for this channel. Issues with data quality. We selected a generalizable random sample of AMS cases identified as TPP authentication failures for January through October 2017 and identified several data quality issues based on our analysis. First, we found that an estimated 19 percent of cases were categorized as an authentication failure, but the content of the CSR notes indicated otherwise. Further, we could not determine a clear match between the TPP authentication outcome and the CSR notes in an additional estimated 18 percent of cases. For example, in these instances, the CSRs’ notes provided no information on why the taxpayer failed authentication, or the notes were clearly unrelated to TPP. Second, we found that CSRs do not consistently enter useful information in the notes explaining why a taxpayer failed authentication, which could provide IRS management with valuable feedback on characteristics of potential fraud or problem areas for legitimate taxpayers. Specifically, our analysis showed that in an estimated 63 percent of cases, CSRs’ notes contained information that was useful or somewhat useful for helping IRS understand why a taxpayer failed authentication. In the estimated 37 percent of cases where we determined that the notes were not useful, CSRs generally documented the outcome (i.e., authentication failure) but not the details on why the taxpayer failed. We recognize that a portion of the TPP authentication failures may represent fraudsters trying to authenticate as a legitimate taxpayer. However, given that IRS’s fraud detection systems have a history of high false positive rates, these failures may also represent legitimate taxpayers who may be having trouble authenticating. Further, while the CSR notes could provide IRS potentially valuable information on why taxpayers may be failing authentication, further data analysis may prove difficult. This is because this information is captured in a free-text notes field, rather than in a drop-down list or other standardized way to record data that can then be analyzed. Further, during our analysis of AMS data, we found variation in the way CSRs enter notes, particularly in their use of abbreviations and shorthand on why a taxpayer failed authentication. Such variation makes systematic data analysis difficult. According to IRS officials and documents we reviewed, there may be several causes for the data quality issues. For example, as noted earlier, CSRs may not be selecting the correct TPP authentication outcome code because there are too many options and procedures may be unclear. IRS officials also noted that when a taxpayer contacts IRS about TPP authentication, they may want to discuss multiple issues. In these cases, the CSR may choose to record information on another issue instead of the authentication outcome. Complete AMS data sets are not readily available for analysis. In addition to the issues described above, the organizations responsible for monitoring TPP telephone and in-person authentication data do not have access to complete AMS data for TPP. IRS officials responsible for managing TPP told us that they do not have direct access to AMS data reports because they are not the system’s business owner. Instead, they receive a weekly extract of AMS data from IRS’s IT department. However, officials stated that this weekly data extract is limited to approximately the first 5,000 records for each issue area or outcome code, including the codes for TPP. IRS IT officials stated that they limited the file size of the AMS weekly report because it became too large to share internally via e- mail. IT officials stated that the free-text notes entries in AMS were the main cause for large file sizes. However, this procedure of emailing an extract of the data, rather than providing direct access to AMS, makes it difficult for IRS to perform comprehensive analyses and ongoing monitoring for TPP using AMS. To put this into further context, IRS officials reported that in fiscal year 2017, they authenticated about 1.13 million taxpayers for TPP via telephone and at Taxpayer Assistance Centers. However, we found only about 471,600 records with a TPP outcome code in the AMS data IRS provided to us. This represents only about 42 percent of the records we were expecting to see in AMS. IRS officials stated that the discrepancy was likely due to the AMS record limit described above. Yet, in the course of our analysis, we found that only a small number of outcome codes over 42 weeks appeared to be affected by this record limit. (See appendix I for details.) IRS officials could not confirm additional explanations for the discrepancy in the number of records. IRS’s Office of Research, Applied Analytics, and Statistics (RAAS) performs research and quantitative analysis on TPP and has studied authentication performance. For example, in April 2017, RAAS reported results of a newly implemented TPP authentication procedure and found that while the new procedures helped to reduce call times, CSRs were not following the procedures correctly in an estimated 44 percent of the calls. According to IRS officials, RAAS’s research efforts provide IRS management with insight into TPP performance and officials have identified areas where TPP can be improved. However, officials face similar data limitations we described above. Further, officials from IRS’s RAAS division stated that they must submit a formal data request with IT in order to receive additional data beyond what is included in the AMS weekly extract. While valuable, these research efforts are not a substitute for ongoing monitoring using complete, reliable data, which would allow IRS to identify and address potential problems in a more timely manner. IRS officials acknowledged that AMS has limitations and stated that they are in the process of planning a new capability in another system to analyze how taxpayers perform on specific questions during the high-risk authentication process. However, this capability will not address the issues in AMS we described above. Further, as of late November 2017, officials were uncertain when this capability would be implemented because of IT funding constraints. Without effective internal control procedures and mechanisms for collecting authentication outcome data, ensuring data quality, and using these data to perform comprehensive analyses and ongoing monitoring of TPP, IRS will continue to have limited insight into its taxpayer authentication operations. As a result, IRS may be challenged in identifying current and emerging threats to the tax system. IRS Is Working with Security Summit Partners to Improve Taxpayer Authentication Through the Security Summit, IRS is working with states, software companies, and financial industry partners to identify how best to address IDT and refund fraud. In February 2018, IRS announced that its key indicators for IDT dropped for the second year in a row and the number of taxpayers who reported they were victims of IDT in 2017 fell by about 40 percent, in part because of the Security Summit’s ongoing efforts to stop suspected fraudulent returns from entering tax processing systems. IRS has also included key efforts led by the Security Summit in its Roadmap. The Security Summit’s authentication workgroup leads several initiatives aimed at verifying the authenticity of the taxpayer and the tax return at the time of filing. One initiative involves analyzing data elements that are collected during the tax return preparation and filing process. In filing season 2017, the authentication workgroup collected data on 62 elements, 37 of which were new for that year. These elements included, for example, trusted customer requirements and other characteristics of the return. In addition, in 2016 the authentication workgroup worked with software providers to improve authentication procedures to protect taxpayers against their accounts being taken over by criminals. According to IRS officials, these improvements were some of the most visible to taxpayers because they included new password standards to access tax software and required the use of security questions. Authentication workgroup leaders also described their efforts to collaborate with industry to address authentication challenges. For example, in 2017, IRS, payroll service providers, and tax software providers expanded the Form W-2, Wage and Tax Statements (W-2) verification code pilot program. The goal of this program is to verify W-2 data submitted by taxpayers on e-filed individual tax returns, using a unique 16-character verification code printed on the form. According to IRS, verification codes appeared on more than 60 million W-2s issued for tax year 2017, compared with about 27.5 million W-2s issued for tax year 2016. Overall, co-leads from each of the sectors expressed positive views about the level of commitment and cooperation guiding the Security Summit authentication efforts. Officials with whom we spoke stated that they are dedicated to continuing to address authentication issues collaboratively because they all have an interest in improving authentication to reduce tax refund fraud. IRS Has Improved Its Authentication Methods, but Additional Actions Could Help Enhance Security IRS Has Taken Preliminary Steps to Adopt NIST’s New Guidance, but Does Not Have a Timeline or Detailed Plans for Full Implementation As described above, in June 2017, NIST released guidance related to online authentication that agencies will need to implement to ensure they are authenticating users in a secure manner. NIST’s guidance is designed to (1) describe the risk management process for selecting appropriate digital identity services and (2) help agencies implement authentication programs that provide reasonable risk-based assurances that a returning user is the same user that previously accessed the service. Adherence to the NIST guidance will help IRS provide reasonable risk-based assurance that the person accessing IRS services is who they claim to be. Further, OMB guidance states that federal legacy systems have 12 months to comply with a new NIST publication, while systems under development or undergoing a major transformation need to use the current revision when deployed. IRS officials told us they have met with NIST officials and plan to update IRS systems and applications to comply with the new security guidelines. IRS officials also noted that the agency has taken preliminary steps to implement the new guidelines. For example, in December 2017, IRS implemented a more secure authentication option through its mobile app, IRS2Go. After taxpayers link their online account with the mobile app, they can use the app to generate a security code to log into their online account. This option is in line with NIST’s new guidance and provides taxpayers with an alternative to receiving the security code via a text message. IRS has also taken other preliminary steps to implement the new NIST guidance, including forming a task force to guide the implementation of NIST guidance, working with the Security Summit to develop an authentication framework that incorporates the new guidance for state and industry partners, starting an analysis to identify gaps between IRS’s current authentication procedures and the new NIST guidance, and updating authentication procedures. However, IRS has not yet established detailed plans, including timelines, milestone dates, and resource needs, for fully implementing the new guidance. IRS officials cited several reasons for the delay. They said the agency will have to balance maintaining current authentication programs with developing IT infrastructure to support technologies that are compliant with the new guidance. In addition, officials stated that they will need to take a slower, incremental approach to updating authentication programs because of resource constraints. In March 2018, IRS officials provided us a draft, high-level analysis of IRS systems relative to the new NIST guidance, including some action items to address potential gaps. This preliminary analysis is a first step to help IRS identify gaps between IRS’s current authentication methods and the new NIST guidance. However, it does not include steps needed to implement the high-level action items, a timeline with milestones, or the resources needed to implement improvements to bring IRS into compliance with the new NIST guidance. IT officials stated that IRS intends to develop its implementation roadmap through 2018 and begin implementing technical solutions in 2019. However, those officials did not identify the technical solutions nor did they have a prioritization plan or documentation of a timeline to fully implement the new NIST guidance. Implementing the new NIST guidance and updating authentication programs to be protected by the appropriate level of assurance is consistent with federal standards for internal control and IRS’s Roadmap. Standards for Internal Control notes that agencies should identify, analyze, and respond to risks, as well as assess whether risk response actions sufficiently reduce risk to an acceptable level. Further, one of IRS’s initiatives in its Roadmap is to strengthen e-authentication and ensure it is in compliance with federal regulations, which includes guidance from NIST. Developing a plan that includes timelines with specific milestones and resource needs to implement the new NIST guidance is consistent with leading practices for effective planning and management. Specifically, in our prior work on the Government Performance and Results Act, we found that developing and using specific milestones and timelines to guide and gauge progress toward achieving an agency’s desired result is a leading practice for effective strategic planning and management. Further, our body of work on IRS has noted that developing project plans with measurable goals, schedules, and resources can help the agency more effectively plan new projects and initiatives. According to IRS officials, IRS must balance the needs of its existing authentication efforts against potential new investments. IRS’s gap analysis on current authentication procedures relative to the NIST guidance may help IRS prioritize which improvements are most critical. However, without clear plans, timelines, and milestones for performing this work, IRS may not be positioned to address the most vulnerable areas in a timely manner. IRS’s timely implementation of NIST’s new guidance is critical, as it can help the agency mitigate potential security weaknesses in its existing online authentication programs. IRS Does Not Have a Comprehensive Process to Evaluate Technologies That Could Help It Improve Authentication While IRS has made some progress in improving its authentication programs, the agency lacks a comprehensive, repeatable process to identify and evaluate potential new authentication technologies and approaches. IRS’s planning documents have noted a commitment to identify and leverage authentication best practices from outside organizations to protect taxpayer data and support IRS business needs. Specifically, IRS’s Roadmap states that the agency will leverage leading technology and implementation practices from the private and public sectors through a repeatable environmental scan process and, when appropriate, collaborate with partners to address its authentication needs. Similarly, IRS’s Strategic Plan notes that the agency will invest in innovative, secure technology needed to protect taxpayer data and support the business needs of the agency and its partners. IRS officials told us the agency continuously researches new identity assurance processes and technologies and has talked with other agencies, industry groups, and vendors to better understand how particular technology solutions could apply to IRS’s environment. Further, according to officials, IRS plans to work with an outside organization to analyze third-party identity proofing and authentication services; however, IRS is in the initial phases of this effort. IRS also recently established the Commissioner’s Identity Assurance Executive Steering Committee to help oversee IRS’s authentication efforts agency-wide. This committee is intended to serve as an advisory body, creating a forum for agency-wide collaboration, as well as providing guidance and direction for identity assurance implementation. IRS provided us documentation that it reviewed some available authentication technologies and their pros and cons in February 2016, and told us that this research helped them develop their Roadmap. However, IRS officials could not provide documentation on more recent evaluations of the broader authentication environment, or evidence of a repeatable, comprehensive process to identify and evaluate available authentication technologies and services. IRS officials stated that one way the agency evaluates potential technologies is through limited pilots or “innovation studies.” For example, from October 2017 to January 2018, IRS conducted a limited pilot to explore the feasibility of having a third-party identity assurance service provider authenticate taxpayers on behalf of IRS. Officials stated that this pilot was possible because it required little upfront investment by IRS. Specifically, IRS received a grant from NIST to implement it, and officials stated that it required minimal integration with IRS’s IT infrastructure. In January 2018, IRS officials stated they were reviewing the results of the pilot, but had not decided on any next steps. Further, IRS officials stated that the agency is considering other pilots, including one to assist with IRS’s telephone authentication and one to enhance security checks during the Individual Taxpayer Identification Number application process. However, while IRS has completed preliminary planning for these pilots, it has not established priorities or timelines because each pilot requires IT support, for example, to ensure the application can be integrated with IRS’s infrastructure and to make any technical changes. Further, in December 2017, IRS officials stated that all innovation studies were on hold until resources become available. IRS may benefit from considering new ways of approaching its authentication efforts, as other public and private entities face similar challenges of authenticating users. Our discussions with representatives from industry and financial institutions and with government officials indicate that there is no single, ideal taxpayer authentication solution that will solve IRS’s challenges related to IDT refund fraud. Further, representatives from industry and financial institutions and government officials with whom we spoke advocated a layered approach to authentication that relies on multiple strategies and sources of information, while giving taxpayers options for further protecting their information. Based on our discussions with representatives from industry and state departments of revenue and government officials, some options IRS could consider include the following: Expanding existing IRS services to further protect taxpayers. As discussed earlier, IRS’s online account offers taxpayers several services, including the ability to set up a payment plan and make payments to IRS and view their tax history. In fiscal year 2017, about 808,000 taxpayers created online accounts, and IRS expects this number to grow. IRS’s Roadmap has identified enhancing taxpayer assurance by expanding authentication, such as generating and sending event-driven notifications to taxpayers to help IRS authenticate returns, which could help IRS quickly validate legitimate returns. With this option, IRS may be able to further protect taxpayers from IDT refund fraud. For example, IRS could develop additional functionality for the online account that allows the taxpayer to designate a bank account or a preference for a paper check for receiving a tax refund. If a fraudster filed a return with different information, the return would automatically be rejected. In February 2018, IRS officials stated that their strategic vision includes empowering taxpayers to manage their online account; however, when these services offer the ability to change personal or financial information, there is greater potential for fraudsters to exploit them. Federated model. A federated authentication approach allows an organization to rely on trusted authentication credentials from another entity to log into its systems, potentially without needing to save information from the trusted source. (See figure 3.) One example of a federated authentication model is when people use their Google or Facebook credentials to log into a different website or mobile application. IRS could use a trusted authentication credential from the private or public sector, or another federal agency. The General Services Administration (GSA) has developed a single sign-on authentication platform for federal agencies called Login.gov. In March 2018, GSA officials told us that the Office of Personnel Management and Customers and Border Patrol were using Login.gov and that several other agencies plan to use the authentication platform. According to IRS officials, IRS and Department of the Treasury officials have met with GSA to discuss whether Login.gov could meet IRS’s authentication needs. In December 2017, IRS IT officials said they are tracking Login.gov’s progress and capabilities and want to ensure that GSA officials understand IRS’s requirements. IRS officials said that the agency is interested in being able to federate with different organizations, but does not want to limit federating to one entity, since different taxpayers will want to use different credentials. IRS officials also noted that the agency will need to implement additional IT infrastructure to support a federated model for authentication. Possession-based authentication. This type of authentication offers users a convenient, added layer of security when used as a second factor for accessing websites or systems that would otherwise rely on a username and password for single-factor authentication. As shown in figure 4, Universal Authentication Framework (UAF) solutions use biometrics, such as an embedded fingerprint, facial recognition, or voice recognition sensor on a computer or smart phone, eliminating the need for a password. Similarly, authentication with a Universal Second Factor (U2F) uses a trusted device or “security key” for authentication in addition to a username and password. According to a representative from the Fast Identity Online (FIDO) Alliance, UAF standards and U2F devices comply with NIST’s new guidance for digital authentication. While IRS is not likely to provide the devices to taxpayers, it could enable its systems to accept these types of standards-based authentication technology for taxpayers who elect to use UAF or U2F devices. For example, taxpayers could use a UAF or U2F device when logging into their IRS online account for additional protection. States’ strategies for authentication. When we met with representatives from five states to discuss how they authenticate taxpayers, representatives from three states volunteered that they use driver’s license information to help authenticate taxpayers and tax returns. One state we met with compares driver’s license information to other state agency data to help authenticate returns. IRS could investigate making driver’s license information, or other government identification, a requirement when filing a federal return, and work with states and other outside organizations to assist with authentication. This information could be a key factor in verifying that the legitimate taxpayer is filing the return. While some industry representatives told us driver’s license information is a good credential for identity- proofing, this information can be compromised. For example, fraudsters can use stolen PII to obtain fraudulent driver’s licenses. Contracting with outside organizations. Several private-sector organizations offer identity proofing and authentication services. We spoke with officials from the Department of Veterans Affairs (VA) and representatives from the State of Alabama’s Department of Revenue, both of which are currently using such services. VA is using a third- party service to identity proof and authenticate veterans accessing services through www.vets.gov. For the 2018 filing season, Alabama has contracted with a third-party organization to offer taxpayers a service that sends them an alert when a return is filed using their name, and authenticates the return as legitimate using a selfie. This photo is then digitally compared to their driver’s license photo. IRS could evaluate these services to see if any meet their needs. Working with trusted partners. IRS could partner with organizations it trusts that are accessible to taxpayers and enable the partners to identity-proof and authenticate taxpayers. Trusted partners could include tax preparers, financial institutions, or other federal agencies. In November 2017, IRS officials told us that they had been discussing an in-person identity proofing study with the Social Security Administration (SSA), where SSA would identity proof taxpayers and transmit the authentication data to IRS. However, in June 2018, IRS officials stated that discussions with SSA are ongoing, and they have not made a decision about next steps because SSA is concerned about resources. IRS is also exploring working with the U.S. Postal Service on an information-sharing initiative that could help IRS identify potential IDT. Throughout the course of our work, IRS officials stated that improving the security of IRS’s online authentication applications is a high priority and further noted that IRS must ensure that the highest-risk authentication improvements are completed first. In January 2018, IRS officials stated that the agency’s priority is implementing tax reform, which will use IRS’s limited IT resources. Further, officials noted that priorities, including resources required to develop project estimates, are determined by IRS’s appropriate executive steering committees. Developing a repeatable, comprehensive process to identify and evaluate different alternatives for taxpayer authentication, such as the ones described above, is consistent with leading practices and can help IRS ensure that it has a sound rationale for its investment decisions. It can also help ensure that IRS has the resources it needs to make authentication improvements in a timely manner. For example, these evaluations may involve developing and documenting a business case for selected initiatives in IRS’s Roadmap. Such a process could compare options for in-house authentication solutions with solutions available in the private sector based on estimates of cost, schedule, and benefits, as applicable. By identifying options and performing such an evaluation, IRS may find, for example, that an authentication technology available in the private sector already complies with the new NIST guidelines, offers IRS additional fraud detection capabilities, or is less expensive than developing a similar capability in-house. On the other hand, the process may show that minor improvements to a technology IRS is already using can provide the most secure option in relatively short time, given appropriate resources. This information could be communicated to IRS’s executive steering committees, as well as to Congress, to help IRS identify resource needs and ensure it is pursuing the most efficient and effective authentication improvements to protect IRS and taxpayers against evolving threats. IRS’s authentication environment is one component of a broad, complex IT infrastructure, and the agency faces many challenges as it modernizes its tax systems. However, given the availability of PII and the prevalence of cyberattacks, developing a repeatable, comprehensive process to identify and evaluate alternative options for taxpayer authentication and implementing improvements can help IRS ensure it is authenticating taxpayers in the most secure manner. IRS documentation acknowledges that a hybrid authentication approach using in-house solutions, third-party services, and working with trusted partners is the best approach to implementing the new NIST guidance and expanding IRS’s authentication coverage. However, without a process to comprehensively identify and evaluate available or emerging authentication technologies and models, IRS may be missing an opportunity to implement the most secure, robust technologies to authenticate and protect taxpayers. Further, including these authentication options and prioritizing them with other initiatives included in IRS’s Roadmap would help IRS ensure it is working on the highest priority authentication improvements first. It also provides a way for IRS to communicate its strategy and plan for authentication to IRS management and external stakeholders. Conclusions Each year, IRS authenticates millions of taxpayers via telephone, online, in-person, or correspondence to verify potentially fraudulent tax returns, provide taxpayers access to a tax transcript, or issue a replacement IP PIN. IRS’s cost to authenticate taxpayers varies widely, with in-person authentication at a Taxpayer Assistance Center costing about $89 per interaction and online authentication costing less than $1 per interaction. The challenge for IRS is to provide taxpayers with options to interact with the agency, while providing IRS with reasonable assurance that it is authenticating the legitimate taxpayer. In its Roadmap, IRS has identified high-level strategic efforts and numerous foundational initiatives to address its most pressing authentication challenges. IRS has made progress in several areas identified in its Roadmap. However, identifying the resources the agency will need to complete its foundational initiatives and further prioritizing them would help IRS better understand the relationship between its competing priorities and limited IT resources. Further, while IRS has made progress in identifying risks and establishing internal control activities to monitor online taxpayer authentication, it has not established equally rigorous controls for telephone, in-person, and correspondence authentication. First, IRS does not have a policy for identifying, assessing, and mitigating risks for these authentication channels. Second, IRS does not have effective internal controls for collecting reliable, useful data on telephone, in-person, and correspondence authentication outcomes for TPP and for using these data to monitor authentication operations. Without effective controls for collecting these data and using it for monitoring, IRS may not be positioned to identify potential vulnerabilities in its operations and the necessary improvements. Given the widespread availability of PII that fraudsters can use to perpetrate tax fraud, it is essential for IRS to strengthen taxpayer authentication to stay ahead of fraudsters’ schemes. Completing an analysis of IRS’s current authentication procedures relative to new NIST guidance may help IRS identify and prioritize which improvements are most critical. Developing a timeline with milestones and resource needs to implement NIST’s new guidance can help guide IRS’s implementation and help officials gauge progress and ensure the most critical improvements are made in a timely manner. Further, implementing NIST’s new guidance can help IRS ensure its online authentication applications are appropriately protecting IRS information. While improving IRS’s current authentication programs would help IRS further protect taxpayer information and identify and prevent fraud, IRS may not need to conduct all of its taxpayer authentication activities in-house nor build IRS- specific authentication solutions: there are many additional tools and partners IRS could consider. Further, developing a repeatable, comprehensive process to identify and evaluate potential authentication technologies and services will help IRS avoid missing opportunities for improving authentication. Further, including and prioritizing these authentication technologies and services in IRS’s Roadmap could provide useful information to decision makers given IRS’s concerns over competing IT priorities and limited resources. Recommendations for Executive Action We are making the following 11 recommendations to IRS: The Commissioner of Internal Revenue should direct the Identity Assurance Office, in collaboration with other IRS business partners, to estimate the resources (i.e., financial and human) required for the foundational initiatives and supporting activities identified in its Identity Assurance Strategy and Roadmap. (Recommendation 1) Based on the estimates developed in Recommendation 1, the Commissioner of Internal Revenue should direct the Identity Assurance Office to prioritize foundational initiatives in its Identity Assurance Strategy and Roadmap. (Recommendation 2) The Commissioner of Internal Revenue should establish a policy for conducting risk assessments for telephone, in-person, and correspondence channels for authentication. This policy should include, for example, the frequency of assessments to be performed and timeframes for addressing deficiencies. (Recommendation 3) Consistent with the policy developed in Recommendation 3, the Commissioner of Internal Revenue should direct the Identity Assurance Office and IRS business owners to develop a plan for performing risk assessments for telephone, in-person, and correspondence channels for authentication. (Recommendation 4) The Commissioner of Internal Revenue should establish a mechanism to collect data on outcomes for telephone, in-person, and correspondence authentication, consistent with federal standards for internal control. (Recommendation 5) The Commissioner of Internal Revenue should revise or establish, as appropriate, procedures to ensure data quality in the Account Management Services (AMS) consistent with federal standards for internal control. (Recommendation 6) The Commissioner of Internal Revenue should ensure that IRS business units have access to complete AMS data to monitor authentication performance and identify potential issues. (Recommendation 7) The Commissioner of Internal Revenue should direct the Identity Assurance Office and other appropriate business partners to develop a plan—including a timeline, milestone dates, and resources needed—for implementing changes to its online authentication programs consistent with new NIST guidance. (Recommendation 8) In accordance with the plan developed in Recommendation 8, the Commissioner of Internal Revenue should implement improvements to IRS’s systems to fully implement NIST’s new guidance. (Recommendation 9) The Commissioner of Internal Revenue should develop a repeatable, comprehensive process to identify and evaluate alternative options for improving taxpayer authentication, including technologies in use by industry, states, or other trusted partners. (Recommendation 10) Based on the approach developed in Recommendation 10, the Commissioner of Internal Revenue should include and prioritize these options, as appropriate, in IRS’s Identity Assurance Strategy and Roadmap. (Recommendation 11) Agency Comments and Our Evaluation We provided a draft of this report to the Commissioner of Internal Revenue for review and comment. In its written comments, which are summarized below and reproduced in appendix III, IRS agreed with our 11 recommendations and stated that it is taking action to address them. IRS agreed with our recommendations to identify resources and prioritize the foundational authentication initiatives identified in its Roadmap. IRS noted that the Roadmap is a concept document outlining potential strategic initiatives and IRS has not finalized its approach. IRS stated that once it finalizes its authentication approach, it will estimate the resources required for each initiative and prioritize them, consistent with our recommendation. As stated earlier, we recognize that a strategy is a high- level plan and may need to change based on agency needs. Nevertheless, IRS’s timely attention to identifying resources and prioritizing its approved authentication initiatives will better position the agency to respond to known and unknown threats to the tax system. Further, IRS agreed with our recommendations to develop a plan for fully implementing NIST’s new authentication guidance and make the necessary improvements to its systems. In its written comments, IRS noted that its ability to complete these efforts will depend on the availability of resources. As noted throughout our report, we recognize the challenge of balancing competing IT priorities and limited resources, but given the importance of implementing authentication improvements consistent with NIST’s guidance, we continue to believe it should be a high priority. Additional actions, including addressing our recommendations, will help IRS further mitigate potential security weaknesses in its existing online authentication programs and help prevent potentially hundreds of millions of dollars in fraudulent refunds from being issued. IRS also agreed with our other seven recommendations, but did not provide additional details on how it plans to address them. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Chairmen and Ranking Members of other Senate and House committees and subcommittees that have appropriation, authorization, and oversight responsibilities for IRS. We will also send copies of the report to the Commissioner of Internal Revenue and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff has any questions about this report, please contact me at (202) 512-9110 or mctiguej@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff members who made major contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology Our objectives were to (1) describe the taxpayer interactions that require authentication, including the general rationale behind the requirements, and the Internal Revenue Service’s (IRS) authentication methods; (2) assess what IRS is doing to monitor and improve its authentication methods, both internally and collaboratively through the Security Summit, to secure taxpayer information and reduce identity theft refund fraud; and (3) evaluate what else, if anything, IRS can do to strengthen its authentication methods while improving services to taxpayers. To describe the interactions that require taxpayer authentication and IRS’s methods to do so, we reviewed IRS documents, policies and procedures, IRS data and information on the number of taxpayers authenticated by channel, and interviewed knowledgeable IRS officials. IRS documents and policies we reviewed included IRS’s Authentication Strategy: Current State Touchpoints, IRS’s Identity Assurance Strategy and Roadmap (Roadmap), and Internal Revenue Manuals related to taxpayer authentication. For this report, we focused on the following four IRS programs and services because they require taxpayer authentication, verify a significant number of taxpayer identities each year, and illustrate IRS’s different approaches to authentication: the Taxpayer Protection Program (TPP), Get Transcript, Identity Protection Personal Identification Number (IP PIN), and IRS’s online services. We reviewed IRS-reported data and information on taxpayer authentication volumes and per transaction costs for these programs for fiscal years 2016 and 2017. To assess the reliability of this data, we examined it for errors and talked with knowledgeable IRS officials. We determined that the data were sufficiently reliable for our purposes. We also interviewed knowledgeable IRS officials on the agency’s authentication programs and services to understand different authentication options offered to taxpayers through various channels: in-person, online, telephone, and correspondence. To assess IRS’s efforts to monitor and improve authentication internally and through the Security Summit, we reviewed IRS policies, procedures, authentication risk assessments, and data from IRS systems on authentication performance. We compared IRS’s efforts to applicable activities in the Roadmap, IRS’s Strategic Plan Fiscal Years 2014-2017 (Strategic Plan), Standards for Internal Control in the Federal Government, GAO’s Framework for Managing Fraud Risks in Federal Programs, and relevant National Institute of Standards and Technology (NIST) guidance. We interviewed IRS officials in IRS’s Return Integrity and Compliance Services (RICS), Identity Assurance Office (IAO), and Information Technology (IT) knowledgeable about the agency’s taxpayer authentication programs. For additional context and informational purposes, we visited IRS’s Andover, Massachusetts call center to observe IRS customer service representatives (CSR) authenticating taxpayers for TPP. We also interviewed IRS, state, and industry co-leads from the Security Summit’s Authentication workgroup and Strategic Threat Assessment and Response workgroup to understand IRS’s collaborative efforts to improve taxpayer authentication. To better understand IRS’s efforts to authenticate taxpayers via telephone and in person, and how CSRs record data for TPP authentication, we obtained data from IRS’s Accounts Management System (AMS) for the weeks January 1, 2017, through October 23, 2017. This was the most recent and complete set of data at the time of our review. We reviewed AMS records coded with any of the nine TPP authentication outcome codes for tax years 2015, 2016, or with “0.” We assessed the reliability of the data by: (1) performing electronic testing of key data elements, including checks for missing, out-of-range, or logically inaccurate data; (2) reviewing documents for information about the data and IRS’s systems; and (3) interviewing officials knowledgeable about the data to discuss any limitations. During these discussions, IRS officials stated that the AMS data we received may not include all available records in AMS. This is because the IRS office that creates the weekly AMS data report includes only the first 5,000 records for each outcome code. To assess whether this was an issue for our data set, we reviewed record counts for each of the nine TPP outcome codes for the 42 weeks of data IRS provided us. We found 12 out of these 378 instances (3 percent) where the data appeared to be affected by the 5,000 record cutoff. Each of these instances occurred in the “TPP- Other – Sent to TAC” issue code for which we planned no further analysis. Specifically, we did not include this issue code in the generalizable random probability sample described below. As a result, we determined that the data were sufficiently reliable for the purposes of our report. To assess the quality and usefulness of the data CSRs enter into AMS for TPP, we selected a random, generalizable sample of records CSRs coded as a TPP authentication failure. We stratified the population into two groups: (1) high-risk authentication failures, and (2) all other authentication failures. From each population, we drew a random sample of 96 records independently, reflecting the population size of each stratum and to be able to detect a 10 percent difference in absolute value between the sample estimate and true population number with a 95 percent confidence level; that is, a 1 out of 20 chance of failure. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Each sample record was subsequently weighted in the analysis to account statistically for all the cases in the population, including those which were not selected. Two analysts independently reviewed each sample record to determine (1) whether the TPP authentication outcome code generally aligned with the CSR’s notes and (2) the extent to which the CSR notes were useful in understanding why a taxpayer failed authentication. First, the analysts categorized each record in the sample as “aligned” (authentication outcome code and content of CSR notes are clearly aligned); “not aligned” (authentication outcome code and content of CSR notes are clearly not aligned); or “cannot determine” (if the content of the CSR notes was unclear and the analyst could not confidently determine that the record was aligned or not aligned). Next, for each record in the sample, the analysts categorized the content of the notes as one of the following: Useful: CSR notes provided a clear explanation of why the taxpayer failed authentication (e.g., question failed; taxpayer did not have proper identification; or taxpayer did not have copy of tax return during the call/visit). Somewhat Useful: CSR notes provided some information on where in the process or why a taxpayer failed, but no clear explanation of the specific reason (e.g., taxpayer passed disclosure, but could not answer high risk questions). Not Useful: CSR notes were blank, or provided no useful information on where in the process or why a taxpayer failed authentication. Cannot Determine: This was selected when the content of the CSR notes was unclear and the analyst could not determine if information was useful. After the independent review, the analysts discussed their results and resolved any disagreements. Based on these results, we determined how many records in the sample were “aligned,” “not aligned,” or “unable to determine.” Further, we analyzed records categorized as “aligned” to determine how many included CSR notes that were useful, somewhat useful, or not useful. To evaluate what else, if anything, IRS can do to strengthen its authentication methods while improving services to taxpayers, we interviewed knowledgeable officials from IRS and reviewed documentation to understand IRS’s current authentication methods, future plans for authentication, and challenges IRS faces in taxpayer authentication. We also interviewed knowledgeable officials at the General Services Administration/18F to understand their work on a government-wide authentication platform, Login.gov, and how IRS may be able to use this technology in the future. We also interviewed Department of Veterans Affairs officials to understand how they authenticate veterans applying for benefits at www.vets.gov. Further, we met with knowledgeable officials from NIST on their guidelines for online identity-proofing and authentication, which were released in June 2017. To understand current and emerging authentication strategies and technologies, we interviewed representatives from state departments of revenue and from industry. We also interviewed knowledgeable officials from the Office of Management and Budget’s (OMB) U.S. Digital Service to understand their work with IRS in 2016 in launching IRS’s Secure Access online authentication platform and to understand any emerging technologies and standards for authentication. We interviewed a nongeneralizable selection of knowledgeable state and industry representatives based on referrals from NIST officials, and other government and industry representatives knowledgeable on tax issues, including co-chairs from the Security Summit’s Authentication workgroup. In total we met with representatives from five state departments of revenue, one association representing state tax officials, three financial institution organizations, one financial service industry association, three identity-proofing/authentication organizations, and four tax industry organizations. Finally, we compared IRS’s authentication programs and plans for future improvements to its Roadmap, Standards for Internal Control, GAO’s Information Technology Investment Management framework, principles for project planning, GAO’s prior work on the Government Performance and Results Act, GAO’s Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, and NIST and OMB guidance to determine ways IRS could strengthen its authentication methods, while improving taxpayer service. We conducted this performance audit from January 2017 to June 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Overview of IRS’s Identity Assurance Strategy and Roadmap Prioritize technology and processes for e- Authentication to enhance identification, verification, and authorization capabilities as taxpayers continue to shift toward electronically filing. Establish a central authentication policy across the enterprise (i.e., channels and functions) Appendix III: Comments from the Internal Revenue Service Appendix IV: GAO Contact and Acknowledgments GAO Contact: Staff Acknowledgments: In addition to the contact named above, Neil Pinney (Assistant Director), Dawn Bidne, Matthew Bond, Mark Canter, Jehan Chase, Heather A. Collins (Analyst-in-Charge), Michele Fejfar, Robert Gebhart, Steven Flint, Dae Park, and Robert Robinson made significant contributions to this report. Related GAO Products Tax Fraud and Noncompliance: IRS Can Strengthen Pre-refund Verification and Explore More Uses. GAO-18-224. Washington, D.C.: January 30, 2018. Identity Theft: Improved Collaboration Could Increase Success of IRS Initiatives to Prevent Refund Fraud. GAO-18-20. Washington, D.C.: November 28, 2017. Financial Audit: IRS’s Fiscal Years 2017 and 2016 Financial Statements. GAO-18-165. Washington, D.C.: November 9, 2017. Information Technology: Management Attention Is Needed to Successfully Modernize Tax Processing Systems. GAO-18-153T. Washington, D.C., October 4, 2017. 2017 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, and Duplication and Achieve Other Financial Benefits. GAO-17-491SP. Washington, D.C.: April 26, 2017. High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15, 2017. 2016 Filing Season: IRS Improved Telephone Service but Needs to Better Assist Identity Theft Victims and Prevent Release of Fraudulent Refunds. GAO-17-186. Washington, D.C.: January 31, 2017. Information Technology: Federal Agencies Need to Address Aging Legacy Systems. GAO-16-468. Washington, D.C.: May 25, 2016. Identity Theft and Tax Fraud: IRS Needs to Update Its Risk Assessment for the Taxpayer Protection Program. GAO-16-508. Washington, D.C.: May 24, 2016. Information Security: IRS Needs to Further Improve Controls over Taxpayer Data and Continue to Combat Identity Theft Refund Fraud. GAO-16-589T. Washington, D.C.: April 12, 2016. Information Security: IRS Needs to Further Improve Controls over Financial and Taxpayer Data. GAO-16-398. Washington, D.C.: March 28, 2016. Information Security: IRS Needs to Continue Improving Controls over Financial and Taxpayer Data. GAO-15-337. Washington, D.C.: March 19, 2015. Identity Theft and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an Estimate of Costs, Benefits and Risks. GAO-15-119. Washington, D.C.: January 20, 2015. Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving Threat of Refund Fraud. GAO-14-633. Washington, D.C.: August 20, 2014. Internal Revenue Service: 2013 Tax Filing Season Performance to Date and Budget Data. GAO-13-541R. Washington, D.C.: April 15, 2013.
target: Strong preventive controls can help IRS defend itself against identity theft refund fraud. These controls include taxpayer authentication—the process by which IRS verifies identities before allowing people access to a resource; sensitive data; or, in some cases, a tax refund. The risk of fraud has increased as more personally identifiable information has become available as a result of, for example, large-scale cyberattacks on various entities. IRS's ability to continuously monitor and improve taxpayer authentication is a critical step in protecting billions of dollars from fraudsters. GAO was asked to examine IRS's efforts to authenticate taxpayers. This report (1) describes the taxpayer interactions that require authentication and IRS's methods; (2) assesses what IRS is doing to monitor and improve taxpayer authentication; and (3) determines what else, if anything, IRS can do to strengthen taxpayer authentication in the future. To meet these objectives, GAO reviewed IRS documents and data, evaluated IRS processes against relevant federal internal control standards and guidance, and interviewed IRS officials and state and industry representatives. The Internal Revenue Service (IRS) has identified over 100 interactions requiring taxpayer authentication based on potential risks to IRS and individuals. IRS authenticates millions of taxpayers each year via telephone, online, in person, and correspondence to ensure that it is interacting with legitimate taxpayers. IRS's estimated costs to authenticate taxpayers vary by channel. IRS has made progress on monitoring and improving authentication, including developing an authentication strategy with high-level strategic efforts. However, it has not prioritized the initiatives supporting its strategy nor identified the resources required to complete them, consistent with program management leading practices. Doing so would help IRS clarify relationships between its authentication efforts and articulate resource needs relative to expected benefits. Further, while IRS regularly assesses risks to and monitors its online authentication applications, it has not established equally rigorous internal controls for its telephone, in-person, and correspondence channels, including mechanisms to collect reliable, useful data to monitor authentication outcomes. As a result, IRS may not identify current or emerging threats to the tax system. IRS can further strengthen authentication to stay ahead of fraudsters. While IRS has taken preliminary steps to implement National Institute of Standards and Technology's (NIST) new guidance for secure digital authentication, it does not have clear plans and timelines to fully implement it by June 2018, as required by the Office of Management and Budget. As a result, IRS may not be positioned to address its most vulnerable authentication areas in a timely manner. Further, IRS lacks a comprehensive process to evaluate potential new authentication technologies. Industry representatives, financial institutions, and government officials told GAO that the best authentication approach relies on multiple strategies and sources of information, while giving taxpayers options for actively protecting their identity. Evaluating alternatives for taxpayer authentication will help IRS avoid missing opportunities for improving authentication.