Identity Theft and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an Estimate of Costs, Benefits and Risks
Released: 2015-02-19T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: IRS estimated it prevented $24.2 billion in fraudulent identity theft (IDT) refunds in 2013, but paid $5.8 billion later determined to be fraud. Because of the difficulties in knowing the amount of undetected fraud, the actual amount could differ from these point estimates. IDT refund fraud occurs when an identity thief uses a legitimate taxpayer's identifying information to file a fraudulent tax return and claims a refund.

GAO was asked to review IRS's efforts to combat IDT refund fraud. This report, the second in a series, assesses (1) the quality of IRS's IDT refund fraud cost estimates, and (2) IRS's progress in developing processes to enhance taxpayer authentication.

GAO compared IRS's IDT estimate methodology to GAO Cost Guide best practices (fraud is a cost to taxpayers). To assess IRS's progress enhancing authentication, GAO reviewed IRS documentation and interviewed IRS officials, other government officials, and associations representing software companies, return preparers, and financial institutions.

section_title: What GAO Found
paragraphs: Identity Theft (IDT) Refund Fraud Cost Estimates. The Internal Revenue Service's (IRS) fraud estimates met several GAO Cost Guide best practices, such as documenting data sources and detailing calculations. However, the estimates do not reflect the uncertainty inherent in measuring IDT refund fraud because they are presented as point estimates. Best practices suggest that agencies assess the effects of assumptions and potential errors on estimates. Officials said they did not assess the estimates' level of uncertainty because of resource constraints and methodological challenges. Because making different assumptions could affect IDT fraud estimates by billions of dollars, a point estimate (as opposed to, for example, a range) could lead to different decisions about allocating IDT resources. Reporting the uncertainty that is already known from IRS analysis (and conducting further analyses when not cost prohibitive) might help IRS communicate IDT refund fraud's inherent complexity.

While IRS's fraud estimates note the relevant cost assumptions used to develop estimates, they do not provide the rationale or analysis to support them. Officials stated they did not document the rationale because of the time and resources required. Best practices suggest that agencies should document assumptions. Given the evolving nature of IDT refund fraud, documenting assumptions' rationale would help IRS management and policymakers determine whether the assumptions remain valid or need to be updated.

Taxpayer Authentication. IRS recently created a group aimed at centralizing several prior ad hoc efforts to authenticate taxpayers across its systems. IRS's planning documentation contains goals and short- and long-term priorities (including implementation plans). However, a commitment to cost, benefit and risk analysis is not documented in the group's short- and long-term priorities. The draft planning documentation makes no mention of where such analyses would be included in IRS's priorities. Office of Management and Budget guidance states that agencies should use cost-benefit analyses that consider alternatives to promote efficient resource allocation and that agencies should ensure that authentication processes provide the appropriate level of assurance by assessing risks. Without analysis of costs, benefits and risks, IRS and Congress will not have quantitative information that could inform decisions about whether and how much to invest in the various authentication options. Cost, benefit and risk estimates for authentication would have the additional benefit of allowing comparisons with other options for combating IDT refund fraud. IDT options could have significant costs for taxpayers and IRS, so more information about the tradeoffs would help inform IRS and congressional decision making.

section_title: What GAO Recommends
paragraphs: GAO recommends IRS improve its fraud estimates by (1) reporting the inherent imprecision and uncertainty of estimates, and (2) documenting the underlying analysis justifying cost-influencing assumptions. In addition, IRS should estimate and document the economic costs, benefits and risks of possible options for taxpayer authentication. IRS agreed with GAO's recommendations and provided technical comments that GAO incorporated, as appropriate.

section_title: Letter
paragraphs: Tax refund fraud associated with identity theft (IDT) is a complex and  rapidly changing threat facing the nation’s tax system. IDT refund fraud  occurs when a refund-seeking identity thief obtains an individual’s  identifying information and uses it to file a fraudulent tax return. IDT  refund fraud burdens honest taxpayers who have had fraudulent tax  returns filed in their name because they must deal with delayed refunds  as they authenticate their identities with the Internal Revenue Service  (IRS). Additionally, IDT refund fraud is an attractive target for criminals  with a potentially high payoff. While the estimates have inherent  uncertainty, IRS estimated that it prevented $24.2 billion in fraudulent IDT  refunds in filing season 2013. However, IRS also estimated, where data  were available, that it paid $5.8 billion in fraudulent IDT refunds.  Because of the difficulties in knowing the amount of undetected fraud, the  actual amount could differ from these point estimates.

This is the second in a series of our reports on IDT refund fraud. In  August 2014, we issued a report describing what IRS knew about the  extent of IDT refund fraud and identifying additional actions IRS could  take to combat IDT refund fraud using third-party information. One action  that the first report focused on was matching wage information that IRS  receives from employers (on Form W-2, Wage and Tax Statement (W-2))  to tax returns before issuing refunds. While there is no “silver bullet” for  combating IDT refund fraud, IRS officials told us that pre-refund W-2  matching could prevent billions of dollars in estimated IDT refund fraud;  however, pre-refund matching would have costs. We noted that pre- refund W-2 matching would likely require some combination of  accelerated due dates for information returns, delayed start of the annual  tax filing season, delayed refund issuance, and investments in IRS  information systems with the capability of doing real-time matching. We  found that IRS had not considered how to implement such changes,  including identifying their costs and benefits. We recommended that the  agency estimate the costs and benefits to inform a discussion about  whether to proceed. In November 2014, IRS reported that it had  convened an internal working group to address our recommendations and  that it anticipated implementing our recommendations by July 2015.

IRS has other pre-refund options for preventing IDT refund fraud. Two  options that the agency is exploring are (1) tracking device identification  numbers to determine when multiple returns are filed from the same  device (e.g., the same laptop computer), and (2) authenticating the  identity of a taxpayer before issuing a refund through the use of security  questions, passwords, and other techniques.

Within this context, you asked us to continue examining IRS’s efforts to  combat IDT refund fraud. This report assesses (1) the quality of the IRS  Identity Theft Taxonomy’s (Taxonomy) estimates of the cost of IDT refund  fraud, and (2) IRS’s progress in developing processes to track device  identification numbers and to enhance taxpayer authentication.

To assess the quality of the Taxonomy’s estimates of IDT-related refund  fraud, we reviewed the Taxonomy’s methodology for filing season 2013  and evaluated it against selected best practices in the GAO Cost  Estimating and Assessment Guide that were applicable to the Taxonomy  and consistent with IRS and Office of Management and Budget (OMB)  information quality guidelines. Appendix I explains our scope and  methodology and provides a summary of best practices selected. These  best practices are relevant because the Taxonomy is an estimate of the  amount of revenue lost to IDT refund fraud—a cost to taxpayers. We  discussed the criteria with IRS officials, who generally agreed with their  applicability to the Taxonomy. We conducted manual data testing for  obvious errors and compared underlying data to IRS’s Refund Fraud &  Identity Theft Global Report. We also interviewed IRS officials to better  understand the methodology IRS used to create the estimates.

OMB, E-Authentication Guidance for Federal Agencies, M-04-04 (Washington, D.C.:  Dec. 16, 2003); Circular A-94: Guidelines and Discount Rates for Benefit Cost Analysis of  Federal Programs (Washington, D.C.: 1992); and NIST, Electronic Authentication  Guideline, Special Publication 800-63-2, (August 2013). associations and stakeholders with differing positions and characteristics  based on IRS documentation and suggestions, our prior work, and other  information. Because we used a nonprobability sample, the views of  these associations are not generalizable to all potential third parties. We  then communicated with IRS offices to determine the feasibility of various  options and the challenges of pursuing them. See appendix I for details  on our scope and methodology.

We conducted this performance audit from August 2013 to January 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Identity Theft Refund Fraud – Key Components
paragraphs: IDT refund fraud occurs in the context of several inter-related issues: the  vulnerability of personal information, thieves’ ability to exploit IRS’s  current compliance model, and the attractiveness of IDT refund fraud as a  target.

Theft of Personal Information. To successfully commit IDT refund fraud,  thieves must exploit various sources of information to steal or otherwise  obtain individuals’ identities. According to an official in IRS’s Criminal  Investigation division, the sources of stolen identities are limitless. The  Department of Justice has prosecuted cases ranging from an employee  stealing information from his employer to organized cyber attacks that  infiltrate computer systems.

Exploitation of IRS Compliance Checks. After obtaining personal  information belonging to legitimate taxpayers (or to individuals who do not  have a tax filing obligation), identity thieves use this information to file  fraudulent tax returns claiming refunds. Identity thieves are often able to  exploit what IRS officials call a “look back” compliance model: rather than  holding refunds until all compliance checks can be completed, IRS issues  refunds after doing some selected, automated reviews of taxpayer- submitted information (see text box). IRS is under pressure from  taxpayers who expect to receive their refunds quickly.normally issues refunds before matching tax returns to third-party  information returns (such as W-2 data).

Examples of automated reviews used

Matching name and Social Security number (SSN)

Correcting obvious errors—such as mathematical mistakes or exceeding the  statutory limits of deductions and credits.

Attractiveness of IDT Refund Fraud. IDT refund fraud crimes often  involve large criminal enterprises that exploit the speed and relative  anonymity of preparing and filing tax returns. For this reason, they are  difficult to prosecute, according to the Department of Justice.

section_title: IRS’s Current IDT Refund Fraud Response
paragraphs: In light of the complexity and fluidity of this threat, IRS addressed refund  fraud and IDT in its strategic plan, identifying both issues as major  challenges facing the nation’s tax system over the next several years (see  text box).

IRS: Addressing the Threat of Refund Fraud and Identity Theft  “Assuring the accuracy of refunds and the security of taxpayer data remain our priorities  going forward. We are committed to stopping this threat to tax administration, protecting  our government’s revenue and safeguarding the identity of all taxpayers. We must  bolster our efforts to prevent refund fraud and identity theft before they happen.”

The plan further states that IRS is committed to building a stronger  identity authentication process that will enable secure, timely processing  of tax returns and improve other service interactions. IRS has also  identified several strategic objectives relevant to its efforts to combat  identity theft, including balancing the speed of refund delivery with the need to verify  taxpayers’ identities; and using third-party data, risk modeling, and a historical view of taxpayer  interactions to prevent fraud before issuing refunds.

Further, IRS has allocated more than 3,000 employees to combat IDT  refund fraud, including assigning staff to help IDT victims resolve their  accounts. The agency has also requested an additional $64.9 million in its  fiscal year 2015 budget request for staffing and advanced technologies to  support its continued IDT and refund fraud efforts.

In addition to identifying IDT refund fraud as a major issue and requesting  additional resources, IRS has developed a number of tools to address  IDT refund fraud throughout the tax return filing process—and has done  so amidst budget reductions and other challenges.IDT refund fraud includes efforts to authenticate taxpayer identities as  well as several tools used to detect and prevent IDT refund fraud, as  described below (see appendix II for more detail on these IDT refund  fraud tools).

IRS’s response to  Authenticating Taxpayer Identities. IRS has enhanced its  authentication efforts to combat IDT refund fraud. For example, IRS  provides IP PINs to past IDT victims who have confirmed their identities  with IRS. IP PINs help prevent future IDT refund fraud because, once  issued, the IP PIN must accompany an electronically filed (e-file) tax  return. In addition, IRS conducts authentication checks on returns flagged by IDT and fraud filters. If flagged, IRS stops processing the  return and sends a letter asking the taxpayer to confirm his or her identity.  IRS then confirms the taxpayer’s identity by asking for personal  information, such as the taxpayer’s previous addresses, mortgage lender,  and family members.

Taxpayer Alerts. Often, IRS becomes aware of IDT refund fraud when a  legitimate taxpayer alerts IRS of an inability to e-file. Specifically, in cases  where an identity thief has already e-filed a return using the taxpayer’s  name and Taxpayer Identification Number—such as an SSN—IRS’s e-file  system will reject the second, duplicate return (top of figure 1), thus  preventing the legitimate taxpayer from filing. IRS officials are aware  when their e-file system rejects returns; however, they do not know if the  rejections are due to IDT refund fraud unless further investigation is  conducted.

Information Return Matching. IRS also finds IDT refund fraud as part of  the Automated Underreporter (AUR) program, which matches tax return  data to information returns, such as the W-2. These information returns  are provided by third parties such as employers, financial institutions, and  others. In many cases, IRS does not receive the information returns until  well after the tax return and refund are processed (bottom of figure 1). In  these types of cases, the legitimate taxpayer may not be aware of a  stolen identity until after receiving a notice indicating that the income (or  payment information) IRS has on file does not match the information  reported on the tax return. We previously found that these post-refund  compliance checks can take a year or more to complete, which can be a  burden to taxpayers who receive a notice. IRS officials acknowledge  that the longer the delay between filing a tax return and receiving an IRS  notice, the harder it can be for taxpayers to locate tax records or other  information necessary to respond to IRS.

Fraud Filters. IRS also uses IDT and other fraud filters to detect IDT  refund fraud. These filters are computerized automatic checks that screen  returns using characteristics that IRS has identified in previous IDT refund  fraud schemes. The filters also search for clusters of returns with similar  characteristics, such as the same bank account or address, which could  indicate potential fraud. Two of the tax-administration systems employing  filters are the Dependent Database (DDb) and Electronic Fraud Detection  System (EFDS). (RRP) to replace EFDS. In April 2014, IRS began a pilot of one of RRP’s  planned fraud detection capabilities focused on detecting IDT refund  fraud (e.g., RRP’s IDT model).RRP’s IDT model on all returns in filing season 2015. Returns flagged by  the RRP IDT model will go through the same process as returns flagged  by other filters (as previously described).

DDb incorporates IRS, Department of Health & Human Services, and Social Security  Administration data to identify compliance issues involving IDT, refundable credits, and  prisoners. EFDS is a system built in the mid-1990s to detect taxpayer fraud.

section_title: IRS’s Efforts to Identify and Monitor the Extent of IDT Refund Fraud
paragraphs: According to IRS officials, a vital component in the agency’s strategy to  identify IDT refund fraud is its Identity Theft Taxonomy (Taxonomy). This  research-based effort has several objectives, including (1) providing  information to internal and external stakeholders about the effectiveness  of IRS’s IDT defenses, (2) helping IRS identify IDT trends and evolving  risks, and (3) refining IDT filters to better detect potentially fraudulent  returns while reducing the likelihood of flagging legitimate tax returns.

Taxonomy Methodology. Consisting of a matrix of IDT refund fraud  categories (see figure 2), IRS’s Taxonomy estimates the number of  identified IDT refund fraud cases where IRS (1) prevented or recovered  the fraudulent refunds (turquoise band), and (2) paid the fraudulent  refunds (purple band). IRS breaks these estimates into six categories  associated with IDT detection strategies. These strategies occur at three  key points in the life cycle of a tax refund: before accepting a tax return,  during return processing, and post refund.

Taxonomy Categories. Estimates in categories 1-3 are based on IRS’s  Refund Fraud & Identity Theft Global Report (Global Report), which  consolidates IRS administrative records of known IDT refund fraud.  Category 4 estimates are based on duplicate returns, where IRS has  received both a fraudulent IDT return and a legitimate return. Category 5  estimates are based on cases identified as part of a criminal investigation  or as part of the AUR program. To estimate the AUR portion of category  5, IRS developed assumptions based on its analysis of the characteristics  of past IDT refund fraud; IRS then used these assumptions to identify  which information return mismatches were likely IDT returns.represents undetected IDT returns.

Current Taxonomy Estimates. Based upon its Taxonomy, IRS  estimated that $30 billion in IDT refund fraud was attempted in filing  season 2013 (see figure 3). Of this attempted amount of IDT refund fraud,  IRS estimated that it prevented or recovered $24.2 billion (81 percent) of  the estimated total. IRS also estimated it paid $5.8 billion (19 percent) in  IDT refunds on 1 million IDT returns during the same time frame.  Taxonomy estimates do not include the amount of IDT refund fraud from  schemes IRS cannot detect (e.g., schemes that involve reported income  that IRS cannot confirm during information return matching).

section_title: Administration Prioritizes Identity Theft and Authentication Efforts
paragraphs: In October 2014, the administration announced a plan to combat identity  theft and further strengthen the security of personal identifying information   The plan is intended to ensure that all  maintained by the government.agencies making personal data accessible to citizens online will require  the use of multiple authentication steps and will have an effective identity  proofing process. National Security Council staff, the Office of Science  and Technology Policy, and the Office of Management and Budget (OMB)  are tasked with developing this plan by January 2015, and relevant  agencies shall complete any required implementation steps set forth in  this plan by April 2016. Therefore, while this plan may aid IRS in its efforts  to prevent identity theft, any implementation of the plan at the agency  level is still a few years away.

section_title: Taxonomy Met Several Best Practices for Cost Estimating, but It Could Better Explain Assumptions and Reflect Inherent Uncertainty
subsections: section_title: Taxonomy Documented Data and Methodology
paragraphs: By providing insight into how IDT refund fraud is evading IRS defenses,  estimates inform IRS decision making about how to improve fraud filters  and other detection efforts. Objective estimates may also inform  congressional decision making about IRS resources. To ensure that IRS  information reporting is objective, the agency developed information  quality guidelines. Objectivity involves ensuring that information is  reliable, accurate, and unbiased, as defined in OMB information quality  guidelines.appropriate, supporting data should include full, accurate, transparent  documentation, and should disclose error sources affecting data quality.

Further, OMB quality guidelines state that, where  We evaluated Taxonomy estimates against selected GAO Cost  Estimating and Assessment Guide (GAO Cost Guide) best practices that  (1) are related to OMB’s definition of objectivity, and (2) are applicable to  the Taxonomy. These best practices are intended to ensure the reliability of estimates—a key component of OMB’s definition of  objectivity. While IRS is not required to follow the GAO Cost Guide best  practices, following such practices could help the agency meet OMB and  IRS information quality guidelines and could improve the reliability of IDT  refund fraud estimates. We assessed the extent to which IRS provided  evidence that the Taxonomy met each best practice and assigned ratings  based on a five-point scale (Met, Substantially met, Partially met,  Minimally met, or Not met). See appendix I for details on how we  conducted our assessment.

As shown in table 1, the Taxonomy met several GAO Cost Guide best  practices. IRS documented the Taxonomy’s source data, identified the  methodology used to develop the estimate, and described how the  estimate was developed. With regard to the calculation of Taxonomy  estimates, our data reliability testing did not find calculation errors or other  mistakes.

section_title: Methodology Changes Increased Fraud Estimates by $1 Billion, and Officials are Developing a Process to Document Management Review
paragraphs: After initial development of the Taxonomy in 2013, IRS made  methodology improvements that resulted in more comprehensive  Taxonomy estimates. For example, the agency included categories of  duplicate IDT returns that had not been in filing season 2012 estimates.  IRS made these methodology changes to enable comparison across filing  seasons in future years, and to respond to our data reliability questions,  according to officials. As a result, 2013 filing season estimates of “IDT  refunds paid” increased by about $1 billion from an original estimate of  $4.8 billion to a revised estimate of $5.8 billion (see table 2 for details).

IRS officials have considered using surveys to develop a more  comprehensive estimate of unidentified IDT refund fraud, but have not  been able to develop a survey method that would avoid significant  taxpayer burden and administrative costs. Accordingly, while IRS has  made several methodology changes and refinements to improve  Taxonomy estimates, it is unlikely that IRS will be able to develop a  completely comprehensive estimate, given potential administrative costs  and other constraints.

While Taxonomy documentation does not provide evidence of managerial  review, IRS officials stated that the former IRS Acting Commissioner  reviewed and approved the Taxonomy. Officials told us they are working  on a new process to document management review and approval.

section_title: Taxonomy Notes Relevant Cost Assumptions Used, but Does Not Provide the Rationale or Analysis Supporting the Assumptions
paragraphs: Developing loss estimates of illicit activities is challenging because such  activities are difficult to observe. For this reason, IRS makes various  assumptions, including whether an information return mismatch is an IDT  return.

Taxonomy documentation thoroughly details IRS’s assumptions. For  example, the Taxonomy describes the assumptions used to develop its  “refund paid” estimates in category 5, which are based on AUR data (see  figure 2). This part of the Taxonomy accounts for $3.0 billion of the  estimated $5.8 billion in IDT refunds paid by IRS. However, the  Taxonomy documentation for the AUR category does not provide  information on the analysis or rationale used to develop the assumptions  of past IDT refund fraud characteristics (see appendix III for examples  showing how IRS assumptions affect Taxonomy results).

Given the evolving nature of IDT refund fraud, documenting Taxonomy  assumptions and the rationale used to develop the assumptions would  help IRS management and policymakers to determine whether the  assumptions remain valid or need to be revised or updated. IRS officials  acknowledged they could have better documented their analysis and  rationale for choosing assumptions. They stated that IRS did not  document its rationale for selecting assumptions because of the time and  resources required.

Taxonomy assumptions also result in overestimates in some categories  and underestimates in others. For example, while IRS’s estimate for  refunds prevented includes e-file rejects that occurred due to an incorrect  or missing Identity Protection Personal Identification Number (IP PIN)  (see figure 2), legitimate taxpayers may also have their return rejected if  they include an incorrect IP PIN, or forget to include an IP PIN on their tax  return. In addition, the same return—regardless of whether the return is  filed by a legitimate taxpayer or an identity thief—can be rejected multiple  times, which would result in an over-count of IDT refunds prevented.  Officials said they do not collect data that would allow them to break out  the amount of e-file rejects due to IDT refund fraud. According to IRS  officials, the costs of collecting these data may outweigh the benefits, as it  would require major changes to IRS information technology systems.

section_title: Point Estimates Do Not Reflect the Taxonomy’s Inherent Uncertainty
paragraphs: To gain a better understanding of the effects that changing assumptions  had on its estimates, IRS conducted a sensitivity analysis for category 5  “IDT refunds paid” estimates (which are based on AUR data from filing  season 2013). That analysis shows that making different assumptions  could affect the estimate of category 5 IDT refunds paid by billions of  dollars in either direction (see appendix III, example 1). However, IRS  does not report a range or some other indication of the results of the  sensitivity analysis when reporting the $5.8 billion estimate for IDT refund  fraud detected after refunds were issued. IRS officials stated that their  goal in developing the Taxonomy was to achieve a level of precision that  would allow them to assess the effectiveness of IRS IDT defenses.

Nor did IRS conduct sensitivity analyses for the other Taxonomy  categories that include assumptions. Our analysis, shown in example 2 in  appendix III, demonstrates that changes in these assumptions could  affect estimates by billions of dollars. Also, IRS did not conduct a risk and  uncertainty analysis showing the cumulative effect that assumptions have  on the fraud estimate.with the Taxonomy estimates is unclear and users of the estimates may  be left with a mistaken impression of their precision.

As a result, the level of uncertainty associated  IRS officials stated that they did not conduct such analyses because of  resource constraints and methodological challenges. Specifically, IRS  officials stated that it would be methodologically difficult—if not  impossible—to calculate uncertainty surrounding category 5 estimates  that are based on AUR data. However, officials acknowledged that these  analyses are possible for other categories in the Taxonomy, such as  categories that use average refund value assumptions, or assumptions  about the percent of returns detected by IRS defenses that are IDT.

We recognize that conducting an uncertainty analysis will be challenging  and add some costs; however, better reporting of what is already known  from sensitivity analyses would not be costly. Reporting the uncertainty  that is known already, and conducting further sensitivity analyses when  not cost prohibitive, might help IRS communicate the complexities  inherent in combating the evolving threat of IDT refund fraud. Reporting  uncertainty, quantitatively if possible and otherwise qualitatively, could  also give decision makers in Congress and IRS a more accurate  understanding of what is known and not known about the extent of the  IDT refund fraud problem. A point estimate, compared to a range or some  other indication of uncertainty, could provide a false sense of precision  leading to different decisions about how to allocate resources to combat  IDT refund fraud.

Given methodological and resource constraints, there are various ways  IRS could report the uncertainty in the IDT refund fraud estimates. One  way would be to present a point estimate surrounded by quantitative  estimates of the possible range. Another way would be to qualitatively  describe the relative size of the uncertainty and the reasons for this  uncertainty. For example, IRS could describe how changes in  assumptions affect the Taxonomy’s minimum, point, and maximum  estimates.

section_title: IRS Is Beginning to Implement One New Pre-Refund Tool and Is Exploring Enhanced Taxpayer Authentication, but Lacks Information on Costs, Benefits and Risks
paragraphs: While it is likely that no one tool will stop all attempts at fraud, we have  found that implementing strong preventive controls can help defend  against invalid refunds, increasing public confidence and avoiding the  difficult “pay and chase” aspects of recovering invalid refunds.  Recapturing a fraudulent refund after it is issued can be challenging—if  not impossible—because identity thieves often spend or transfer the  funds immediately, making them very difficult to trace. For this reason,  IRS is in various stages of exploring several possible pre-refund tools.  Three tools with significant potential are (1) pre-refund Form W-2, Wage  and Tax Statement (W-2) matching (which we already noted was the  subject of our August 2014 report), (2) device identification, and (3)  improved taxpayer authentication.
subsections: section_title: IRS is Working with Tax Software Companies to Implement Device Identification
paragraphs: Based on suggestions from the tax software industry and internal  stakeholders, IRS is beginning to implement device identification that  would capture the unique number associated with the individual device,  such as a laptop computer, used to e-file a return. IRS could use this  information to determine when multiple fraudulent returns are filed from  the same device.

In November 2014, IRS published guidance for e-file providers that  outlined IRS’s plans to collect device identification numbers along with tax  returns for filing season 2015. IRS officials told us they will collect  device identification numbers voluntarily for this first year. Beginning in  filing season 2016, IRS plans to require these companies to submit a  device identification number with each e-filed tax return.

From a cost-benefit perspective, IRS’s implementation of device  identification appears justified. One important benefit of device  identification is that it will enhance IRS’s ability to monitor when multiple  returns are filed from the same device or from devices previously  associated with fraud. In addition, device identification analysis could aid  in criminal investigations, according to officials from one software industry  group we interviewed.

Device identification will impose minimal, if any, costs on taxpayers, third  parties, or IRS. It will not require additional taxpayer action, according to  IRS. In addition, IRS and tax software companies told us that while tax  software companies already capture device identification numbers when  a taxpayer is preparing a return, that information is not currently  transmitted to IRS. In contrast to some other options IRS is considering,  such as earlier W-2 matching, IRS can use current information technology  systems and processes to implement the device identification tool. For  example, the device identification number will be transmitted to IRS via  existing return transmission processes for e-filed returns. IRS could also  use its existing filters as a low-cost method of determining patterns of  device usage.

section_title: IRS is Pursuing Improved Taxpayer Authentication to Prevent IDT Refund Fraud; However, the Agency Does Not Have a Plan to Assess Costs, Benefits and Risks
subsections: section_title: IRS’s Current Authentication Tools Have Limitations
paragraphs: IRS has developed various personal identification numbers (PIN) to  authenticate taxpayers’ identities and help verify the legitimacy of tax  returns (see text box). Typically, these PINs are used by taxpayers to sign  e-filed tax returns. IRS programs its systems to not accept a tax return if a  required PIN is missing or does not match agency records. However,  according to our analysis of IRS information and interviews with experts  from tax software companies and associations, IRS’s current  authentication tools (such as the e-file PIN) have limitations.

PINs and the Identity Authentication They Require  Self-select PIN – Most taxpayers are eligible to use the Self-Select PIN. The Self- Select PIN requires taxpayers to provide their prior year’s adjusted gross income  (AGI) amount or prior year’s self created PIN to authenticate the taxpayer’s identity.  E-file PIN – If taxpayers do not have a self-select PIN or their prior year’s AGI, they  can obtain an e-file PIN. The e-file PIN requires taxpayers to authenticate their  name, SSN, date of birth, address, and filing status.  IP PIN – IRS provides IP PINs to past IDT victims who have confirmed their  identities with IRS, or to taxpayers who participated in a pilot program. In filing  season 2014, IRS offered this pilot to taxpayers in Florida, Georgia, and the District  of Columbia.

Identity thieves may be able to falsely obtain e-file PINs. Identity  thieves can easily find the information needed to obtain an e-file PIN,  allowing them to bypass some, if not all of IRS’s current automatic  checks, according to our analysis and interviews with tax software and  return preparer associations and companies.identity thieves can find identifying information through public records  or other easily accessible sources.

Only a small number of taxpayers undergo knowledge-based  authentication or receive IP PINs. Knowledge-based  authentication—a more intensive authentication process—uses  questions about personal information that only the taxpayer should  know to confirm taxpayers’ identities.  Examples of authentication  questions are “Who is your mortgage lender?” or “Which of the  following is your previous address?” IRS uses authentication  questions to confirm the identities of taxpayers whose returns are  flagged by IRS’s IDT and other fraud filters. Only a limited number of  returns—about 1 percent—are currently subject to this more intensive  authentication process. IRS also uses authentication questions to  confirm the identities of taxpayers who request an IP PIN. Because  IRS did not advertise the IP PIN pilot, the participation rate for the pilot  was low. According to IRS officials, as of July 31, 2014, IRS had  received about 21,000 requests out of about 13.9 million eligible  taxpayers (or about 0.15 percent of eligible taxpayers), in 2014. IDT  thieves can also obtain and use credit bureau information to answer  the authentication questions, according to IRS officials.

section_title: IRS Has Options for Improving Its Authentication Tools
paragraphs: IRS officials and several third parties, including software providers and  paid preparers, suggested IRS could enhance its taxpayer authentication  approach by expanding some current tools and by exploring additional  options. According to our review of IRS and third-party information, each  of these options has strengths and weaknesses. Unlike the device  identification tool, these options could require substantial changes to tax  administration and may burden taxpayers by requiring individuals to track  additional information or to take additional steps when filing a tax return.  Similar to pre-refund W-2 matching, improved authentication tools could  provide substantial benefits but require major investments in IRS systems  and changes to work processes. One advantage of authentication is that  it could be applicable to more tax returns than pre-refund W-2 matching,  since W-2 matching only works for tax returns reporting wage income.  Authentication options include:

Expanding the use of current authentication questions to a wider  set of taxpayers. IRS could use authentication questions for the  entire individual taxpayer population or in conjunction with other tools.  IRS is continually analyzing the effectiveness of its authentication  questions, which may be a benefit if the program was expanded.  However, IRS analysis of single filers whose returns were flagged by  fraud filters and who answered authentication questions has shown  limitations: some likely identity thieves were able to correctly answer  authentication questions while some legitimate taxpayers were not.

Expanding the availability of the IP PIN pilot to additional  taxpayers. Currently, IP PIN distribution is limited to individuals who  are IDT refund fraud victims or who participated in the IP PIN pilot.  However, IRS is considering an expansion of the IP PIN to include  more taxpayers. In responding to an open-ended question, 3 of the 18  associations we interviewed also suggested expanding the IP PIN  pilot to all taxpayers as an optional effort.additional layer of security for taxpayers, according to IRS. However,  the effectiveness of the IP PIN relies on the strength of authentication  questions, which have the limitations described above. In addition,  because taxpayers only use the IP PIN once a year when filing their  returns, retrieving lost IP PINs creates additional burden for taxpayers  and IRS.

A third-party issued credential would be aligned with standards established by the  National Strategy for Trusted Identities in Cyberspace (NSTIC), a White House initiative to  develop an online environment where organizations follow agreed upon standards to  obtain and authenticate their digital identities. returns would be processed. According to one analytics company we  interviewed, because this option could be an automated,  computerized match that would not require any action from taxpayers,  it would limit burden on low-risk taxpayers because they would not be  subject to additional authentication checks. Although the analytics  company official stated that this authentication option has been used  by some states, he also acknowledged that there are no data  available about its effectiveness in combating IDT refund fraud at the  state level.

section_title: IRS Is Creating an Authentication Group to Examine Options, but Lacks a Plan For Identifying and Assessing Tools
paragraphs: According to IRS officials, the agency is in the initial stages of creating an  authentication group aimed at centralizing several prior ad hoc efforts to  authenticate taxpayers across IRS services (e.g., online, telephone calls,  walk-in services). While the group was not specifically designed in  response to IDT refund fraud, improving authentication across IRS would  likely advance IRS’s ability to combat such fraud. IRS officials anticipate  the group will consider options for improving authentication and will make  recommendations to senior IRS executives. As of October 2014, the  group was operating as a task team, with staff detailed from other IRS  units. In its draft planning documentation, the authentication group  outlined several initial high-level goals. Generally, they include:

Centralize protection of IRS and taxpayers through integrated identity

Centralize decisions and a strategic approach for authentication;

Provide an avenue for tax administration through identity

Provide an operational foundation for authentication;

Provide a consistent operational approach to implementing  authentication processes, including updating relevant Internal  Revenue Manual sections;  Improve the security of IRS interactions and transactions with internal  and external stakeholders; and

Coordinate the testing of authentication techniques (e.g., in-person or  remote authentication through the Post Office or other venues).

The group has also documented short- and long-term priorities, including  implementation plans. In recent discussions, agency officials said they  would coordinate analysis of costs, benefits and risks with several IRS  offices. However, a commitment to cost, benefit and risk analysis is not  documented in the group’s short- and long-term priorities. The draft  planning documentation that we were given by IRS makes no mention of  where such analyses would be included in IRS’s priorities.

Federal guidance directs agencies to assess the costs, benefits and risks  of government systems. OMB provides guidance to agencies for  conducting economic cost-benefit and cost-effectiveness assessments  that promote efficient resource allocation through well-informed decision  making. Specifically, these assessments should consider different  alternatives to meet program objectives along with a discussion of costs  and benefits. Further, OMB and NIST provide guidance for agencies to  review new and existing electronic transactions to ensure that  authentication processes provide the appropriate level of assurance.Agencies can determine the appropriate level of assurance by conducting  an assessment, mapping identified risks to the applicable assurance  level, and selecting technology based on e-authentication technical  guidance, among other steps. While we recognize that developing  quantitative cost, benefit and risk estimates can be challenging or may  not always be possible, qualitative analysis can also be informative, as  discussed by OMB guidance.

Without analysis of costs, benefits and risks, IRS and Congress will not  have quantitative information that could inform decisions about whether  and how much to invest in the various authentication options. These  decisions could include which authentication options to pursue (e.g.,  expanding the IP PIN or issuing a credential), where in the tax filing  process authentication would be required (e.g., at the time of filing or after  a return is flagged by IDT filters), and what level of assurance would be  required (as detailed in OMB and NIST guidance). Cost, benefit and risk estimates for authentication would have the additional benefit of allowing  comparisons with other options for combating IDT refund fraud, such as  pre-refund W-2 matching. Both approaches could have significant costs  for taxpayers and IRS, so more information about the tradeoffs would  help inform IRS and congressional decision making.

section_title: Conclusions
paragraphs: IDT refund fraud is a large, continually evolving threat that is costing  taxpayers billions of dollars per year. Honest taxpayers who have had  fraudulent tax returns filed in their name have the burden of proving to  IRS who they are and waiting for delayed refunds. IRS has poured  resources into trying to clean up the tax accounts of the honest victims  and is playing a losing game of “pay and chase” with the thieves. A  strategy that avoids these costs would be one to prevent fraudulent  refunds from being issued in the first place. While IRS has a variety of  preventive measures in place, the Taxonomy estimates show that  additional preventative efforts could have significant benefits.

IRS’s Taxonomy estimates are one part of improving IRS’s prevention  strategies. Because the Taxonomy helps IRS understand how and to  what extent IDT refund fraud is evading IRS defenses, it can focus  attention on where the risk is greatest and can help improve the design of  IRS’s IDT filters. To reap the most benefit from the Taxonomy, decision  makers—both IRS managers and Congress—need to understand how  reliable the estimates are. Given the difficulties in estimating refund fraud,  reporting only point estimates risks misleading decision makers about the  extent and nature of IDT refund fraud. While a point estimate might lead  to one decision, a range that reflects the uncertainty may lead decision  makers to a different decision.

We previously recommended that IRS develop cost-benefit information on  pre-refund W-2 matching, which IRS has committed to implementing.  Another tool that IRS is beginning to implement is device identification,  which has potential benefits at low costs. IRS has limited information  about the costs, benefits and risks of a third option, taxpayer  authentication. The lack of this information could hinder decision makers’  ability to select which option (or combination of options) is most cost  beneficial.

section_title: Recommendations
paragraphs: To improve the reliability of Taxonomy estimates for future filing seasons,  the Commissioner of Internal Revenue should follow relevant best  practices outlined in the GAO Cost Guide by taking the following two  actions:

Documenting the underlying analysis justifying cost-influencing

Reporting the inherent imprecision and uncertainty of the estimates.

For example, IRS could provide a range of values for its Taxonomy  estimates.

To ensure relevant information is available to decision makers, we  recommend that the Commissioner of Internal Revenue estimate and  document the costs, benefits and risks of possible options for taxpayer  authentication, in accordance with OMB and NIST guidance.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this product to the Commissioner of Internal  Revenue for review and comment. In written comments, reproduced in  appendix IV, IRS agreed with our recommendations. With regard to our  first recommendation, IRS stated that it will follow best practices in the  GAO Cost Guide for documenting the rationale supporting assumptions  used in the Taxonomy estimates. IRS also stated that it will supplement  its revenue lost estimates by reporting the inherent imprecision and  uncertainty of estimates, subject to the availability of data and resources.

While we acknowledged IRS’s resource limitations in the report, we also  stated that reporting a point estimate without a range or some other  indication of uncertainty could provide a false sense of precision about  refunds prevented and paid. This false sense of precision could affect  decisions about how to allocate resources to combat IDT refund fraud.  Given the importance of these estimates, providing the proper context is  also important. With regard to our second recommendation, IRS stated  that its authentication group will develop a repeatable process to estimate  and document the costs, benefits and risks of possible options for  taxpayer authentication, in accordance with OMB and NIST guidance.  However, the scope and analysis may be limited due to available  resources and time. IRS also provided technical comments on figure 1,  which we revised to acknowledge that the examples provided are for IDT  refund fraud cases detected after refund issuance.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Commissioner of  Internal Revenue. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9110 or whitej@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.

section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report assesses (1) the quality of the Internal Revenue Service (IRS)  Identity Theft Taxonomy’s (Taxonomy) estimates of the cost of identity  theft (IDT) refund fraud, and (2) IRS’s progress in developing processes  to track device identification numbers and to enhance taxpayer  authentication. The report discusses IDT refund fraud and not  employment fraud.

To assess the quality of the Taxonomy’s estimates of IDT refund fraud,  we reviewed the Taxonomy’s methodology and estimates for filing season  2013 and evaluated them against selected best practices in the GAO  Cost Estimating and Assessment Guide (GAO Cost Guide) that were  applicable to the Taxonomy and consistent with IRS and Office of  Management and Budget (OMB) information quality guidelines (see text  box).Taxonomy is an estimate of the amount of revenue lost to IDT refund  fraud—a cost to taxpayers. To develop this guide, our cost experts  assessed the measures consistently applied by cost-estimating  organizations throughout the federal government and industry; based  upon this assessment, cost experts then considered best practices for the  development of reliable cost estimates.

Selected Best Practices in Cost Estimating  Objective, reliable cost estimates  Include all relevant costs.

Document all cost-influencing ground rules and assumptions.

Capture the source data used.

Describe in sufficient detail the calculations performed and the estimating  methodology used to derive each element’s cost.

Describe step by step how the estimate was developed so that a cost analyst  unfamiliar with the program can understand what was done and replicate it.  Provide evidence that the cost estimate was reviewed and accepted by  management.  Are regularly updated to reflect significant changes in the methodology.

Contain few mistakes.

Include a sensitivity analysis.  Include a risk and uncertainty analysis.  Are not overly conservative or optimistic, but are based on an assessment of most  likely costs.

During our assessment of the Taxonomy, we interviewed IRS officials to  better understand IRS’s methodology. We also discussed the GAO Cost  Guide’s best practices with IRS officials who generally agreed with their  applicability to the Taxonomy. IRS officials said many of the best  practices are relevant to the Taxonomy, but questioned the applicability of  best practices related to sensitivity and uncertainty analyses. They also  questioned whether the Taxonomy itself was a cost estimate. We  consulted with our cost estimating experts and concluded that the  Taxonomy is a cost estimate because it is IRS’s estimate of the amount  of revenue lost due to IDT refund fraud. Further, given the importance of  the Taxonomy and the fact that changes in the assumptions IRS makes  and includes in the estimates substantially affect results, we believe  providing information about the uncertainty of the Taxonomy estimates is  warranted (as discussed in more detail in the report).

To analyze IRS’s Taxonomy against the best practices, we reviewed  Taxonomy documentation, conducted manual data testing for obvious  errors, compared underlying data to IRS’s Refund Fraud & Identity Theft  Global Report, and conducted numerous interviews with IRS officials to  understand the methodology the IRS used to create estimates. We also  confirmed Taxonomy components where we had data available to cross  check. We developed an overall assessment rating for each best practice  using the following definitions:

Not met. IRS provided no evidence that satisfies any portion of the  best practice.

Minimally met. IRS provided evidence that satisfies a small portion of  the best practice.

Partially met. IRS provided evidence that satisfies about half of the  best practice.

Substantially met. IRS provided evidence that satisfies a large  portion of the best practice.

Met. IRS provided complete evidence that satisfies the entire best  practice.

To assess IRS’s progress in developing processes to track device  identification numbers and to enhance taxpayer authentication, we  reviewed Internal Revenue Manual sections detailing IRS’s Identity  Protection Program and IRS documentation for several tools developed to  combat IDT refund fraud. We also interviewed IRS officials to learn about  these efforts. These included the Identity Protection Personal  Identification Number, device identification, authentication group, and  other efforts related to identity authentication. We compared IRS’s  authentication group’s planning document to OMB’s guidance on cost- benefit analyses, as well as OMB and the National Institute for Standards  and Technology (NIST) guidance on assessing levels of assurance for  taxpayer authentication. We interviewed NIST officials to better  understand the methodology used in their cost-benefit analysis of a  credential-based taxpayer authentication system and to gather input on  the advantages and disadvantages of this type of system.

To learn about additional actions IRS could take to prevent IDT refund  fraud, we interviewed associations representing software companies,  return preparers, and financial institutions. To help ensure our analysis  covered a variety of viewpoints, we selected a nonprobability sample of  18 associations and stakeholders with differing positions and  characteristics, based on IRS documentation and suggestions, our prior  work, and other information. For example, to select associations  representing financial institutions, we considered (among other factors)  the size and type of institutions they represented (e.g., large or small  banks, credit unions, and prepaid debit card companies). Because we  used a nonprobability sample, the views of these associations are not  generalizable to all potential third parties.

When possible, we used a standard set of questions in interviewing these  associations and summarized the results of the semistructured interviews.  However, as needed, we also sought perspectives on additional  questions tailored to these associations’ expertise and sought their  opinions on key issues. To determine the feasibility of various options and  the challenges of pursuing them, we then communicated with IRS offices  including (1) Privacy, Government Liaison, and Disclosure; (2) Customer  Accounts Services, and (3) Return Integrity and Correspondence  Services.

We conducted this performance audit from August 2013 to January 2015  in accordance with generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

section_title: Appendix II: Summary of Tools to Combat Identity Theft Refund Fraud
paragraphs: The Internal Revenue Service (IRS) has developed multiple tools to  combat identity theft (IDT) refund fraud. IDT detection occurs at three  stages of the refund process: (1) before the IRS accepts tax returns, (2)  during IRS’s tax return processing, and (3) after IRS issues tax refunds to  taxpayers (or fraudsters). IRS uses some of these tools currently, while  others are under development or were recommended by one of our prior  reports. Table 4 describes each tool and its status.

section_title: Appendix III: How Assumptions Affect Identity Theft Taxonomy (Taxonomy) Results – Two Examples
paragraphs: The Internal Revenue Service (IRS) developed the Taxonomy for a  number of reasons, including the need to monitor both the volume and  cost of identity theft (IDT) refund fraud attempts and the effectiveness of  IDT defenses over time. Taxonomy estimates are based on IRS’s  administrative records of known IDT refund fraud (e.g., data on the  number of duplicate returns). The Taxonomy also estimates IDT refunds  by, for example, identifying returns with the characteristics of IDT refund  fraud, as detected by the Automated Underreporter (AUR) program.

Best practices within the GAO Cost Estimating and Assessment Guide  suggest that sensitivity and uncertainty analyses should be used to  determine whether assumptions are potentially introducing error into an  estimate. makes (and includes in its estimates of IDT refund fraud) substantially  affect Taxonomy results.
subsections: section_title: Example 1: IRS’s Analysis Demonstrates that Assumptions Substantially Affect Taxonomy Estimates
paragraphs: A sensitivity analysis (also known as “what if” analysis) examines the effect changing  assumptions has on the estimate by changing one assumption at a time. It involves  recalculating the estimate using differing assumptions to develop ranges of potential  estimates. Risk and uncertainty analysis recognizes the potential for error and captures  the cumulative effect that assumptions have on the cost estimate. It involves using  methods to develop a range of costs around a point estimate. See GAO Cost Estimating  and Assessment Guide: Best Practices for Developing and Managing Capital Program  Costs, GAO-09-3SP, (Washington, D.C.: March 2009). returns (the turquoise dots in figure 4) and which are IDT returns (the  purple dots).

As further illustrated in figure 4, IRS chose assumptions that it believed  best balanced comprehensiveness (that most IDT returns are likely  included but legitimate returns are also included) with certainty (that many  of the returns selected were IDT and include few, if any, legitimate  returns). A completely comprehensive estimate (as illustrated by the  larger circle) would be an overcount and could result in an IDT refund  estimate about 26 times greater than IRS’s current estimate, according to  our analysis of the Taxonomy. In contrast, a completely certain estimate  (as illustrated in the smaller circle) would be an undercount and would  result in an IDT refund estimate that is 25 times less than IRS’s current  estimate. Using these two extremes would likely result in an “IDT refunds  paid” estimate range that is too broad. Since IRS has not conducted an  uncertainty analysis, we do not know the range that likely encompasses  most cases of IDT.

section_title: Example 2: The Taxonomy Does Not Account for Variability in Refund Values
paragraphs: IRS uses an average refund value in certain Taxonomy categories,  instead of using the actual value of each individual refund counted in the  estimate. Therefore, it is likely that the total estimates of “IDT refunds  paid” and “IDT refunds prevented” are imprecise. For example, figure 5  demonstrates how IRS developed its estimate of the value of refunds   To  prevented by rejecting electronically filed returns (e-file reject).develop its $6.2 billion estimate, IRS multiplied the number of e-file  rejects (1.06 million) by the average refund associated with IDT returns  caught by IRS IDT filters and other fraud defenses ($5,804).

However, the average refund value of e-file returns detected by IRS IDT  defenses can vary—indicating uncertainty in this estimate. For example, if  IRS used the different average refunds in table 5 to develop its e-file  reject estimate, the total could range from $4.9 billion to $8.7 billion.

section_title: Appendix IV: Comments from the Internal Revenue Service

section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: James R. White, (202) 512-9110 or whitej@gao.gov.

section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Neil Pinney, Assistant Director;  Shannon Finnegan, Analyst-in-Charge; Dawn Bidne; Amy Bowser;  Deirdre Duffy; Michele Fejfar; Timothy Guinane; Katharine Perl; Jason  Lee; Donna Miller; Dae Park; Ellen Rominger; and Robyn Trotter made  key contributions to this report. Gary Bianchi, Nina Crocker, Mary Evans,  Ellen Grady, David Lewis, Paul Middleton, Sabine Paul, Sara Pelton,  Bradley Roach, LaSonya Roberts, Susan Sato, and Julie Spetz also  provided assistance.

section_title: Related GAO Products
paragraphs: GAO. Identity Theft: Additional Actions Could Help IRS Combat the  Large, Evolving Threat of Refund Fraud. GAO-14-633. Washington, D.C.:  August 20, 2014.

GAO. Financial Audit: IRS’s Fiscal Years 2013 and 2012 Financial  Statements. GAO-14-169. Washington, D.C.: December 12, 2013.

GAO. Internal Revenue Service: 2013 Tax Filing Season Performance to  Date and Budget Data. GAO-13-541R. Washington, D.C.: April 15, 2013.

GAO. Identity Theft: Total Extent of Refund Fraud Using Stolen Identities  is Unknown. GAO-13-132T. Washington, D.C.: November 29, 2012.

GAO. Financial Audit: IRS’s Fiscal Years 2012 and 2011 Financial  Statements. GAO-13-120. Washington, D.C.: November 9, 2012.

GAO. Taxes and Identity Theft: Status of IRS Initiatives to Help Victimized  Taxpayers. GAO-11-721T. Washington, D.C.: June 2, 2011.

GAO. Taxes and Identity Theft: Status of IRS Initiatives to Help Victimized  Taxpayers. GAO-11-674T. Washington, D.C.: May 25, 2011.

GAO. Tax Administration: IRS Has Implemented Initiatives to Prevent,  Detect, and Resolve Identity Theft-Related Problems, but Needs to  Assess Their Effectiveness. GAO-09-882. Washington, D.C.: September  8, 2009.


Question-summary annotations: questions: question: To what extent does the IRS examine the cost assumptions used to develop estimates?
answer: While IRS's fraud estimates note the relevant cost assumptions used to develop estimates, they do not provide the rationale or analysis to support them.
child_questions: question: Why wasn't the rationale documented?
answer: Officials stated they did not document the rationale because of the time and resources required.
child_questions: question: How does this compare to best practices?
answer: Best practices suggest that agencies should document assumptions.

question: How would documenting rationale help the IRS?
answer: Given the evolving nature of IDT refund fraud, documenting assumptions' rationale would help IRS management and policymakers determine whether the assumptions remain valid or need to be updated.

questions: question: How is the IRS centralizing taxpayer authentication systems?
answer: IRS recently created a group aimed at centralizing several prior ad hoc efforts to authenticate taxpayers across its systems.
child_questions: question: What does the planning documentation contain?
answer: IRS's planning documentation contains goals and short- and long-term priorities (including implementation plans). However, a commitment to cost, benefit and risk analysis is not documented in the group's short- and long-term priorities.
child_questions: question: How does this run counter to OMB guidance?
answer: Office of Management and Budget guidance states that agencies should use cost-benefit analyses that consider alternatives to promote efficient resource allocation and that agencies should ensure that authentication processes provide the appropriate level of assurance by assessing risks.

question: What are the negative effects of no analysis?
answer: Without analysis of costs, benefits and risks, IRS and Congress will not have quantitative information that could inform decisions about whether and how much to invest in the various authentication options.

question: Why would the detailed analysis be useful to the IRS?
answer: Cost, benefit and risk estimates for authentication would have the additional benefit of allowing comparisons with other options for combating IDT refund fraud. IDT options could have significant costs for taxpayers and IRS, so more information about the tradeoffs would help inform IRS and congressional decision making.

questions: question: What is the scale of the IRS's IDT refund program?
answer: IRS estimated it prevented $24.2 billion in fraudulent identity theft (IDT) refunds in 2013, but paid $5.8 billion later determined to be fraud.
child_questions: question: Why could the actual amount differ from the point estimates?
answer: Because of the difficulties in knowing the amount of undetected fraud, the actual amount could differ from these point estimates.

question: How does IDT refund fraud occur?
answer: IDT refund fraud occurs when an identity thief uses a legitimate taxpayer's identifying information to file a fraudulent tax return and claims a refund.

questions: question: How did GAO recommend IRS improve its fraud estimates?
answer: GAO recommends IRS improve its fraud estimates by (1) reporting the inherent imprecision and uncertainty of estimates, and (2) documenting the underlying analysis justifying cost-influencing assumptions.
child_questions: question: How could the IRS improve its documentation?
answer: In addition, IRS should estimate and document the economic costs, benefits and risks of possible options for taxpayer authentication.

question: To what extent did the IRS agree with GAO's recommendations?
answer: IRS agreed with GAO's recommendations and provided technical comments that GAO incorporated, as appropriate.