Tax Administration: IRS Has Implemented Initiatives to Prevent, Detect, and Resolve Identity Theft-Related Problems, but Needs to Assess Their Effectiveness
Released: 2009-10-08T00:00:00

Letter

Background

Identity theft describes a wide range of types of theft and uses of stolen information. According to the FTC, the most common form of identity theft is the use of another person’s information to obtain credit and then acquire goods or services, not pay for them, and thus damage the credit rating of the identity theft victim.

As already noted, identity theft most commonly becomes a tax administration problem for victims and IRS in two primary ways. First, an identity thief may use a legitimate taxpayer’s identity to fraudulently file a tax return and claim a refund during the filing season. In these cases, the identity thief typically uses a stolen SSN to file a forged tax return and obtain a refund early in the filing season. The legitimate owner of the SSN may not be aware that this has occurred until he or she files a tax return later in the filing season and IRS discovers that two returns have been filed using the same SSN. In this instance, the legitimate taxpayer’s refund will likely be frozen until IRS can determine the legitimate owner of the SSN. The second way that identity theft becomes a problem for taxpayers and for IRS is through employment fraud. This occurs when an identity thief uses someone else’s name and SSN to obtain a job. In this instance, IRS would receive a Form W-2 or a Form 1099 reporting income on the taxpayer’s account, which the rightful owner of the SSN had not earned and does not report as income to IRS. As a result, the taxpayer may be subject to enforcement action when, during the filing process, IRS matches what the employer and the taxpayer report and it appears that he or she earned more income than was reported on his or her tax return. In a related type of case, an identity thief uses just the SSN of a legitimate taxpayer and the thief’s own or a made up name. This also creates tax administration problems (as well as problems for the Social Security Administration) because the same SSN is now associated with multiple names. The name and SSN information used by identity thieves to commit refund or employment fraud are typically stolen from sources beyond the control of IRS. In many cases, the source of the stolen information is unknown. Someone who makes up an SSN that does not match a legitimate SSN and uses it to gain employment has failed to comply with legal requirements to supply a valid SSN but has not committed identity theft because no person’s identity was stolen.

Identity theft can also involve IRS in other ways, such as when thieves masquerade as IRS in order to steal information over the Internet through phishing schemes—using e-mail or Web sites to impersonate IRS and ask for personal and financial information from unsuspecting victims. According to IRS, there are a variety of online schemes that victimize taxpayers. “Get Your Refund” phishing e-mails appear to be legitimate e- mails from IRS notifying a taxpayer that they are entitled to a refund and can claim it quickly by clicking on a fraudulent link within the e-mail and providing their personally identifiable information. Fraudulent free e-file Web sites claim to be legitimate free e-file Web sites. Once a taxpayer enters his or her tax information, the identity thief enters his or her own bank account number and then steals the refund along with the taxpayer’s personal information, such as the SSN. Other schemes include surveys and malware. Surveys are usually sent through e-mails, where the fraudulent party masquerades as IRS asking taxpayers to rate their experience with IRS. Malware is an executable file sent through an e-mail, which asks the recipient to save and run a file. Once the file runs, information is pulled from the victim’s computer and sent to the fraudulent party. Identity theft can also involve IRS when IRS loses taxpayer data in either electronic form, such as information stored on a lost laptop computer, or on paper, such as documents lost in transit when being sent from one IRS facility to another. However, lost taxpayer data will not result in identity theft unless the data were found by an identity thief who uses the data for personal gain. Figure 1 describes the ways that identity theft issues come to light for IRS and taxpayers.

Federal and state legislatures have toughened laws that prohibit the theft of identities. In October 1998, Congress passed the Identity Theft and Assumption Deterrence Act, which expanded the criminalization of fraud in connection with identification documents to cover the unlawful transfer and use of identification documents. The law addresses identity theft by including instances when someone “knowingly transfers or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.” According to the President’s Identity Theft Task Force, all 50 states and the District of Columbia have some form of legislation that prohibits identity theft, and in all of those jurisdictions, except Maine, identity theft can be prosecuted as a felony.

In addition to congressional efforts to combat identity theft, there have been administrative efforts as well. The President’s Identity Theft Task Force was established in May 2006 by Executive Order 13402. The task force was created to coordinate federal agencies in their efforts against identity theft and to create a strategic plan to combat (increase awareness of, prevent, detect, and prosecute) identity theft.

Victims of identity theft can file a complaint with the FTC. The FTC maintains an Identity Theft Data Clearinghouse, which is the sole national repository of consumer complaints on identity theft. In 2008, the FTC received 313,982 identity theft complaints, a large increase over the number reported in prior years, as shown in figure 2.

Intending to strengthen IRS’s enterprisewide approach to identity theft and data security, IRS established PIPDS in July 2007. PIPDS includes four offices with roles defined by IRS as follows: Privacy. Promotes the protection of individual privacy and integrates privacy into business practices, behaviors, and technology solutions.

Identity Protection. Identifies risks and reduces vulnerabilities of identity information, enhances services and reduces burden and harm to identity theft victims, and increases collaboration and communication with IRS stakeholders and external partners.

Incident Management. Assesses and reduces IRS data loss incidents, promotes protection of personal identity information by IRS employees, and informs taxpayers of identity theft risks discovered by the IRS.

Online Fraud Detection and Prevention. Reduces and prevents online fraud against IRS and taxpayers.

PIPDS collaborates with IRS activities that deal with identity theft cases and issues. A technical working group was formed to provide a forum for developing recommendations on how processes and procedures can be improved to address and reduce the burden on taxpayers who are victims of identity theft. Additionally, IRS established two advisory committees to oversee Identity Theft and Incident Management and Online Fraud Detection and Prevention activities. The advisory committees include executive management from Small Business/Self-Employed (SB/SE), Wage and Investment (W&I), Criminal Investigation (CI), and the Taxpayer Advocate Service (TAS).

IRS’s Ability to Detect and Catalog Current Identity Theft Incidents Is Limited and the Amount That Goes Undetected Is Not Known

IRS began systemically cataloging data on identity theft incidents in January 2008, but limitations on the data mean that the data provides an incomplete picture of the amount of identity theft-related fraud occurring at IRS. IRS catalogs identity theft incidents after identifying a possible case, validating that identity theft-related fraud occurred, and substantiating the identity of the victim taxpayer. Because of the timing of tax return filing, IRS is often unable to detect suspicious cases until well after the fraud occurred. Validating the identity theft and substantiating the victim’s identity takes further time. For example, IRS may not be able to detect potential employment fraud until after the following year’s tax filing deadline of April 15 when it matches Form W-2 information against filed tax returns. It is only after IRS notifies a taxpayer of unreported income that IRS may learn from the taxpayer that the income was not his or hers and that someone else must have been using his or her identity. By the time both the victim and IRS determine that an identity theft incident occurred, well over a year may have passed since the employment fraud.

Time lags are not the only issue obscuring a complete picture of identity theft tax cases at IRS. Some cases go undetected altogether. One reason for this is that IRS does not investigate every case of potential employment fraud. Because of the large volume of mismatches between what is reported on a Form W-2 or a Form 1099 information return and what is reported on an income tax return, and also because of IRS’s limited resources, IRS does not pursue some mismatches. Consequently, IRS is not in a position to detect any underlying identity theft in those cases. Also, if an identity thief steals the identity of a person with no tax filing obligation, such as a child, and files returns and pays taxes using the name and SSN of that person, IRS may have no way of detecting the identity theft. From IRS’s point of view, a tax return has been filed with a name and SSN that match and the income on the tax return matches income reported by an employer.

Many IRS Activities Detected Identity Theft

Table 1 shows the tax-related identity theft incidents that IRS cataloged as of December 31, 2008. Most of the incidents in the table are for identity thefts that occurred since 2005, but some incidents go back many years.

The incidents shown in table 1 include open tax-related identity theft cases reported by various IRS activities. A case is considered open if the taxpayer continues to have identity theft-related issues. For all of the incidents shown in table 1, IRS validated that the identity theft-related fraud occurred and substantiated the identity of the victim taxpayer. The table demonstrates that IRS detects identity theft throughout the course of normal tax administration activities, including processing tax returns, examining returns to verify compliance, and collecting tax debt.

The 51,702 incidents cataloged in table 1 are primarily refund or employment fraud, as shown in table 2.

IRS identifies refund fraud primarily through the Questionable Refund Program (QRP) in CI. QRP was established to identify fraudulent returns, stop the payment of fraudulently claimed refunds, and, in some cases, refer fraudulent refund schemes to CI’s field investigation offices. CI may ultimately refer refund schemes to the Department of Justice (DOJ) for possible criminal prosecution. According to data from CI, the median amount of suspected identity theft-related refunds identified during the 2009 filing season was about $3,400.

Over the past 4 years, CI has investigated a number of tax-related identity theft cases that DOJ successfully prosecuted. For example, a former Girl Scout troop leader is now serving 10 years in federal prison for using children’s identities to defraud the government. The defendant pleaded guilty to multiple counts of filing fictitious tax refund claims and identity theft. The defendant created fake medical release forms for her troop members and told their parents that she needed the girls’ SSNs in case of an emergency. The scheme helped her claim more than $87,000 in fraudulent tax refunds.

According to CI data, in 2008, IRS stopped about 90 percent of suspected identity theft-related refunds it identified as shown in table 3. For the other 10 percent, a majority of the refunds were issued to suspected identity thieves before the legitimate taxpayer filed their return. It is only when IRS finds a duplicate tax return (a second return filed using the same name and SSN) that IRS has an indication of potential refund fraud.

As shown in table 3, about $15 million in fraudulent refund payments were issued in calendar year 2008. IRS officials said that they could not determine how many of those refunds have been recovered. They said that in instances where CI opens a criminal investigation and the government successfully prosecutes the identity thief, upon conviction the perpetrator may be ordered by the court to pay restitution. However, this process may take a long time, and it is rarely possible to associate any restitution paid with a specific refund fraud incident because these prosecutions generally involve more than fraudulent refund schemes. Officials also noted that in cases that do not result in criminal prosecutions, IRS does not often recover the stolen refund.

IRS Has Implemented New Initiatives in an Effort to Detect and Resolve Identity Theft Cases, but Not Enough Is Known about How Well the Initiatives Are Working

In 2008 and 2009, IRS implemented four initiatives to detect and resolve identify theft cases: identity theft account indicators, screening procedures for returns with indicators, the Identity Protection Specialized Unit (IPSU), and call centers with an identity theft telephone hotline.

IRS Implemented Its Identity Theft Initiatives Without Measures to Assess How Well They Are Working

IRS has not assessed the value of its new initiatives. IRS officials said they want to make such assessments. However, currently IRS has not defined measures that would provide an empirical basis for answering questions such as those listed below. This list of questions is not meant to be exhaustive.

How many false positives (cases where a legitimate return is flagged as being fraudulent) and false negatives (cases where a fraudulent return is not flagged) are generated by the screening process?

How long does it take and what is the cost to resolve cases that do not pass the screening and get reviewed by IRS personnel? This is important to taxpayers because refunds are held up while the review is conducted.

How well does the current division of responsibility for resolving identity theft cases work or would a more centralized process work better?

How well are taxpayers’ questions answered and issues resolved using the hotline?

IRS has developed objectives for its Identity Protection Strategy, which is a step towards effective performance measurement: reduce taxpayer burden while addressing and resolving identity theft cases, protect Treasury revenue by identifying suspicious filings before the refunds are generated, and increase operational efficiency of IRS by detecting and processing reported identity theft incidents as early and consistently as possible.

Further, PIPDS has recently developed one identity theft-related performance measure, “Increase revenue protected from erroneous refunds to identity thieves” and is reviewing the results of returns that were run through the business rules to capture data for this measure. PIPDS also stated that it has contracted with a consultant to help develop a suite of performance measures by the end of 2009. However, at the time we concluded our work, it was not known whether the performance measures will answer the types of questions we outlined above. Furthermore, for the measures to be in place in time to assess the initiatives performance during the 2010 filing season, timely action will be required. The measures will need to be developed early enough to give IRS time to develop a plan for capturing the data needed to implement the measures.

The answers to questions such as those listed above were not available when IRS designed its identity theft initiatives. IRS did not have an empirical basis for knowing what approach, such as having IRS activities rather than IPSU resolve cases, would work best. Furthermore, there have been some glitches with implementation. PIPDS officials told us that they are aware that some IRS activities have not been consistent in how they applied the identity theft indicators, causing some discrepancies in how returns were run through the screening procedures. For example, some activities would put the indicator on the taxpayer’s account before ensuring that the information by the identity thief was removed from the taxpayer’s account. Therefore, this resulted in legitimate taxpayer’s returns failing the business rule screening and may have delayed the taxpayer’s refund. In June 2009, PIPDS officials subsequently met with the different IRS activities to revise their procedures for placing indicators on taxpayer accounts before the 2010 filing season.

Our own review of the effectiveness of the identity theft indicator and screening process also uncovered some possible issues. We compared IRS data from PIPDS and CI to test whether IRS issued refunds to suspected identity thieves in cases where there was already a 501 or 506 identity theft indicator on the account of the innocent taxpayer. We used the limited data available for 2009 because we wanted to look at cases handled after the new initiatives were put in place. As shown in table 5, we found that IRS failed to prevent a fraudulent refund 15 times in early 2009 even though the account had an identity theft indicator. During the same period, CI stopped 3,281 refunds, 14 percent of which had an identity theft indicator on the associated taxpayer account. Our analysis covers only part of the year and the initiatives are still new, so it is not possible to know whether this represents the long-term effectiveness of the initiative or not.

Further, according to TAS officials, the number of TAS cases that involved identity theft issues in the first half of fiscal year 2009 was more than twice as high as it was in the same period in fiscal year 2008. Based on analyzing Taxpayer Advocate data, 8,880 taxpayers for whom TAS opened cases with identity theft issues in the first half of fiscal year 2009, 943 (about 11 percent) contacted TAS on their own initiative after another IRS activity had already placed a 501 or 506 indicator on their accounts. The presence of the indicator means that IRS was already working to resolve the taxpayer’s tax problems before the taxpayer contacted TAS. As with our analysis of the screening process, these results need to be interpreted with caution. TAS policy is to always note identity theft problems in the TAS database, even when the taxpayer contacted TAS about a different problem. In addition, because the indicators were so new we cannot be sure that the TAS data reflect their long-term effects. Also, some of the communication with taxpayers about their identity theft issues included TAS contact information, and PIPDS officials noted that some taxpayers may have contacted TAS thinking that it was the IRS office to which they should direct their questions.

Our analysis of screening program results and TAS data suggests that IRS’s identity theft initiatives could be having a positive effect, but the evidence is not at all conclusive. The results do show that the initiatives have had some glitches; for example, some fraudulent refund payments were made despite the presence of an indicator. Overall, our analysis highlights the importance of IRS developing performance measures that will provide a basis for monitoring the effectiveness of the initiatives over time.

IRS Processes to Prevent Identity Theft through Phishing or Security Breaches

IRS provides taxpayers with targeted information to increase their awareness of identity theft, tips and suggestions for safeguarding taxpayers’ personal information, and information to help them better understand tax administration issues related to identity theft. A new segment of the IRS home page, www.irs.gov, provides taxpayers with identity theft information including emerging trends, phishing sites, fraud schemes, and prevention strategies. According to IRS officials, they receive information on potential phishing schemes primarily from citizens sending IRS the information via phishing@irs.gov. These officials said IRS is directing victims to the most up-to-date identity theft information to ensure that they know how to report identity theft crimes and have the necessary resources and support to recover their identities. Additionally, IRS has worked to revise its most widely used documents, such as Form 1040, to include information about identity theft. To raise awareness with paid preparers, IRS officials are making identity theft and phishing presentations at the annual nationwide tax forums held for preparers.

In 2007, IRS created the Online Fraud Detection and Prevention (OFDP) office to reduce online fraud against IRS and taxpayers and provide a rapid response capability to detect and respond to such fraud. OFDP relies on tips from the public sent to phishing@irs.gov and other information sources. Once a fake electronic filing site is found, the team gathers information, such as screen shots of the site, and then passes it to CI and TIGTA for investigation. IRS sends a taxpayer identified as a possible victim a notification letter and a request asking the taxpayer to report the incident to FTC, contact the fraud departments of major credit bureaus, close any accounts that have been tampered with, and contact IPSU for further information. Additionally, officials stated that OFDP is currently investigating processes to securely transmit compromised credit card information to banks. In addition, OFDP contacts the Web site’s hosting provider to notify them that one of their customers is hosting a phishing site, and asks the hosting provider to voluntarily take down the site or remove the fraudulent content. According to the OFDP Director, the number of fraudulent Web sites taken down increased to 3,030 in 2008, as shown in figure 3.

IRS faces challenges combating fraudulent Web sites. OFDP officials stated that schemes and Web sites that originate outside the United States are particularly challenging because of jurisdictional issues. However, the officials also said that IRS is working with TIGTA, DOJ, and other organizations to use existing authorities and relationships to assist with combating such fraud. Another challenge is the ability of fraudulent parties to use multiple computer IP addresses that change frequently, making it difficult to trace the perpetrator’s actual IP address. Finally, according to officials, some institutions are reluctant to share specific information about online fraud perpetrated against them. To help overcome this, officials stated that they are working with organizations such as the National Cyber Forensics and Training Alliance, Anti-Phishing Working Group, and others, to facilitate and improve information sharing about fraud schemes.

IRS has considered additional steps to help combat phishing and similar identity theft schemes such as providing a list of legitimate Web sites. However, such a list would be almost impossible to keep current.

IRS Information Security Weaknesses

Although IRS does not know of any cases where information security weaknesses have led to actual identity theft, as was noted earlier in table 4 IRS had 149 incidents of lost data affecting 911 taxpayers in 2008. Perhaps more importantly, IRS has information security weaknesses that increase the likelihood of IRS employees committing identify theft. Specifically, in January 2009 we reported that IRS did not consistently implement controls that were intended to prevent, limit, and detect unauthorized access to its systems and information. We noted that IRS did not always (1) enforce strong password management for properly identifying and authenticating users and (2) authorize user access, including access to personally identifiable information, to permit only the access needed to perform job functions. For example, the agency allowed authenticated users on its network access to shared drives containing taxpayer information as well as performance appraisal information for IRS employees including their SSNs. We made recommendations to IRS regarding ways to strengthen its information security practices. IRS agreed with the recommendations and stated that the agency is working to improve its security posture, and will develop a detailed corrective action plan addressing each of our recommendations. Until IRS addresses these weaknesses, there is an increased risk that someone could use his or her access to steal personally identifiable information and commit identity theft-related crimes.

Privacy and Other Laws Limit IRS’s Coordination with Other Agencies on Identity Theft Cases

Section 6103 of the Internal Revenue Code (I.R.C.) limits the types of information IRS can share with external parties, including identity theft victims, employers who may have workers using stolen identity information, or other government agencies, including law enforcement agencies. Under section 6103, tax returns and other information submitted to and, in some cases, generated by, IRS, are confidential and protected from disclosure, except as specifically authorized by statute.

IRS can disclose identity theft-related events that occur on a taxpayer’s account to the taxpayer, such as the fact that an unauthorized return was filed using the taxpayer’s information or that the taxpayer’s SSN was used on another return. However, IRS may only disclose to the taxpayer the taxpayer’s own return information. Therefore, IRS cannot disclose any other information about a fictitious Form 1040 or an incorrect Form W-2 submitted to IRS, or any information about IRS’s investigation into the civil or criminal tax liability of the perpetrator (whether refund fraud or employment fraud) to the victim. In addition, IRS cannot disclose information about the perpetrator’s identity to the taxpayer.

IRS can notify an employer whose employee has used a stolen SSN that the SSN on the Form W-2 filed for that employee does not belong to that individual. IRS can disclose to the employer that there is a mismatch between name and SSN and that the number belongs to someone else. However, IRS cannot disclose any further information such as the identity of the true owner of the SSN, to the employer. The employer is required to file a Form W-2 with accurate information and to file a corrected form if necessary. If an employer fails to file information returns or fails to include complete and correct information on them, IRS is authorized to penalize the employer. However, in prior work, we have reported that because of limited requirements for employers to verify and report accurate employee names and SSNs, few, if any, employers are likely to be penalized. For example, if employers establish reasonable cause for the incorrect Form W-2 information by showing they solicited an SSN from each employee one to three times, depending on the circumstances, and that they used this information to complete the wage statements, IRS will waive the penalties on the employers.

In 2008, IRS carried out a servicewide analysis of its efforts related to notification of identity theft victims and employers and information sharing with other federal agencies. IRS sought to determine if it was fully utilizing its disclosure authority under section 6103 to address the problem of identity theft and assist victims. The working group conducting the analysis determined that IRS was appropriately using its disclosure authority, though it also identified a few areas where IRS had authority to expand victim/employer notification and information sharing with federal law enforcement, if doing so was deemed sound policy. IRS is in the planning phase of an initiative to notify victims of employment fraud.

Section 6103 also limits the types of information indicating identity theft that the IRS can share with other agencies. For example, according to officials in IRS’s Office of Chief Counsel, IRS can only share limited information about employment fraud with the Department of Homeland Security (DHS) and the Social Security Administration (SSA). A circumstance where IRS can share some information with federal law enforcement/immigration agencies is when IRS performs a criminal investigation. In these cases IRS can make investigative disclosures, i.e., the sharing of specific, limited information necessary for receiving information from other agencies that might support or further IRS’s investigation. Disclosure of taxpayer information to state and local law enforcement agencies is even more limited. As mentioned previously, officials stated that IRS is currently investigating processes to securely transmit compromised credit card information to banks.

IRS officials also noted that tax fraud is not one of the 11 felony offenses enumerated in 18 U.S.C. §1028A, the Aggravated Identity Theft Statute. This means that in federal identity theft prosecutions, identity thieves would not be subject to the enhanced sentencing prescribed in the statute, an additional 2-year term of imprisonment. They also stated that this may be one factor that deters other federal law enforcement agencies and federal prosecutors from referring identity theft cases to IRS to look for possible tax fraud or making identity theft-related tax fraud a priority when determining which cases to pursue.

According to PIPDS officials, activities that place 501 and 504 indicators on taxpayer accounts do not routinely accept information about identity theft victims from other federal agencies or other external parties. IRS does not routinely accept this information because it does not meet IRS’s substantiation requirements.

Section 6103 does not limit IRS’s ability to share more general information about how to manage identity theft. PIPDS has coordinated with private industry leaders, tax professionals, and other federal agencies on identity theft prevention, detection, and taxpayer assistance about how to handle tax-related identity theft issues and to share information about the increase in online fraud threats. PIPDS officials also meet with officials from other federal agencies such as SSA, FTC, and DHS and held a forum in July 2008 to share information on the effects of identity theft on victims and to identify best practices for preventing and resolving identity theft issues. According to PIPDS, one result of the forum was that IRS co- sponsored, along with the FTC, DHS, US Postal Inspection Service, Department of Commerce, DOJ, and the Securities and Exchange Commission, an educational website, www.onguardonline.gov. IRS is also coordinating with agencies to shut down phishing sites and online fraud schemes. According to CI and PIPDS, they are members of the Identity Theft Enforcement Interagency Working Group which shares information about leading identity theft activities, groups, and offenders with federal agencies that pursue identity theft cases.

Conclusion

While identity theft is known to cause tax problems for a relatively small number of taxpayers, for those affected the problems can be severe and include refunds frozen and time wasted. In an effort to more efficiently identify refund fraud and employment fraud as well as to assist innocent taxpayers, IRS put in place four new initiatives. Although IRS management has begun to develop performance measures, it is not known how well the measures will assess the effectiveness of the four initiatives.

Furthermore, it would be desirable to have the new measures in place for the 2010 filing season for at least two reasons. First, most refund fraud is committed during the filing season and also most employment fraud is detected as part of the filing process. Second, IRS is expanding the identity theft initiatives for the 2010 filing season. Without performance measures in place, neither Congress nor IRS management will know whether the 2010 changes are effective or if additional changes are needed.

Recommendation for Executive Action

We recommend that the Commissioner of Internal Revenue ensure that performance measures suitable for assessing the effectiveness of its identity theft initiatives, and associated data collection procedures, are in place at the beginning of the 2010 filing season.

Agency Comments

The Commissioner of Internal Revenue provided written comments on a draft of this report in an August 31, 2009, letter, which is reprinted in appendix IV. The Commissioner agreed with our recommendation. In his letter, the Commissioner discussed IRS’s commitment to reduce the impact of identity theft on taxpayers and said that he has made it a priority at IRS to reduce the burden placed on the taxpayer and the tax system because of identity theft. IRS provided separate comments on technical issues, which we incorporated into this report where appropriate.

As agreed with your offices, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its issue date. At that time, we will send copies to the Secretary of the Treasury; the Commissioner of Internal Revenue, and other interested parties. This report will also be available at no charge on GAO’s Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9110 or whitej@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) describe how much identity theft- related refund and employment fraud the Internal Revenue Service (IRS) faces and whether incidents of identity theft go undetected by IRS, (2) assess the actions IRS is taking to prevent and detect identity theft-related tax problems and to assist affected taxpayers, and (3) describe what IRS is doing to coordinate its identity theft-related efforts with other government and nongovernment entities.

To understand how much identity theft-related refund and employment fraud IRS faces, we interviewed IRS officials from the Office of Privacy, Information Protection and Data Security (PIPDS), Wage and Investment Division (W&I), Small Business/Self-Employed Division (SB/SE), Criminal Investigation Division (CI), and Submission Processing. We discussed the processes and systems used to identify identity theft-related refund fraud and IRS’s use of the identity theft indicators. Additionally, we analyzed information from PIPDS on the number and characteristics of identity theft-related refund and employment fraud by cases and affected taxpayers, including the activity reporting the incident and the type of identity theft indicator placed on the taxpayer account. Based on the information we collected on the identity theft-related incidents and affected taxpayers, we also were able to discuss the outcomes of the identity theft-related refund fraud cases and identify the reasons which incidents of identity theft go undetected.

To determine the reliability of the PIPDS data sets, we interviewed knowledgeable officials to discuss processes followed to upload the taxpayer data, collection methods, and the data reported on and for what purpose. We also reviewed related documentation to determine the accuracy of the 2008 year-end aggregate numbers of taxpayers affected and identity indicators placed on accounts. PIPDS provided us with monthly reports on the number of taxpayers affected and incidents reported as well as an annual report totaling these numbers. We compared the monthly reports to the aggregated data to identify any obvious errors in accuracy and completeness. We determined that the PIPDS data we used for this objective were sufficiently reliable for this assessment.

To assess what actions IRS is taking to prevent and detect identity theft- related problems and to assist affected taxpayers, we interviewed officials from PIPDS, W&I, SB/SE, CI, the Online Fraud Detection and Prevention office (OFDP), and the Taxpayer Advocate Service (TAS). We discussed new initiatives IRS has implemented to detect and resolve identity theft as well as assist affected taxpayers and educate taxpayers about identity theft. We also reviewed prior GAO work to obtain information on identity theft-related issues in the federal government and on systems used to safeguard IRS data and to identify identity theft-related incidents, as well as Treasury Inspector General for Tax Administration (TIGTA) reports to obtain information on the identity theft-related processes and procedures used by IRS. Additionally, we collected and analyzed IRS’s Identity Protection Strategy, policies and procedures related to identity theft prevention and detection and assistance, relevant sections of the Internal Revenue Manual and Internal Revenue Code, and governmentwide guidance on performance measures. To understand how IRS implemented some of the new initiatives, we visited the Andover, Massachusetts campus and reviewed processes followed by the Identity Protection Specialized Unit (IPSU) and the Baltimore call center to listen to calls taken by customer service representatives on the identity theft hotline. Additionally, we met with and reviewed the software used by the OFDP staff when taking down a fraudulent Web site. For these new initiatives, we collected data on the number of affected taxpayers whose records had identity theft indicators, the number of cases worked by the IPSU, information on calls received by the dedicated identity theft call-in number, and the number of fraudulent Web sites taken down by OFDP. We reviewed the data and documents provided by IRS in conjunction with discussions with IRS officials in order to describe these new initiatives as well as to understand the extent to which IRS had performance measures to determine the effectiveness of the new initiatives. We used previous GAO work and recommendations to describe systems and information security weaknesses and assessed how these weaknesses may translate to identity theft-related issues for IRS and taxpayers.

To assess whether IRS’s initiatives were working as intended, we interviewed PIPDS and TAS officials and used IRS and TAS data to identify (1) the frequency with which suspected identity theft-related refund fraud reoccurred for taxpayers known to have had identity theft issues in the past and (2) how often taxpayers took identity theft-related tax problems to TAS after other IRS functions had determined that their issues were related to identity theft. To assess whether the business rules were working as intended, we tested suspected identity theft-related refunds that were identified by CI to determine how many of the corresponding taxpayers had indicators on their accounts before the refunds were stopped or issued by IRS. To perform this assessment we received from PIPDS taxpayer data on all taxpayer accounts that had indicators on them. We also received from CI taxpayer data on all suspected identity theft-related refunds that were identified, stopped, and issued by IRS from January 1, 2009, through April 30, 2009. To assess how often taxpayers took their issues to TAS after an identity theft indicator had been placed on their accounts, we compared taxpayer data from TAS with identity theft as a primary or secondary issue code to data from PIPDS identifying all taxpayer accounts with identity theft indicators. We compared the dates the identity theft indicator was placed on the accounts to the dates when TAS received the cases. Additionally, we reviewed the reason why the cases came to TAS based on each identity theft indicator. We requested TAS cases received from October 1, 2008, through May 18, 2009, and PIPDS indicator data from calendar year 2008.

We received taxpayer data from PIPDS, CI, and TAS. To ensure the reliability of the data, we performed an analysis using Statistical Analysis Software (SAS) to test for obvious errors in accuracy and completeness. Additionally, we reviewed related reports to determine if there were any discrepancies in the data we received. Any questions we had about the data were answered by knowledgeable officials with whom we also discussed the processes followed to upload the taxpayer data, collection methods, and the data reported on and for what purpose. We determined that the PIPDS, CI, and TAS data we used for this analysis were sufficiently reliable to use for this assessment.

To identify what IRS is doing to coordinate its identity theft-related efforts with those of other government agencies and other entities as well as to identify any lessons learned, we interviewed officials from IRS’s PIPDS, Office of General Counsel, OFDP, and W&I. We also reviewed documentation provided by IRS officials, a recorded version of the IRS identity protection forum held in July 2008, and previous GAO work. We also reviewed an IRS general counsel analysis and discussion of Section 6103 of the Internal Revenue Code to determine the circumstances in which IRS can share information with other federal agencies, law enforcement employers, and the taxpayers for identity theft-related refund and employment fraud issues.

We conducted this performance audit from October 2008 through August 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Description of Indicator Codes Used to Identify Tax and Non-Tax Related Issues

In January 2008, the Internal Revenue Service (IRS) began using indicator codes to identify taxpayers with identity theft-related issues. How the identity theft-related issue comes to IRS and the type of incident will dictate the indicator that will be placed on taxpayers’ accounts. Based on the incidents, IRS can require additional documentation to substantiate the identity theft and run certain flagged accounts through additional screenings in subsequent years. See table 6 for a more detailed description of the indicators.

Appendix III: Procedures Followed for Additional Screening of Certain Indicator Accounts

Taxpayer accounts with a 501 or 506 indicator are run through additional screenings in subsequent years to determine the legitimacy of the return filed. The Internal Revenue Service (IRS) initially decided to run the 501 and 506 indicators through additional screenings because IRS processes determined those accounts to have identity theft directly impacting IRS.

Returns that pass the additional screening are sent through for regular processing. If a return fails the screening, the Unpostable Unit in Submission Processing will attempt to determine if the return was filed by the legitimate taxpayer or an identity thief. If the Unpostable Unit cannot resolve the problem, Accounts Management will conduct a more detailed analysis, which may include contacting the taxpayer. Once Accounts Management determines the owner of the return, they will forward the information back to the Unpostable Unit who will send the legitimate returns through for regular processing and mark any returns filed by identity thieves as bad.

Appendix IV: Comments from the Internal Revenue Service

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the individual named above, David Lewis, Assistant Director; Sabine Paul, Assistant Director; Mary Fike; Suzanne Heimbach; Sairah Ijaz; Laurie King; Sabrina Streagle; and James Ungvarsky made key contributions to this report.