Identity Theft and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an Estimate of Costs, Benefits and Risks
Released: 2015-02-19T00:00:00

Letter

Background

Identity Theft Refund Fraud – Key Components

IDT refund fraud occurs in the context of several inter-related issues: the vulnerability of personal information, thieves’ ability to exploit IRS’s current compliance model, and the attractiveness of IDT refund fraud as a target.

Theft of Personal Information. To successfully commit IDT refund fraud, thieves must exploit various sources of information to steal or otherwise obtain individuals’ identities. According to an official in IRS’s Criminal Investigation division, the sources of stolen identities are limitless. The Department of Justice has prosecuted cases ranging from an employee stealing information from his employer to organized cyber attacks that infiltrate computer systems.

Exploitation of IRS Compliance Checks. After obtaining personal information belonging to legitimate taxpayers (or to individuals who do not have a tax filing obligation), identity thieves use this information to file fraudulent tax returns claiming refunds. Identity thieves are often able to exploit what IRS officials call a “look back” compliance model: rather than holding refunds until all compliance checks can be completed, IRS issues refunds after doing some selected, automated reviews of taxpayer- submitted information (see text box). IRS is under pressure from taxpayers who expect to receive their refunds quickly.normally issues refunds before matching tax returns to third-party information returns (such as W-2 data).

Examples of automated reviews used

Matching name and Social Security number (SSN)

Correcting obvious errors—such as mathematical mistakes or exceeding the statutory limits of deductions and credits.

Attractiveness of IDT Refund Fraud. IDT refund fraud crimes often involve large criminal enterprises that exploit the speed and relative anonymity of preparing and filing tax returns. For this reason, they are difficult to prosecute, according to the Department of Justice.

IRS’s Current IDT Refund Fraud Response

In light of the complexity and fluidity of this threat, IRS addressed refund fraud and IDT in its strategic plan, identifying both issues as major challenges facing the nation’s tax system over the next several years (see text box).

IRS: Addressing the Threat of Refund Fraud and Identity Theft “Assuring the accuracy of refunds and the security of taxpayer data remain our priorities going forward. We are committed to stopping this threat to tax administration, protecting our government’s revenue and safeguarding the identity of all taxpayers. We must bolster our efforts to prevent refund fraud and identity theft before they happen.”

The plan further states that IRS is committed to building a stronger identity authentication process that will enable secure, timely processing of tax returns and improve other service interactions. IRS has also identified several strategic objectives relevant to its efforts to combat identity theft, including balancing the speed of refund delivery with the need to verify taxpayers’ identities; and using third-party data, risk modeling, and a historical view of taxpayer interactions to prevent fraud before issuing refunds.

Further, IRS has allocated more than 3,000 employees to combat IDT refund fraud, including assigning staff to help IDT victims resolve their accounts. The agency has also requested an additional $64.9 million in its fiscal year 2015 budget request for staffing and advanced technologies to support its continued IDT and refund fraud efforts.

In addition to identifying IDT refund fraud as a major issue and requesting additional resources, IRS has developed a number of tools to address IDT refund fraud throughout the tax return filing process—and has done so amidst budget reductions and other challenges.IDT refund fraud includes efforts to authenticate taxpayer identities as well as several tools used to detect and prevent IDT refund fraud, as described below (see appendix II for more detail on these IDT refund fraud tools).

IRS’s response to Authenticating Taxpayer Identities. IRS has enhanced its authentication efforts to combat IDT refund fraud. For example, IRS provides IP PINs to past IDT victims who have confirmed their identities with IRS. IP PINs help prevent future IDT refund fraud because, once issued, the IP PIN must accompany an electronically filed (e-file) tax return. In addition, IRS conducts authentication checks on returns flagged by IDT and fraud filters. If flagged, IRS stops processing the return and sends a letter asking the taxpayer to confirm his or her identity. IRS then confirms the taxpayer’s identity by asking for personal information, such as the taxpayer’s previous addresses, mortgage lender, and family members.

Taxpayer Alerts. Often, IRS becomes aware of IDT refund fraud when a legitimate taxpayer alerts IRS of an inability to e-file. Specifically, in cases where an identity thief has already e-filed a return using the taxpayer’s name and Taxpayer Identification Number—such as an SSN—IRS’s e-file system will reject the second, duplicate return (top of figure 1), thus preventing the legitimate taxpayer from filing. IRS officials are aware when their e-file system rejects returns; however, they do not know if the rejections are due to IDT refund fraud unless further investigation is conducted.

Information Return Matching. IRS also finds IDT refund fraud as part of the Automated Underreporter (AUR) program, which matches tax return data to information returns, such as the W-2. These information returns are provided by third parties such as employers, financial institutions, and others. In many cases, IRS does not receive the information returns until well after the tax return and refund are processed (bottom of figure 1). In these types of cases, the legitimate taxpayer may not be aware of a stolen identity until after receiving a notice indicating that the income (or payment information) IRS has on file does not match the information reported on the tax return. We previously found that these post-refund compliance checks can take a year or more to complete, which can be a burden to taxpayers who receive a notice. IRS officials acknowledge that the longer the delay between filing a tax return and receiving an IRS notice, the harder it can be for taxpayers to locate tax records or other information necessary to respond to IRS.

Fraud Filters. IRS also uses IDT and other fraud filters to detect IDT refund fraud. These filters are computerized automatic checks that screen returns using characteristics that IRS has identified in previous IDT refund fraud schemes. The filters also search for clusters of returns with similar characteristics, such as the same bank account or address, which could indicate potential fraud. Two of the tax-administration systems employing filters are the Dependent Database (DDb) and Electronic Fraud Detection System (EFDS). (RRP) to replace EFDS. In April 2014, IRS began a pilot of one of RRP’s planned fraud detection capabilities focused on detecting IDT refund fraud (e.g., RRP’s IDT model).RRP’s IDT model on all returns in filing season 2015. Returns flagged by the RRP IDT model will go through the same process as returns flagged by other filters (as previously described).

DDb incorporates IRS, Department of Health & Human Services, and Social Security Administration data to identify compliance issues involving IDT, refundable credits, and prisoners. EFDS is a system built in the mid-1990s to detect taxpayer fraud.

IRS’s Efforts to Identify and Monitor the Extent of IDT Refund Fraud

According to IRS officials, a vital component in the agency’s strategy to identify IDT refund fraud is its Identity Theft Taxonomy (Taxonomy). This research-based effort has several objectives, including (1) providing information to internal and external stakeholders about the effectiveness of IRS’s IDT defenses, (2) helping IRS identify IDT trends and evolving risks, and (3) refining IDT filters to better detect potentially fraudulent returns while reducing the likelihood of flagging legitimate tax returns.

Taxonomy Methodology. Consisting of a matrix of IDT refund fraud categories (see figure 2), IRS’s Taxonomy estimates the number of identified IDT refund fraud cases where IRS (1) prevented or recovered the fraudulent refunds (turquoise band), and (2) paid the fraudulent refunds (purple band). IRS breaks these estimates into six categories associated with IDT detection strategies. These strategies occur at three key points in the life cycle of a tax refund: before accepting a tax return, during return processing, and post refund.

Taxonomy Categories. Estimates in categories 1-3 are based on IRS’s Refund Fraud & Identity Theft Global Report (Global Report), which consolidates IRS administrative records of known IDT refund fraud. Category 4 estimates are based on duplicate returns, where IRS has received both a fraudulent IDT return and a legitimate return. Category 5 estimates are based on cases identified as part of a criminal investigation or as part of the AUR program. To estimate the AUR portion of category 5, IRS developed assumptions based on its analysis of the characteristics of past IDT refund fraud; IRS then used these assumptions to identify which information return mismatches were likely IDT returns.represents undetected IDT returns.

Current Taxonomy Estimates. Based upon its Taxonomy, IRS estimated that $30 billion in IDT refund fraud was attempted in filing season 2013 (see figure 3). Of this attempted amount of IDT refund fraud, IRS estimated that it prevented or recovered $24.2 billion (81 percent) of the estimated total. IRS also estimated it paid $5.8 billion (19 percent) in IDT refunds on 1 million IDT returns during the same time frame. Taxonomy estimates do not include the amount of IDT refund fraud from schemes IRS cannot detect (e.g., schemes that involve reported income that IRS cannot confirm during information return matching).

Administration Prioritizes Identity Theft and Authentication Efforts

In October 2014, the administration announced a plan to combat identity theft and further strengthen the security of personal identifying information The plan is intended to ensure that all maintained by the government.agencies making personal data accessible to citizens online will require the use of multiple authentication steps and will have an effective identity proofing process. National Security Council staff, the Office of Science and Technology Policy, and the Office of Management and Budget (OMB) are tasked with developing this plan by January 2015, and relevant agencies shall complete any required implementation steps set forth in this plan by April 2016. Therefore, while this plan may aid IRS in its efforts to prevent identity theft, any implementation of the plan at the agency level is still a few years away.

Taxonomy Met Several Best Practices for Cost Estimating, but It Could Better Explain Assumptions and Reflect Inherent Uncertainty

Taxonomy Documented Data and Methodology

By providing insight into how IDT refund fraud is evading IRS defenses, estimates inform IRS decision making about how to improve fraud filters and other detection efforts. Objective estimates may also inform congressional decision making about IRS resources. To ensure that IRS information reporting is objective, the agency developed information quality guidelines. Objectivity involves ensuring that information is reliable, accurate, and unbiased, as defined in OMB information quality guidelines.appropriate, supporting data should include full, accurate, transparent documentation, and should disclose error sources affecting data quality.

Further, OMB quality guidelines state that, where We evaluated Taxonomy estimates against selected GAO Cost Estimating and Assessment Guide (GAO Cost Guide) best practices that (1) are related to OMB’s definition of objectivity, and (2) are applicable to the Taxonomy. These best practices are intended to ensure the reliability of estimates—a key component of OMB’s definition of objectivity. While IRS is not required to follow the GAO Cost Guide best practices, following such practices could help the agency meet OMB and IRS information quality guidelines and could improve the reliability of IDT refund fraud estimates. We assessed the extent to which IRS provided evidence that the Taxonomy met each best practice and assigned ratings based on a five-point scale (Met, Substantially met, Partially met, Minimally met, or Not met). See appendix I for details on how we conducted our assessment.

As shown in table 1, the Taxonomy met several GAO Cost Guide best practices. IRS documented the Taxonomy’s source data, identified the methodology used to develop the estimate, and described how the estimate was developed. With regard to the calculation of Taxonomy estimates, our data reliability testing did not find calculation errors or other mistakes.

Methodology Changes Increased Fraud Estimates by $1 Billion, and Officials are Developing a Process to Document Management Review

After initial development of the Taxonomy in 2013, IRS made methodology improvements that resulted in more comprehensive Taxonomy estimates. For example, the agency included categories of duplicate IDT returns that had not been in filing season 2012 estimates. IRS made these methodology changes to enable comparison across filing seasons in future years, and to respond to our data reliability questions, according to officials. As a result, 2013 filing season estimates of “IDT refunds paid” increased by about $1 billion from an original estimate of $4.8 billion to a revised estimate of $5.8 billion (see table 2 for details).

IRS officials have considered using surveys to develop a more comprehensive estimate of unidentified IDT refund fraud, but have not been able to develop a survey method that would avoid significant taxpayer burden and administrative costs. Accordingly, while IRS has made several methodology changes and refinements to improve Taxonomy estimates, it is unlikely that IRS will be able to develop a completely comprehensive estimate, given potential administrative costs and other constraints.

While Taxonomy documentation does not provide evidence of managerial review, IRS officials stated that the former IRS Acting Commissioner reviewed and approved the Taxonomy. Officials told us they are working on a new process to document management review and approval.

Taxonomy Notes Relevant Cost Assumptions Used, but Does Not Provide the Rationale or Analysis Supporting the Assumptions

Developing loss estimates of illicit activities is challenging because such activities are difficult to observe. For this reason, IRS makes various assumptions, including whether an information return mismatch is an IDT return.

Taxonomy documentation thoroughly details IRS’s assumptions. For example, the Taxonomy describes the assumptions used to develop its “refund paid” estimates in category 5, which are based on AUR data (see figure 2). This part of the Taxonomy accounts for $3.0 billion of the estimated $5.8 billion in IDT refunds paid by IRS. However, the Taxonomy documentation for the AUR category does not provide information on the analysis or rationale used to develop the assumptions of past IDT refund fraud characteristics (see appendix III for examples showing how IRS assumptions affect Taxonomy results).

Given the evolving nature of IDT refund fraud, documenting Taxonomy assumptions and the rationale used to develop the assumptions would help IRS management and policymakers to determine whether the assumptions remain valid or need to be revised or updated. IRS officials acknowledged they could have better documented their analysis and rationale for choosing assumptions. They stated that IRS did not document its rationale for selecting assumptions because of the time and resources required.

Taxonomy assumptions also result in overestimates in some categories and underestimates in others. For example, while IRS’s estimate for refunds prevented includes e-file rejects that occurred due to an incorrect or missing Identity Protection Personal Identification Number (IP PIN) (see figure 2), legitimate taxpayers may also have their return rejected if they include an incorrect IP PIN, or forget to include an IP PIN on their tax return. In addition, the same return—regardless of whether the return is filed by a legitimate taxpayer or an identity thief—can be rejected multiple times, which would result in an over-count of IDT refunds prevented. Officials said they do not collect data that would allow them to break out the amount of e-file rejects due to IDT refund fraud. According to IRS officials, the costs of collecting these data may outweigh the benefits, as it would require major changes to IRS information technology systems.

Point Estimates Do Not Reflect the Taxonomy’s Inherent Uncertainty

To gain a better understanding of the effects that changing assumptions had on its estimates, IRS conducted a sensitivity analysis for category 5 “IDT refunds paid” estimates (which are based on AUR data from filing season 2013). That analysis shows that making different assumptions could affect the estimate of category 5 IDT refunds paid by billions of dollars in either direction (see appendix III, example 1). However, IRS does not report a range or some other indication of the results of the sensitivity analysis when reporting the $5.8 billion estimate for IDT refund fraud detected after refunds were issued. IRS officials stated that their goal in developing the Taxonomy was to achieve a level of precision that would allow them to assess the effectiveness of IRS IDT defenses.

Nor did IRS conduct sensitivity analyses for the other Taxonomy categories that include assumptions. Our analysis, shown in example 2 in appendix III, demonstrates that changes in these assumptions could affect estimates by billions of dollars. Also, IRS did not conduct a risk and uncertainty analysis showing the cumulative effect that assumptions have on the fraud estimate.with the Taxonomy estimates is unclear and users of the estimates may be left with a mistaken impression of their precision.

As a result, the level of uncertainty associated IRS officials stated that they did not conduct such analyses because of resource constraints and methodological challenges. Specifically, IRS officials stated that it would be methodologically difficult—if not impossible—to calculate uncertainty surrounding category 5 estimates that are based on AUR data. However, officials acknowledged that these analyses are possible for other categories in the Taxonomy, such as categories that use average refund value assumptions, or assumptions about the percent of returns detected by IRS defenses that are IDT.

We recognize that conducting an uncertainty analysis will be challenging and add some costs; however, better reporting of what is already known from sensitivity analyses would not be costly. Reporting the uncertainty that is known already, and conducting further sensitivity analyses when not cost prohibitive, might help IRS communicate the complexities inherent in combating the evolving threat of IDT refund fraud. Reporting uncertainty, quantitatively if possible and otherwise qualitatively, could also give decision makers in Congress and IRS a more accurate understanding of what is known and not known about the extent of the IDT refund fraud problem. A point estimate, compared to a range or some other indication of uncertainty, could provide a false sense of precision leading to different decisions about how to allocate resources to combat IDT refund fraud.

Given methodological and resource constraints, there are various ways IRS could report the uncertainty in the IDT refund fraud estimates. One way would be to present a point estimate surrounded by quantitative estimates of the possible range. Another way would be to qualitatively describe the relative size of the uncertainty and the reasons for this uncertainty. For example, IRS could describe how changes in assumptions affect the Taxonomy’s minimum, point, and maximum estimates.

IRS Is Beginning to Implement One New Pre-Refund Tool and Is Exploring Enhanced Taxpayer Authentication, but Lacks Information on Costs, Benefits and Risks

While it is likely that no one tool will stop all attempts at fraud, we have found that implementing strong preventive controls can help defend against invalid refunds, increasing public confidence and avoiding the difficult “pay and chase” aspects of recovering invalid refunds. Recapturing a fraudulent refund after it is issued can be challenging—if not impossible—because identity thieves often spend or transfer the funds immediately, making them very difficult to trace. For this reason, IRS is in various stages of exploring several possible pre-refund tools. Three tools with significant potential are (1) pre-refund Form W-2, Wage and Tax Statement (W-2) matching (which we already noted was the subject of our August 2014 report), (2) device identification, and (3) improved taxpayer authentication.

IRS is Working with Tax Software Companies to Implement Device Identification

Based on suggestions from the tax software industry and internal stakeholders, IRS is beginning to implement device identification that would capture the unique number associated with the individual device, such as a laptop computer, used to e-file a return. IRS could use this information to determine when multiple fraudulent returns are filed from the same device.

In November 2014, IRS published guidance for e-file providers that outlined IRS’s plans to collect device identification numbers along with tax returns for filing season 2015. IRS officials told us they will collect device identification numbers voluntarily for this first year. Beginning in filing season 2016, IRS plans to require these companies to submit a device identification number with each e-filed tax return.

From a cost-benefit perspective, IRS’s implementation of device identification appears justified. One important benefit of device identification is that it will enhance IRS’s ability to monitor when multiple returns are filed from the same device or from devices previously associated with fraud. In addition, device identification analysis could aid in criminal investigations, according to officials from one software industry group we interviewed.

Device identification will impose minimal, if any, costs on taxpayers, third parties, or IRS. It will not require additional taxpayer action, according to IRS. In addition, IRS and tax software companies told us that while tax software companies already capture device identification numbers when a taxpayer is preparing a return, that information is not currently transmitted to IRS. In contrast to some other options IRS is considering, such as earlier W-2 matching, IRS can use current information technology systems and processes to implement the device identification tool. For example, the device identification number will be transmitted to IRS via existing return transmission processes for e-filed returns. IRS could also use its existing filters as a low-cost method of determining patterns of device usage.

IRS is Pursuing Improved Taxpayer Authentication to Prevent IDT Refund Fraud; However, the Agency Does Not Have a Plan to Assess Costs, Benefits and Risks

IRS’s Current Authentication Tools Have Limitations

IRS has developed various personal identification numbers (PIN) to authenticate taxpayers’ identities and help verify the legitimacy of tax returns (see text box). Typically, these PINs are used by taxpayers to sign e-filed tax returns. IRS programs its systems to not accept a tax return if a required PIN is missing or does not match agency records. However, according to our analysis of IRS information and interviews with experts from tax software companies and associations, IRS’s current authentication tools (such as the e-file PIN) have limitations.

PINs and the Identity Authentication They Require Self-select PIN – Most taxpayers are eligible to use the Self-Select PIN. The Self- Select PIN requires taxpayers to provide their prior year’s adjusted gross income (AGI) amount or prior year’s self created PIN to authenticate the taxpayer’s identity. E-file PIN – If taxpayers do not have a self-select PIN or their prior year’s AGI, they can obtain an e-file PIN. The e-file PIN requires taxpayers to authenticate their name, SSN, date of birth, address, and filing status. IP PIN – IRS provides IP PINs to past IDT victims who have confirmed their identities with IRS, or to taxpayers who participated in a pilot program. In filing season 2014, IRS offered this pilot to taxpayers in Florida, Georgia, and the District of Columbia.

Identity thieves may be able to falsely obtain e-file PINs. Identity thieves can easily find the information needed to obtain an e-file PIN, allowing them to bypass some, if not all of IRS’s current automatic checks, according to our analysis and interviews with tax software and return preparer associations and companies.identity thieves can find identifying information through public records or other easily accessible sources.

Only a small number of taxpayers undergo knowledge-based authentication or receive IP PINs. Knowledge-based authentication—a more intensive authentication process—uses questions about personal information that only the taxpayer should know to confirm taxpayers’ identities. Examples of authentication questions are “Who is your mortgage lender?” or “Which of the following is your previous address?” IRS uses authentication questions to confirm the identities of taxpayers whose returns are flagged by IRS’s IDT and other fraud filters. Only a limited number of returns—about 1 percent—are currently subject to this more intensive authentication process. IRS also uses authentication questions to confirm the identities of taxpayers who request an IP PIN. Because IRS did not advertise the IP PIN pilot, the participation rate for the pilot was low. According to IRS officials, as of July 31, 2014, IRS had received about 21,000 requests out of about 13.9 million eligible taxpayers (or about 0.15 percent of eligible taxpayers), in 2014. IDT thieves can also obtain and use credit bureau information to answer the authentication questions, according to IRS officials.

IRS Has Options for Improving Its Authentication Tools

IRS officials and several third parties, including software providers and paid preparers, suggested IRS could enhance its taxpayer authentication approach by expanding some current tools and by exploring additional options. According to our review of IRS and third-party information, each of these options has strengths and weaknesses. Unlike the device identification tool, these options could require substantial changes to tax administration and may burden taxpayers by requiring individuals to track additional information or to take additional steps when filing a tax return. Similar to pre-refund W-2 matching, improved authentication tools could provide substantial benefits but require major investments in IRS systems and changes to work processes. One advantage of authentication is that it could be applicable to more tax returns than pre-refund W-2 matching, since W-2 matching only works for tax returns reporting wage income. Authentication options include:

Expanding the use of current authentication questions to a wider set of taxpayers. IRS could use authentication questions for the entire individual taxpayer population or in conjunction with other tools. IRS is continually analyzing the effectiveness of its authentication questions, which may be a benefit if the program was expanded. However, IRS analysis of single filers whose returns were flagged by fraud filters and who answered authentication questions has shown limitations: some likely identity thieves were able to correctly answer authentication questions while some legitimate taxpayers were not.

Expanding the availability of the IP PIN pilot to additional taxpayers. Currently, IP PIN distribution is limited to individuals who are IDT refund fraud victims or who participated in the IP PIN pilot. However, IRS is considering an expansion of the IP PIN to include more taxpayers. In responding to an open-ended question, 3 of the 18 associations we interviewed also suggested expanding the IP PIN pilot to all taxpayers as an optional effort.additional layer of security for taxpayers, according to IRS. However, the effectiveness of the IP PIN relies on the strength of authentication questions, which have the limitations described above. In addition, because taxpayers only use the IP PIN once a year when filing their returns, retrieving lost IP PINs creates additional burden for taxpayers and IRS.

A third-party issued credential would be aligned with standards established by the National Strategy for Trusted Identities in Cyberspace (NSTIC), a White House initiative to develop an online environment where organizations follow agreed upon standards to obtain and authenticate their digital identities. returns would be processed. According to one analytics company we interviewed, because this option could be an automated, computerized match that would not require any action from taxpayers, it would limit burden on low-risk taxpayers because they would not be subject to additional authentication checks. Although the analytics company official stated that this authentication option has been used by some states, he also acknowledged that there are no data available about its effectiveness in combating IDT refund fraud at the state level.

IRS Is Creating an Authentication Group to Examine Options, but Lacks a Plan For Identifying and Assessing Tools

According to IRS officials, the agency is in the initial stages of creating an authentication group aimed at centralizing several prior ad hoc efforts to authenticate taxpayers across IRS services (e.g., online, telephone calls, walk-in services). While the group was not specifically designed in response to IDT refund fraud, improving authentication across IRS would likely advance IRS’s ability to combat such fraud. IRS officials anticipate the group will consider options for improving authentication and will make recommendations to senior IRS executives. As of October 2014, the group was operating as a task team, with staff detailed from other IRS units. In its draft planning documentation, the authentication group outlined several initial high-level goals. Generally, they include:

Centralize protection of IRS and taxpayers through integrated identity

Centralize decisions and a strategic approach for authentication;

Provide an avenue for tax administration through identity

Provide an operational foundation for authentication;

Provide a consistent operational approach to implementing authentication processes, including updating relevant Internal Revenue Manual sections; Improve the security of IRS interactions and transactions with internal and external stakeholders; and

Coordinate the testing of authentication techniques (e.g., in-person or remote authentication through the Post Office or other venues).

The group has also documented short- and long-term priorities, including implementation plans. In recent discussions, agency officials said they would coordinate analysis of costs, benefits and risks with several IRS offices. However, a commitment to cost, benefit and risk analysis is not documented in the group’s short- and long-term priorities. The draft planning documentation that we were given by IRS makes no mention of where such analyses would be included in IRS’s priorities.

Federal guidance directs agencies to assess the costs, benefits and risks of government systems. OMB provides guidance to agencies for conducting economic cost-benefit and cost-effectiveness assessments that promote efficient resource allocation through well-informed decision making. Specifically, these assessments should consider different alternatives to meet program objectives along with a discussion of costs and benefits. Further, OMB and NIST provide guidance for agencies to review new and existing electronic transactions to ensure that authentication processes provide the appropriate level of assurance.Agencies can determine the appropriate level of assurance by conducting an assessment, mapping identified risks to the applicable assurance level, and selecting technology based on e-authentication technical guidance, among other steps. While we recognize that developing quantitative cost, benefit and risk estimates can be challenging or may not always be possible, qualitative analysis can also be informative, as discussed by OMB guidance.

Without analysis of costs, benefits and risks, IRS and Congress will not have quantitative information that could inform decisions about whether and how much to invest in the various authentication options. These decisions could include which authentication options to pursue (e.g., expanding the IP PIN or issuing a credential), where in the tax filing process authentication would be required (e.g., at the time of filing or after a return is flagged by IDT filters), and what level of assurance would be required (as detailed in OMB and NIST guidance). Cost, benefit and risk estimates for authentication would have the additional benefit of allowing comparisons with other options for combating IDT refund fraud, such as pre-refund W-2 matching. Both approaches could have significant costs for taxpayers and IRS, so more information about the tradeoffs would help inform IRS and congressional decision making.

Conclusions

IDT refund fraud is a large, continually evolving threat that is costing taxpayers billions of dollars per year. Honest taxpayers who have had fraudulent tax returns filed in their name have the burden of proving to IRS who they are and waiting for delayed refunds. IRS has poured resources into trying to clean up the tax accounts of the honest victims and is playing a losing game of “pay and chase” with the thieves. A strategy that avoids these costs would be one to prevent fraudulent refunds from being issued in the first place. While IRS has a variety of preventive measures in place, the Taxonomy estimates show that additional preventative efforts could have significant benefits.

IRS’s Taxonomy estimates are one part of improving IRS’s prevention strategies. Because the Taxonomy helps IRS understand how and to what extent IDT refund fraud is evading IRS defenses, it can focus attention on where the risk is greatest and can help improve the design of IRS’s IDT filters. To reap the most benefit from the Taxonomy, decision makers—both IRS managers and Congress—need to understand how reliable the estimates are. Given the difficulties in estimating refund fraud, reporting only point estimates risks misleading decision makers about the extent and nature of IDT refund fraud. While a point estimate might lead to one decision, a range that reflects the uncertainty may lead decision makers to a different decision.

We previously recommended that IRS develop cost-benefit information on pre-refund W-2 matching, which IRS has committed to implementing. Another tool that IRS is beginning to implement is device identification, which has potential benefits at low costs. IRS has limited information about the costs, benefits and risks of a third option, taxpayer authentication. The lack of this information could hinder decision makers’ ability to select which option (or combination of options) is most cost beneficial.

Recommendations

To improve the reliability of Taxonomy estimates for future filing seasons, the Commissioner of Internal Revenue should follow relevant best practices outlined in the GAO Cost Guide by taking the following two actions:

Documenting the underlying analysis justifying cost-influencing

Reporting the inherent imprecision and uncertainty of the estimates.

For example, IRS could provide a range of values for its Taxonomy estimates.

To ensure relevant information is available to decision makers, we recommend that the Commissioner of Internal Revenue estimate and document the costs, benefits and risks of possible options for taxpayer authentication, in accordance with OMB and NIST guidance.

Agency Comments and Our Evaluation

We provided a draft of this product to the Commissioner of Internal Revenue for review and comment. In written comments, reproduced in appendix IV, IRS agreed with our recommendations. With regard to our first recommendation, IRS stated that it will follow best practices in the GAO Cost Guide for documenting the rationale supporting assumptions used in the Taxonomy estimates. IRS also stated that it will supplement its revenue lost estimates by reporting the inherent imprecision and uncertainty of estimates, subject to the availability of data and resources.

While we acknowledged IRS’s resource limitations in the report, we also stated that reporting a point estimate without a range or some other indication of uncertainty could provide a false sense of precision about refunds prevented and paid. This false sense of precision could affect decisions about how to allocate resources to combat IDT refund fraud. Given the importance of these estimates, providing the proper context is also important. With regard to our second recommendation, IRS stated that its authentication group will develop a repeatable process to estimate and document the costs, benefits and risks of possible options for taxpayer authentication, in accordance with OMB and NIST guidance. However, the scope and analysis may be limited due to available resources and time. IRS also provided technical comments on figure 1, which we revised to acknowledge that the examples provided are for IDT refund fraud cases detected after refund issuance.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Commissioner of Internal Revenue. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9110 or whitej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report assesses (1) the quality of the Internal Revenue Service (IRS) Identity Theft Taxonomy’s (Taxonomy) estimates of the cost of identity theft (IDT) refund fraud, and (2) IRS’s progress in developing processes to track device identification numbers and to enhance taxpayer authentication. The report discusses IDT refund fraud and not employment fraud.

To assess the quality of the Taxonomy’s estimates of IDT refund fraud, we reviewed the Taxonomy’s methodology and estimates for filing season 2013 and evaluated them against selected best practices in the GAO Cost Estimating and Assessment Guide (GAO Cost Guide) that were applicable to the Taxonomy and consistent with IRS and Office of Management and Budget (OMB) information quality guidelines (see text box).Taxonomy is an estimate of the amount of revenue lost to IDT refund fraud—a cost to taxpayers. To develop this guide, our cost experts assessed the measures consistently applied by cost-estimating organizations throughout the federal government and industry; based upon this assessment, cost experts then considered best practices for the development of reliable cost estimates.

Selected Best Practices in Cost Estimating Objective, reliable cost estimates Include all relevant costs.

Document all cost-influencing ground rules and assumptions.

Capture the source data used.

Describe in sufficient detail the calculations performed and the estimating methodology used to derive each element’s cost.

Describe step by step how the estimate was developed so that a cost analyst unfamiliar with the program can understand what was done and replicate it. Provide evidence that the cost estimate was reviewed and accepted by management. Are regularly updated to reflect significant changes in the methodology.

Contain few mistakes.

Include a sensitivity analysis. Include a risk and uncertainty analysis. Are not overly conservative or optimistic, but are based on an assessment of most likely costs.

During our assessment of the Taxonomy, we interviewed IRS officials to better understand IRS’s methodology. We also discussed the GAO Cost Guide’s best practices with IRS officials who generally agreed with their applicability to the Taxonomy. IRS officials said many of the best practices are relevant to the Taxonomy, but questioned the applicability of best practices related to sensitivity and uncertainty analyses. They also questioned whether the Taxonomy itself was a cost estimate. We consulted with our cost estimating experts and concluded that the Taxonomy is a cost estimate because it is IRS’s estimate of the amount of revenue lost due to IDT refund fraud. Further, given the importance of the Taxonomy and the fact that changes in the assumptions IRS makes and includes in the estimates substantially affect results, we believe providing information about the uncertainty of the Taxonomy estimates is warranted (as discussed in more detail in the report).

To analyze IRS’s Taxonomy against the best practices, we reviewed Taxonomy documentation, conducted manual data testing for obvious errors, compared underlying data to IRS’s Refund Fraud & Identity Theft Global Report, and conducted numerous interviews with IRS officials to understand the methodology the IRS used to create estimates. We also confirmed Taxonomy components where we had data available to cross check. We developed an overall assessment rating for each best practice using the following definitions:

Not met. IRS provided no evidence that satisfies any portion of the best practice.

Minimally met. IRS provided evidence that satisfies a small portion of the best practice.

Partially met. IRS provided evidence that satisfies about half of the best practice.

Substantially met. IRS provided evidence that satisfies a large portion of the best practice.

Met. IRS provided complete evidence that satisfies the entire best practice.

To assess IRS’s progress in developing processes to track device identification numbers and to enhance taxpayer authentication, we reviewed Internal Revenue Manual sections detailing IRS’s Identity Protection Program and IRS documentation for several tools developed to combat IDT refund fraud. We also interviewed IRS officials to learn about these efforts. These included the Identity Protection Personal Identification Number, device identification, authentication group, and other efforts related to identity authentication. We compared IRS’s authentication group’s planning document to OMB’s guidance on cost- benefit analyses, as well as OMB and the National Institute for Standards and Technology (NIST) guidance on assessing levels of assurance for taxpayer authentication. We interviewed NIST officials to better understand the methodology used in their cost-benefit analysis of a credential-based taxpayer authentication system and to gather input on the advantages and disadvantages of this type of system.

To learn about additional actions IRS could take to prevent IDT refund fraud, we interviewed associations representing software companies, return preparers, and financial institutions. To help ensure our analysis covered a variety of viewpoints, we selected a nonprobability sample of 18 associations and stakeholders with differing positions and characteristics, based on IRS documentation and suggestions, our prior work, and other information. For example, to select associations representing financial institutions, we considered (among other factors) the size and type of institutions they represented (e.g., large or small banks, credit unions, and prepaid debit card companies). Because we used a nonprobability sample, the views of these associations are not generalizable to all potential third parties.

When possible, we used a standard set of questions in interviewing these associations and summarized the results of the semistructured interviews. However, as needed, we also sought perspectives on additional questions tailored to these associations’ expertise and sought their opinions on key issues. To determine the feasibility of various options and the challenges of pursuing them, we then communicated with IRS offices including (1) Privacy, Government Liaison, and Disclosure; (2) Customer Accounts Services, and (3) Return Integrity and Correspondence Services.

We conducted this performance audit from August 2013 to January 2015 in accordance with generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Summary of Tools to Combat Identity Theft Refund Fraud

The Internal Revenue Service (IRS) has developed multiple tools to combat identity theft (IDT) refund fraud. IDT detection occurs at three stages of the refund process: (1) before the IRS accepts tax returns, (2) during IRS’s tax return processing, and (3) after IRS issues tax refunds to taxpayers (or fraudsters). IRS uses some of these tools currently, while others are under development or were recommended by one of our prior reports. Table 4 describes each tool and its status.

Appendix III: How Assumptions Affect Identity Theft Taxonomy (Taxonomy) Results – Two Examples

The Internal Revenue Service (IRS) developed the Taxonomy for a number of reasons, including the need to monitor both the volume and cost of identity theft (IDT) refund fraud attempts and the effectiveness of IDT defenses over time. Taxonomy estimates are based on IRS’s administrative records of known IDT refund fraud (e.g., data on the number of duplicate returns). The Taxonomy also estimates IDT refunds by, for example, identifying returns with the characteristics of IDT refund fraud, as detected by the Automated Underreporter (AUR) program.

Best practices within the GAO Cost Estimating and Assessment Guide suggest that sensitivity and uncertainty analyses should be used to determine whether assumptions are potentially introducing error into an estimate. makes (and includes in its estimates of IDT refund fraud) substantially affect Taxonomy results.

Example 1: IRS’s Analysis Demonstrates that Assumptions Substantially Affect Taxonomy Estimates

A sensitivity analysis (also known as “what if” analysis) examines the effect changing assumptions has on the estimate by changing one assumption at a time. It involves recalculating the estimate using differing assumptions to develop ranges of potential estimates. Risk and uncertainty analysis recognizes the potential for error and captures the cumulative effect that assumptions have on the cost estimate. It involves using methods to develop a range of costs around a point estimate. See GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, GAO-09-3SP, (Washington, D.C.: March 2009). returns (the turquoise dots in figure 4) and which are IDT returns (the purple dots).

As further illustrated in figure 4, IRS chose assumptions that it believed best balanced comprehensiveness (that most IDT returns are likely included but legitimate returns are also included) with certainty (that many of the returns selected were IDT and include few, if any, legitimate returns). A completely comprehensive estimate (as illustrated by the larger circle) would be an overcount and could result in an IDT refund estimate about 26 times greater than IRS’s current estimate, according to our analysis of the Taxonomy. In contrast, a completely certain estimate (as illustrated in the smaller circle) would be an undercount and would result in an IDT refund estimate that is 25 times less than IRS’s current estimate. Using these two extremes would likely result in an “IDT refunds paid” estimate range that is too broad. Since IRS has not conducted an uncertainty analysis, we do not know the range that likely encompasses most cases of IDT.

Example 2: The Taxonomy Does Not Account for Variability in Refund Values

IRS uses an average refund value in certain Taxonomy categories, instead of using the actual value of each individual refund counted in the estimate. Therefore, it is likely that the total estimates of “IDT refunds paid” and “IDT refunds prevented” are imprecise. For example, figure 5 demonstrates how IRS developed its estimate of the value of refunds To prevented by rejecting electronically filed returns (e-file reject).develop its $6.2 billion estimate, IRS multiplied the number of e-file rejects (1.06 million) by the average refund associated with IDT returns caught by IRS IDT filters and other fraud defenses ($5,804).

However, the average refund value of e-file returns detected by IRS IDT defenses can vary—indicating uncertainty in this estimate. For example, if IRS used the different average refunds in table 5 to develop its e-file reject estimate, the total could range from $4.9 billion to $8.7 billion.

Appendix IV: Comments from the Internal Revenue Service

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

James R. White, (202) 512-9110 or whitej@gao.gov.

Staff Acknowledgments

In addition to the individual named above, Neil Pinney, Assistant Director; Shannon Finnegan, Analyst-in-Charge; Dawn Bidne; Amy Bowser; Deirdre Duffy; Michele Fejfar; Timothy Guinane; Katharine Perl; Jason Lee; Donna Miller; Dae Park; Ellen Rominger; and Robyn Trotter made key contributions to this report. Gary Bianchi, Nina Crocker, Mary Evans, Ellen Grady, David Lewis, Paul Middleton, Sabine Paul, Sara Pelton, Bradley Roach, LaSonya Roberts, Susan Sato, and Julie Spetz also provided assistance.

Related GAO Products

GAO. Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving Threat of Refund Fraud. GAO-14-633. Washington, D.C.: August 20, 2014.

GAO. Financial Audit: IRS’s Fiscal Years 2013 and 2012 Financial Statements. GAO-14-169. Washington, D.C.: December 12, 2013.

GAO. Internal Revenue Service: 2013 Tax Filing Season Performance to Date and Budget Data. GAO-13-541R. Washington, D.C.: April 15, 2013.

GAO. Identity Theft: Total Extent of Refund Fraud Using Stolen Identities is Unknown. GAO-13-132T. Washington, D.C.: November 29, 2012.

GAO. Financial Audit: IRS’s Fiscal Years 2012 and 2011 Financial Statements. GAO-13-120. Washington, D.C.: November 9, 2012.

GAO. Taxes and Identity Theft: Status of IRS Initiatives to Help Victimized Taxpayers. GAO-11-721T. Washington, D.C.: June 2, 2011.

GAO. Taxes and Identity Theft: Status of IRS Initiatives to Help Victimized Taxpayers. GAO-11-674T. Washington, D.C.: May 25, 2011.

GAO. Tax Administration: IRS Has Implemented Initiatives to Prevent, Detect, and Resolve Identity Theft-Related Problems, but Needs to Assess Their Effectiveness. GAO-09-882. Washington, D.C.: September 8, 2009.