To answer your immediate concern, no, neither IRS nor the SSA will report your friend to immigration service. Both agencies get billions of dollars every year as taxes from unauthorized workers, and they don't have the knowledge of who's authorized or who is making an honest mistake (people misstype their SSNs all the time). On top of it, many if not the majority of immigrants do not inform SSA when their immigration status changes to that of a permanent resident or citizen (or any other status that allows employment), so these agencies truly would not know much beyond whether someone spelled their name/SSN correctly.Now let's address your friend's status. First of all, misrepresentation on the I-9. Had she checked the 'US citizen' box, she would most likely be totally screwed (i.e. permanent inadmissibility to the US without the possibility of a waiver, even if she marries a US citizen), but if she claimed to be a permanent resident, it would be much harder for the USCIS to ban her just for that. However, it is much safer for someone working without authorization to work as a contractor, not an employee. W-9 does not require you to disclose your immigration status, and this way both the contractor and the employer are safe. I know people who have worked for years as contractors without authorization, and have been able to get permanent residence (but only through marriage to a citizen).Second, there is an important distinction in the immigration code that your friend needs to understand, which may save her behind, after all. While her employment is unauthorized and she is out of status, it does not necessarily mean she is illegally present - yet. And there is a world of difference between being out of status and being illegally present. Once she is illegally present for 180 days, the 3 year admissibility bar kicks in, and she will be unable to legalize her status (unless, again, it's a marriage to USC). The date she needs to look at comes either from her work visa approval or the stamp she got when she last entered the country, whichever happened later. If that date has not passed or passed less than 180 days ago, she can still get a new work visa, but she will have to leave the country and come back (most likely will have to go to the consulate). It is called date on I-94, and she should definitely talk to an immigration lawyer about it.Third, yes, she needs to file her taxes. Being employed unauthorized does not mean you don't have to file a return. In fact, the IRS treats unauthorized workers the same way it treats legal immigrants - in the eyes of IRS they are all 'resident aliens'. In fact, not filing a return may present problems later if she ever gets to apply for citizenship.P.S. If you thought the US immigration system is punitive, then you need to know that your friend is one the few lucky ones who get to come to the US legally, a privilege not offered to the vast majority of would be immigrants. In other words, others have it worse.