Identity thieves can obtain a legitimate taxpayer’s name and Social Security number (SSN) in a variety of ways. They can obtain identity information by hacking into a computer system or paper files at one of the many entities that use names and SSNs in their records (e.g., employers, schools, or financial institutions). Thieves can trick the taxpayer into revealing such information, or they can steal it from the taxpayer. Armed with the stolen identity, the thief can then file a fraudulent tax return seeking a refund. The thief typically files a return claiming a refund early in the filing season, before the legitimate taxpayer files. If IRS determines the name and SSN on the tax return appear valid (IRS checks all returns to see if filers’ names and SSNs match before issuing refunds) and it passes through IRS’s other filters, IRS will issue the refund to the thief. IRS often becomes aware of a problem after the legitimate taxpayer files a return. At that time, IRS discovers that two returns have been filed using the same name and SSN, as shown in figure 1. The legitimate taxpayer’s refund is delayed while IRS spends time determining who is legitimate. As we have previously reported, IRS has taken multiple steps to detect, resolve, and prevent identity theft-based refund fraud. IRS developed new filtering processes in 2012 to detect identity theft based on the characteristics of incoming tax returns that do not rely on a duplicate filing or self-identification by filers. Identity theft indicators—also known as account flags—are a key tool used to resolve and detect identity theft. Identity theft indicators speed resolution by making a taxpayer’s identity theft problems visible to all IRS personnel with account access. In some cases, IRS uses its identity theft indicators to screen tax returns filed in the names of known identity theft victims. If a return fails the screening, it is subject to additional IRS manual review, including contacting employers to verify that the income reported on the tax return was legitimate. IRS uses the Identity Protection Personal Identification Number (IP PIN)—a single-use identification number sent to victims of identity theft that have validated their identities with IRS—to prevent refund fraud. When screening returns for possible identity theft, IRS excludes returns with an IP PIN, which helps avoid the possibility of a “false positive” and a delayed tax refund. If a taxpayer was issued an IP PIN and does not use it when filing electronically, IRS rejects the electronically filed return and prompts the taxpayer to file on paper. Taxpayers that do not use an IP PIN or enter an incorrect IP PIN filing on paper experience processing delays as IRS verifies the taxpayers’ identity. As of June 30th, IRS reported providing more than 251,500 IP PINs to taxpayers in 2012 and of those, 150,506 taxpayers filed using an IP PIN. Of filers that filed using an IP PIN, 8.6 percent (12,936) used an invalid IP PIN. IRS officials told us their review of a sample of these cases found that the majority of the invalid IP PINs were due to transposition or keying errors. Details on other IRS actions can be found in our previous reports. Other steps taken in 2012 include temporarily reallocating hundreds of staff from other business units to resolve duplicate filing cases and issue refunds to legitimate taxpayers. Officials in IRS’s accounts management function told us that in October 2012 there were more than 1,700 staff working to resolve identity theft cases. Also, in April 2012, IRS began the Law Enforcement Assistance Pilot Program in Florida to help state and local law enforcement agencies obtain tax return data vital to local identity theft investigations. The pilot allows taxpayers to give their permission for IRS to provide state and local law enforcement with the returns submitted using their SSN in certain cases. IRS expanded the pilot to eight additional states in October 2012. As of September 2012, 49 state and local agencies participated in the pilot. We did not independently assess IRS’s 2012 efforts. The full extent and nature of identity theft-based refund fraud is not known, but IRS data indicate that it is a large and growing problem. The data show that in the first 9 months of 2012, the number of known tax- related identity theft incidents has already more than doubled over 2011 (see table 1). Understanding the extent and nature of identity theft-related refund fraud is important to crafting a response to it. Program officials said that one of the challenges they face in combating this type of fraud is its changing nature. The officials said that when they discover and shut down one vulnerability, thieves often change tactics. The hidden nature of the crime means it is not reasonable to expect perfect knowledge about cases and who is committing the crime. However, the better IRS managers’ understanding of the problem, the better they can respond and the better Congress can oversee IRS’s efforts. IRS officials described several areas where the extent and nature of identity theft is unknown. Total number and cost of fraudulent returns. IRS does not know the full extent of the occurrence of identity theft. Officials said that they count the refund fraud cases that IRS identifies but that they do not estimate the number of identity theft cases that go undetected. IRS officials explained that “we don’t know what we don’t know,” because if a fraudulent return goes through IRS’s identity theft models and other programs, they are unable to tell if they failed to detect the fraudulent return. Officials explained that it is very difficult to detect a fraudulent return when an identity thief uses a correct SSN and has enough identifying information to make the return “look” like it came from the legitimate tax filer. The tax return appears to be legitimate as it has been filed with a name and SSN that match. Detecting identity theft can also be challenging because some legitimate filers mistakenly file duplicate returns. For example, IRS officials told us that in some cases, taxpayers intending to amend their return are confused and file a second Form 1040. In such a case, IRS has to investigate whether the duplicate filing is due to taxpayer confusion or identity theft. IRS captures data on the amount of money it recovers from all types of fraudulent returns, but it does not distinguish whether the type of fraud was identity theft or some other type of fraud. In some cases, external entities, such as banks or other agencies, may notify IRS of potential refund fraud, including suspected identity theft-based refund fraud. IRS reported it had received information from 116 banks and external leads on more than 193,000 accounts between January 1 and September 30, 2012, for all types of refund fraud. IRS reported that banks and other external entities returned almost $754 million dollars during this period. These cases are ones where fraudulent returns passed through IRS processes and refunds were issued. W&I officials told us they analyze data from such cases to identify characteristics of the fraudulent returns to improve their screening for identity theft and other types of refund fraud. The officials told us that the procedure for banks to notify IRS of suspected refund fraud is not new, but more financial institutions have now begun doing so. Identity of the thieves. Unless IRS pursues a criminal investigation, IRS generally does not know the real identity of the thieves. An investigation is necessary because the only identity information IRS has on the fraudulent tax return is that of the identity theft victim, not the thief. Officials responsible for processing returns said that they do not have the sort of information that would be needed to even begin such an investigation. CI has substantially increased efforts to criminally investigate identity theft cases in fiscal year 2012; however, as with other forms of fraud, CI focuses its investigative resources on the most serious cases. The number of identity theft investigations opened and time spent investigating identity theft cases have increased from fiscal year 2010 to fiscal year 2012, as shown in table 2. Although identity theft is one of CI’s investigative priorities, the number of investigations initiated is substantially less than the number of identity theft incidents confirmed by IRS in 2012. CI officials told us that while other IRS functions share leads with CI, not all of these leads meet CI’s criteria for developing a case for prosecution. CI officials told us they generally focus their investigative resources on the most egregious and significant identity theft cases, as measured by volume and refund amounts. Whether a fraudulent return is an individual attempt or part of a broader scheme. W&I and CI officials told us the two units work closely to utilize the information they obtain from identity theft cases. They use this information to improve their measures to identify new identity theft-based refund attempts and to identify especially significant or egregious cases to consider for possible criminal investigations. When either W&I’s analysis of identity theft cases or CI investigations lead to the identification of new schemes, that information is reported to the Return Integrity and Correspondence Services unit so it can strengthen its identity theft filters. Identifying new schemes or significant cases, such as one identity thief using numerous taxpayer identities, depends on analysts noticing patterns or other indications that a few cases may be part of a larger scheme. As a result, some schemes or cases involving multiple taxpayers may go undetected. Characteristics of known identity theft returns. IRS officials told us that the agency does not systematically track characteristics of known identity theft returns, including the type of return preparation (e.g. paid preparer or software), whether the return is filed electronically or on paper, or how the individual claimed a refund (e.g. check, direct deposit, or debit card). They added that the form in which a refund is claimed would be particularly hard to track using the current processes. Officials noted that they can identify the Internet protocol address of computers used to electronically file returns, which is helpful in detecting potential identity theft. While much remains unknown about identity theft, IRS has taken steps to collect program data on its identity theft detection and resolution efforts. IRS developed the internal Refund Fraud and Identity Theft Global Report (Global Report) in July 2012 to consolidate and track existing information about identity theft incidents from multiple sources within IRS. IRS officials said that the information in the report is not new, but that they saw the need for consistency in identity theft-related information drawn from several data sources. The report is used to provide information to IRS senior management and the Identity Theft Advisory Councilidentity theft metrics and to provide a standard source of information for responding to data requests from external entities, according to PGLD officials. Officials also stated that because the Global Report is new, they are working to improve its quality. In a selective review of the Global Report, we found that it had many of the attributes we have previously found to be useful for program monitoring. For example, the report covers key program activities and generally provides names, definitions, and data sources. However, we also found some areas where additional information or clarification of information currently in the report could make it more useful, as explained in table 3. The Global Report is a useful step towards providing IRS management and other entities with up-to-date, consistent information about identity theft-based refund fraud and IRS efforts to address it. However, it could be improved with the inclusion of additional information about data limitations, definitions, data sources, and the frequency of data updates in some areas. With such additional information, IRS management or other entities that use the report would have a clearer picture of not only what is known about identity theft-based refund fraud, but the strengths and limitations of the available information. The quality of the report will also be enhanced by the institution of process controls to help ensure consistency in how the data in the report are compiled, verified, and validated. Identity theft-related tax fraud is a terrible problem for the victims and a growing problem for tax administration. For this reason, legislators, government officials, and the public want to know about IRS efforts to address identity theft. The nature of identity theft-related tax fraud means that it will be very difficult, if not impossible, to develop a complete picture of the extent and nature of the problem, which in turn makes it difficult to assess IRS’s progress in combating it. While not a direct attack on the problem itself, IRS’s new Global Report could be a useful management tool. It is a recognition of the fact that IRS is devoting significant resources to the identity theft problem and that consolidated and more consistent program information could assist in management oversight and decision making. In reading the report, we identified some improvements that could help users better understand the information provided. To improve the identity theft information available to IRS management and Congress, we recommend that the Acting Commissioner of Internal Revenue update the Refund Fraud and Identity Theft Global Report to: provide definitions, data sources, and the frequency of data updates for data elements where such information is missing; document procedures used to compile and validate data; and describe limitations of the data presented. IRS officials provided oral comments in response to our draft findings, conclusions, and recommendations. The Director of PGLD stated that she agreed with our recommendations and plans on implementing our recommendations to improve the information provided in the Global Report. The Director of CI, Refund Crimes said that the discussion of CI’s investigation of identity theft could be interpreted to suggest that CI is expected to work every case of identity theft. We revised language in the report to emphasize that, like other forms of fraud, CI focuses its identity theft-related refund fraud investigations on the most serious cases. Chairman Platts, Ranking Member Towns, and Members of the Subcommittee, this completes my prepared statement. I would be happy to respond to any questions you may have at this time. For further information on this testimony, please contact James R. White at (202) 512-9110 or whitej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the individual named above, David Lewis, Assistant Director; Shannon Finnegan, Analyst-in-Charge; Michele Fejfar; Sarah McGrath; Donna Miller; Amy Radovich; and Sabrina Streagle made key contributions to this report. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Identity theft is a growing and evolving problem that imposes a financial and emotional toll on its victims. As of September 30, 2012, IRS had identified almost 642,000 incidents of identity theft that impacted tax administration in 2012 alone, a large increase over prior years. A taxpayer may have his or her tax refund delayed if an identity thief files a fraudulent tax return seeking a refund using a legitimate taxpayer's identity information. GAO was asked to describe identity theft issues at IRS and limits to what is known about the extent of identity theft. GAO updated its analysis on identity theft with current data on identity theft cases and interviewed IRS officials. GAO also reviewed past GAO reports to identify key attributes of successful performance measures and compare information provided by the Global Report Understanding the extent and nature of identity theft-related refund fraud is important to crafting a response to it, but Internal Revenue Service (IRS) managers recognize that they do not have a complete picture. Program officials said that one of the challenges they face in combating this type of fraud is its changing nature and how it is concealed. While perfect knowledge about cases and who is committing the crime will never be attained, the better IRS understands the problem, the better it can respond and the better Congress can oversee IRS's efforts. IRS officials described several areas where the extent and nature of identity theft is unknown. Total number and cost of fraudulent returns. IRS does not know the full extent of the occurrence of identity theft. Officials said that they count the refund fraud cases that IRS identifies but that they do not estimate the number of identity theft cases that go undetected. Identity of the thieves. Unless IRS pursues a criminal investigation, IRS generally does not know the real identity of the thieves. Whether a fraudulent return is an individual attempt or part of a broader scheme. Identifying new schemes or significant cases, such as one thief using numerous taxpayer identities, depends on analysts noticing patterns or other indications that a few cases may be part of a larger scheme. As a result, some schemes or cases involving multiple taxpayers may go undetected. Characteristics of known identity theft returns. IRS officials told us that the agency does not systematically track characteristics of known identity theft returns, including the type of return preparation (e.g., paid preparer or software), whether the return is filed electronically or on paper, or how the individual claimed a refund (e.g., check, direct deposit, or debit card). While much remains unknown about identity theft, IRS has taken steps to organize what it knows in a newly developed Refund Fraud and Identity Theft Global Report (Global Report). The Global Report consolidates and tracks information about identity theft incidents and IRS detection and resolution efforts from multiple sources within IRS. The report provides information to IRS senior management and a standard source of information for responding to data requests from external entities. GAO's selected review of the Global Report against key attributes of successful performance measures found that it had many of the attributes useful for program monitoring, but also had some areas where additional information or clarification would make the report more helpful. Updating the Global Report to provide information on definitions, data sources, and limitations such as the unknown number of undetected fraudulent returns, could help ensure users have a more complete picture of the data and its strengths and limitations. The quality of the report will also be enhanced by the institution of process controls to help ensure consistency in how the data in the report are compiled, verified and validated. To improve information available to IRS management and Congress, GAO recommends that IRS update the Global Report to provide definitions and data sources, where such information is missing; document procedures used to compile and validate the data; and describe limitations of the data presented. IRS officials agreed with our recommendations. Based on their comment, we revised language in the report to clarify that, like other forms of fraud, IRS conducts criminal investigations only in the most serious identity theft-related refund fraud cases.