IRS has reported a substantial increase in IDT refund fraud; however, it is unclear whether this reported increase is due to an overall increase in IDT refund fraud, to an improvement in IRS’s ability to detect IDT refund fraud, or to a combination of the two. For example, IRS instituted IDT filters in 2012, which helped IRS find additional IDT incidents, but it is not known how much of the reported increase can be attributed to filters or to an increase in IDT refund fraud. There are two types of tax-related IDT fraud: (1) refund fraud and (2) employment fraud. IDT refund fraud occurs when a refund-seeking identity thief files a fraudulent tax return using the legitimate taxpayer’s identifying information. Employment fraud occurs when an identity thief uses a taxpayer’s name and Social Security number (SSN) to obtain a job. This report’s discussion focuses on IDT refund fraud and not employment fraud. IDT refund fraud takes advantage of the typical process of filing a tax return. Taxpayers receive information returns from third parties, such as the Form W-2, Wage and Tax Statement (W-2), and use this information to complete their tax returns. As shown in figure 1, taxpayers with wage income typically receive a Form W-2 from their employer by late January. Taxpayers copy the information from the W-2 to prepare their returns. Taxpayers filing paper returns are required to attach a copy of the W-2 to the return. Taxpayers filing electronically (e-file), as most do, are not required to send W-2s to the IRS. Most taxpayers entitled to a refund, along with many identity thieves attempting refund fraud, file early in the filing season—many in February. During return processing, IRS performs some compliance checks and issues refunds, but at this time it cannot verify the W-2 information for all returns (paper W-2s can be forged and fictitious wage information can be entered on a tax return). By the end of March, employers are also required to send a copy of the W-2 to SSA, which performs verification checks before sending the information to IRS. However, IRS only begins matching W-2 information from employers to tax returns in July. This gap between when IRS issues refunds and when IRS matches W-2s to tax returns creates the opportunity for fraudsters to file returns using a stolen identity and to receive a tax refund. Issuing refunds before fully verifying the information on tax returns is an example of what IRS officials refer to as a “look-back” compliance model: rather than holding refunds until all compliance checks can be completed, IRS issues refunds after doing some selected, automated reviews of the information the taxpayer submits to verify identity (e.g., name and SSN matching); filtering out returns with indicators of fraud such as a mismatched name and SSN; and correcting obvious errors, such as calculation mistakes and claims for credits and deductions exceeding statutory limits. IRS’s intent is to issue refunds quickly. After refunds are issued, IRS does further checks. Two of these checks enable IRS to detect significant amounts of IDT refund fraud after the fact. One, shown at the top of figure 2, is checking for duplicate returns. If an identity thief and a legitimate taxpayer file returns using the same name and SSN, IRS will have duplicate returns. The other is matching tax returns to third-party information provided to IRS by employers, financial institutions, and others (bottom of figure 2). Matching tax returns to W-2s is an example of these checks. As we have reported, these post-refund compliance checks can take a year or more to complete. Recognizing the limitations of the look-back compliance model, IRS’s efforts to combat IDT refund fraud occur at three different stages of the refund process: (1) before accepting a tax return, (2) during tax return processing, and (3) after issuing tax refunds. At each stage of the process, IRS uses specific tools to detect IDT refund fraud (see figure 3 for examples of IRS tools at each stage). Identity Protection Personal Identification Number (IP PIN). IP PINs are single-use identification numbers sent to IDT victims who have validated their identities with IRS. Tax returns with IP PINs pass through IRS’s IDT fraud filters, avoiding false positives—where a legitimate taxpayer is identified as an identity thief—and a delayed tax refund. Taxpayers who were issued an IP PIN but e-filed without using it or entered it incorrectly are prompted to enter the IP PIN on their tax return or to file on paper, according to IRS officials. Paper returns filed with the SSN of these taxpayers and without an IP PIN are subject to additional checks. (In January 2014, IRS offered a limited IP PIN pilot program to eligible taxpayers in Florida, Georgia, and the District of Columbia.) Duplicate return rejects. Once IRS receives an e-filed return for a given SSN, it automatically rejects subsequent returns filed using that SSN and sends a notice of duplicate filing, as shown at the top of figure 2. IDT and other fraud filters. IDT filters screen returns, using characteristics that IRS has identified in previous IDT refund fraud schemes. characteristics, such as the same bank account or address, which could indicate potential fraud. If an IDT filter flags a return, IRS stops processing the return and sends a letter asking the taxpayer to validate his or her identity. The filters also search for clusters of returns with similar IDT indicators. Indicators—account flags that are visible to all IRS personnel with account access—are a key tool IRS uses to resolve and detect IDT. IRS uses different indicators (e.g., to denote whether the incident was identified by the IRS or a taxpayer), depending on the circumstances in which IRS learns of an identity theft-related problem. Third-party leads. IRS receives third-party leads regarding suspected IDT refund fraud and other types of refund fraud through efforts including the External Leads Program and the Opt-In Program. The External Leads Program involves third parties providing lead information to IRS. If a questionable refund is confirmed as fraudulent, IRS requests that the financial institution return the refund. The Opt-In Program allows financial institutions to electronically reject suspicious refunds and return them to IRS, indicating why the institution is rejecting the refunds. Two of the tax-administration systems employing filters are the Dependent Database (DDb) and Electronic Fraud Detection System (EFDS). DDb incorporates IRS, Health & Human Services, and Social Security Administration data to identify compliance issues involving IDT, refundable credits, and prisoners. EFDS is a legacy system built in the mid- 1990s. To replace EFDS, IRS is developing the Return Review Program. IRS has income and/or payment information that does not match the information reported by the taxpayer on his return. A key practice in results-oriented management of federal agencies is the establishment of agency-wide, long-term strategic goals. IRS’s strategic plan for fiscal years 2014-2017 identifies two strategic goals: (1) deliver high quality and timely service to reduce taxpayer burden and encourage voluntary compliance and (2) effectively enforce the law to ensure compliance with tax responsibilities and combat fraud. The strategic plan also outlines several objectives relevant to its efforts to combat identity theft, including strengthening refund fraud prevention by balancing the speed of refund delivery with the assurance of taxpayer identity, using analysis of third-party and historical taxpayer data, and educating taxpayers and tax professionals on fraud risk factors and fraud prevention methods; implementing enterprise-wide analytics and research capabilities to make timely, informed decisions; and implementing and maintaining a robust enterprise risk management program, which includes establishing routine reporting procedures to external stakeholders on operational risks. As a complement to the potential benefits of strategic planning, internal control is a major part of managing an organization.comprises the plans, methods, and procedures used to meet missions, goals, and objectives: this supports performance-based management. Internal control helps agency program managers achieve desired results and provides reasonable assurance that program objectives are being achieved through—among other things—effective and efficient use of agency resources. Managers are to design internal controls based on related costs and benefits. In addition, internal control standards in the federal government call for agencies to record and communicate relevant, reliable, and timely information on internal and external events to agency managers and others who need it. Based on IRS’s preliminary Identity Theft Taxonomy (Taxonomy), the agency estimated that $29.4 billion in IDT refund fraud was attempted in filing season 2013. IRS estimated it prevented or recovered about $24.2 billion (82 percent) of the estimated attempted refund fraud. However, IRS estimated it paid $5.2 billion (18 percent) in IDT refunds during the same timeframe (see figure 4). IRS officials noted that they are updating their analysis and anticipate revising the Taxonomy’s estimate of IDT refunds paid. The officials said the revised estimates could be somewhat higher (perhaps by $0.6 billion) but the analysis was not completed in time for us to include it in figure 4. IRS’s Taxonomy demonstrates a significant effort on the part of IRS and is an important first step in estimating how much identified IDT refund fraud IRS is stopping or failing to stop. IRS has made substantial progress in its efforts to estimate IDT refund fraud. For example, IRS developed an estimate of IDT refund fraud by identifying characteristics of fraudulent returns, matching and analyzing information returns and tax returns based on these characteristics, and researching other sources. However, the estimates will continue to evolve as IRS updates its methodology to better reflect new IDT refund fraud schemes and to improve the accuracy of its estimates, according to IRS officials.