Identity theft describes a wide range of types of theft and uses of stolen information. According to the FTC, the most common form of identity theft is the use of another person’s information to obtain credit and then acquire goods or services, not pay for them, and thus damage the credit rating of the identity theft victim. As already noted, identity theft most commonly becomes a tax administration problem for victims and IRS in two primary ways. First, an identity thief may use a legitimate taxpayer’s identity to fraudulently file a tax return and claim a refund during the filing season. In these cases, the identity thief typically uses a stolen SSN to file a forged tax return and obtain a refund early in the filing season. The legitimate owner of the SSN may not be aware that this has occurred until he or she files a tax return later in the filing season and IRS discovers that two returns have been filed using the same SSN. In this instance, the legitimate taxpayer’s refund will likely be frozen until IRS can determine the legitimate owner of the SSN. The second way that identity theft becomes a problem for taxpayers and for IRS is through employment fraud. This occurs when an identity thief uses someone else’s name and SSN to obtain a job. In this instance, IRS would receive a Form W-2 or a Form 1099 reporting income on the taxpayer’s account, which the rightful owner of the SSN had not earned and does not report as income to IRS. As a result, the taxpayer may be subject to enforcement action when, during the filing process, IRS matches what the employer and the taxpayer report and it appears that he or she earned more income than was reported on his or her tax return. In a related type of case, an identity thief uses just the SSN of a legitimate taxpayer and the thief’s own or a made up name. This also creates tax administration problems (as well as problems for the Social Security Administration) because the same SSN is now associated with multiple names. The name and SSN information used by identity thieves to commit refund or employment fraud are typically stolen from sources beyond the control of IRS. In many cases, the source of the stolen information is unknown. Someone who makes up an SSN that does not match a legitimate SSN and uses it to gain employment has failed to comply with legal requirements to supply a valid SSN but has not committed identity theft because no person’s identity was stolen. Identity theft can also involve IRS in other ways, such as when thieves masquerade as IRS in order to steal information over the Internet through phishing schemes—using e-mail or Web sites to impersonate IRS and ask for personal and financial information from unsuspecting victims. According to IRS, there are a variety of online schemes that victimize taxpayers. “Get Your Refund” phishing e-mails appear to be legitimate e- mails from IRS notifying a taxpayer that they are entitled to a refund and can claim it quickly by clicking on a fraudulent link within the e-mail and providing their personally identifiable information. Fraudulent free e-file Web sites claim to be legitimate free e-file Web sites. Once a taxpayer enters his or her tax information, the identity thief enters his or her own bank account number and then steals the refund along with the taxpayer’s personal information, such as the SSN. Other schemes include surveys and malware. Surveys are usually sent through e-mails, where the fraudulent party masquerades as IRS asking taxpayers to rate their experience with IRS. Malware is an executable file sent through an e-mail, which asks the recipient to save and run a file. Once the file runs, information is pulled from the victim’s computer and sent to the fraudulent party. Identity theft can also involve IRS when IRS loses taxpayer data in either electronic form, such as information stored on a lost laptop computer, or on paper, such as documents lost in transit when being sent from one IRS facility to another. However, lost taxpayer data will not result in identity theft unless the data were found by an identity thief who uses the data for personal gain. Figure 1 describes the ways that identity theft issues come to light for IRS and taxpayers. Federal and state legislatures have toughened laws that prohibit the theft of identities. In October 1998, Congress passed the Identity Theft and Assumption Deterrence Act, which expanded the criminalization of fraud in connection with identification documents to cover the unlawful transfer and use of identification documents. The law addresses identity theft by including instances when someone “knowingly transfers or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law.” According to the President’s Identity Theft Task Force, all 50 states and the District of Columbia have some form of legislation that prohibits identity theft, and in all of those jurisdictions, except Maine, identity theft can be prosecuted as a felony. In addition to congressional efforts to combat identity theft, there have been administrative efforts as well. The President’s Identity Theft Task Force was established in May 2006 by Executive Order 13402. The task force was created to coordinate federal agencies in their efforts against identity theft and to create a strategic plan to combat (increase awareness of, prevent, detect, and prosecute) identity theft. Victims of identity theft can file a complaint with the FTC. The FTC maintains an Identity Theft Data Clearinghouse, which is the sole national repository of consumer complaints on identity theft. In 2008, the FTC received 313,982 identity theft complaints, a large increase over the number reported in prior years, as shown in figure 2. Intending to strengthen IRS’s enterprisewide approach to identity theft and data security, IRS established PIPDS in July 2007. PIPDS includes four offices with roles defined by IRS as follows: Privacy. Promotes the protection of individual privacy and integrates privacy into business practices, behaviors, and technology solutions. Identity Protection. Identifies risks and reduces vulnerabilities of identity information, enhances services and reduces burden and harm to identity theft victims, and increases collaboration and communication with IRS stakeholders and external partners. Incident Management. Assesses and reduces IRS data loss incidents, promotes protection of personal identity information by IRS employees, and informs taxpayers of identity theft risks discovered by the IRS. Online Fraud Detection and Prevention. Reduces and prevents online fraud against IRS and taxpayers. PIPDS collaborates with IRS activities that deal with identity theft cases and issues. A technical working group was formed to provide a forum for developing recommendations on how processes and procedures can be improved to address and reduce the burden on taxpayers who are victims of identity theft. Additionally, IRS established two advisory committees to oversee Identity Theft and Incident Management and Online Fraud Detection and Prevention activities. The advisory committees include executive management from Small Business/Self-Employed (SB/SE), Wage and Investment (W&I), Criminal Investigation (CI), and the Taxpayer Advocate Service (TAS). IRS began systemically cataloging data on identity theft incidents in January 2008, but limitations on the data mean that the data provides an incomplete picture of the amount of identity theft-related fraud occurring at IRS. IRS catalogs identity theft incidents after identifying a possible case, validating that identity theft-related fraud occurred, and substantiating the identity of the victim taxpayer. Because of the timing of tax return filing, IRS is often unable to detect suspicious cases until well after the fraud occurred. Validating the identity theft and substantiating the victim’s identity takes further time. For example, IRS may not be able to detect potential employment fraud until after the following year’s tax filing deadline of April 15 when it matches Form W-2 information against filed tax returns. It is only after IRS notifies a taxpayer of unreported income that IRS may learn from the taxpayer that the income was not his or hers and that someone else must have been using his or her identity. By the time both the victim and IRS determine that an identity theft incident occurred, well over a year may have passed since the employment fraud. Time lags are not the only issue obscuring a complete picture of identity theft tax cases at IRS. Some cases go undetected altogether. One reason for this is that IRS does not investigate every case of potential employment fraud. Because of the large volume of mismatches between what is reported on a Form W-2 or a Form 1099 information return and what is reported on an income tax return, and also because of IRS’s limited resources, IRS does not pursue some mismatches. Consequently, IRS is not in a position to detect any underlying identity theft in those cases. Also, if an identity thief steals the identity of a person with no tax filing obligation, such as a child, and files returns and pays taxes using the name and SSN of that person, IRS may have no way of detecting the identity theft. From IRS’s point of view, a tax return has been filed with a name and SSN that match and the income on the tax return matches income reported by an employer. Table 1 shows the tax-related identity theft incidents that IRS cataloged as of December 31, 2008. Most of the incidents in the table are for identity thefts that occurred since 2005, but some incidents go back many years. The incidents shown in table 1 include open tax-related identity theft cases reported by various IRS activities. A case is considered open if the taxpayer continues to have identity theft-related issues. For all of the incidents shown in table 1, IRS validated that the identity theft-related fraud occurred and substantiated the identity of the victim taxpayer. The table demonstrates that IRS detects identity theft throughout the course of normal tax administration activities, including processing tax returns, examining returns to verify compliance, and collecting tax debt.