Identity thieves can obtain a legitimate taxpayer’s name and Social Security number (SSN) in a variety of ways. They can obtain identity information by hacking into a computer system or paper files at one of the many entities that use names and SSNs in their records (e.g., employers, schools, or financial institutions). Thieves can trick the taxpayer into revealing such information, or they can steal it from the taxpayer. Armed with the stolen identity, the thief can then file a fraudulent tax return seeking a refund. The thief typically files a return claiming a refund early in the filing season, before the legitimate taxpayer files. If IRS determines the name and SSN on the tax return appear valid (IRS checks all returns to see if filers’ names and SSNs match before issuing refunds) and it passes through IRS’s other filters, IRS will issue the refund to the thief. IRS often becomes aware of a problem after the legitimate taxpayer files a return. At that time, IRS discovers that two returns have been filed using the same name and SSN, as shown in figure 1. The legitimate taxpayer’s refund is delayed while IRS spends time determining who is legitimate. As we have previously reported, IRS has taken multiple steps to detect, resolve, and prevent identity theft-based refund fraud. IRS developed new filtering processes in 2012 to detect identity theft based on the characteristics of incoming tax returns that do not rely on a duplicate filing or self-identification by filers. Identity theft indicators—also known as account flags—are a key tool used to resolve and detect identity theft. Identity theft indicators speed resolution by making a taxpayer’s identity theft problems visible to all IRS personnel with account access. In some cases, IRS uses its identity theft indicators to screen tax returns filed in the names of known identity theft victims. If a return fails the screening, it is subject to additional IRS manual review, including contacting employers to verify that the income reported on the tax return was legitimate. IRS uses the Identity Protection Personal Identification Number (IP PIN)—a single-use identification number sent to victims of identity theft that have validated their identities with IRS—to prevent refund fraud. When screening returns for possible identity theft, IRS excludes returns with an IP PIN, which helps avoid the possibility of a “false positive” and a delayed tax refund. If a taxpayer was issued an IP PIN and does not use it when filing electronically, IRS rejects the electronically filed return and prompts the taxpayer to file on paper. Taxpayers that do not use an IP PIN or enter an incorrect IP PIN filing on paper experience processing delays as IRS verifies the taxpayers’ identity. As of June 30th, IRS reported providing more than 251,500 IP PINs to taxpayers in 2012 and of those, 150,506 taxpayers filed using an IP PIN. Of filers that filed using an IP PIN, 8.6 percent (12,936) used an invalid IP PIN. IRS officials told us their review of a sample of these cases found that the majority of the invalid IP PINs were due to transposition or keying errors. Details on other IRS actions can be found in our previous reports. Other steps taken in 2012 include temporarily reallocating hundreds of staff from other business units to resolve duplicate filing cases and issue refunds to legitimate taxpayers. Officials in IRS’s accounts management function told us that in October 2012 there were more than 1,700 staff working to resolve identity theft cases. Also, in April 2012, IRS began the Law Enforcement Assistance Pilot Program in Florida to help state and local law enforcement agencies obtain tax return data vital to local identity theft investigations. The pilot allows taxpayers to give their permission for IRS to provide state and local law enforcement with the returns submitted using their SSN in certain cases. IRS expanded the pilot to eight additional states in October 2012. As of September 2012, 49 state and local agencies participated in the pilot. We did not independently assess IRS’s 2012 efforts. The full extent and nature of identity theft-based refund fraud is not known, but IRS data indicate that it is a large and growing problem. The data show that in the first 9 months of 2012, the number of known tax- related identity theft incidents has already more than doubled over 2011 (see table 1). Understanding the extent and nature of identity theft-related refund fraud is important to crafting a response to it. Program officials said that one of the challenges they face in combating this type of fraud is its changing nature. The officials said that when they discover and shut down one vulnerability, thieves often change tactics. The hidden nature of the crime means it is not reasonable to expect perfect knowledge about cases and who is committing the crime. However, the better IRS managers’ understanding of the problem, the better they can respond and the better Congress can oversee IRS’s efforts. IRS officials described several areas where the extent and nature of identity theft is unknown. Total number and cost of fraudulent returns. IRS does not know the full extent of the occurrence of identity theft. Officials said that they count the refund fraud cases that IRS identifies but that they do not estimate the number of identity theft cases that go undetected. IRS officials explained that “we don’t know what we don’t know,” because if a fraudulent return goes through IRS’s identity theft models and other programs, they are unable to tell if they failed to detect the fraudulent return. Officials explained that it is very difficult to detect a fraudulent return when an identity thief uses a correct SSN and has enough identifying information to make the return “look” like it came from the legitimate tax filer. The tax return appears to be legitimate as it has been filed with a name and SSN that match. Detecting identity theft can also be challenging because some legitimate filers mistakenly file duplicate returns. For example, IRS officials told us that in some cases, taxpayers intending to amend their return are confused and file a second Form 1040. In such a case, IRS has to investigate whether the duplicate filing is due to taxpayer confusion or identity theft. IRS captures data on the amount of money it recovers from all types of fraudulent returns, but it does not distinguish whether the type of fraud was identity theft or some other type of fraud. In some cases, external entities, such as banks or other agencies, may notify IRS of potential refund fraud, including suspected identity theft-based refund fraud. IRS reported it had received information from 116 banks and external leads on more than 193,000 accounts between January 1 and September 30, 2012, for all types of refund fraud. IRS reported that banks and other external entities returned almost $754 million dollars during this period. These cases are ones where fraudulent returns passed through IRS processes and refunds were issued. W&I officials told us they analyze data from such cases to identify characteristics of the fraudulent returns to improve their screening for identity theft and other types of refund fraud. The officials told us that the procedure for banks to notify IRS of suspected refund fraud is not new, but more financial institutions have now begun doing so. Identity of the thieves. Unless IRS pursues a criminal investigation, IRS generally does not know the real identity of the thieves. An investigation is necessary because the only identity information IRS has on the fraudulent tax return is that of the identity theft victim, not the thief. Officials responsible for processing returns said that they do not have the sort of information that would be needed to even begin such an investigation. CI has substantially increased efforts to criminally investigate identity theft cases in fiscal year 2012; however, as with other forms of fraud, CI focuses its investigative resources on the most serious cases. The number of identity theft investigations opened and time spent investigating identity theft cases have increased from fiscal year 2010 to fiscal year 2012, as shown in table 2. Although identity theft is one of CI’s investigative priorities, the number of investigations initiated is substantially less than the number of identity theft incidents confirmed by IRS in 2012. CI officials told us that while other IRS functions share leads with CI, not all of these leads meet CI’s criteria for developing a case for prosecution. CI officials told us they generally focus their investigative resources on the most egregious and significant identity theft cases, as measured by volume and refund amounts. Whether a fraudulent return is an individual attempt or part of a broader scheme. W&I and CI officials told us the two units work closely to utilize the information they obtain from identity theft cases. They use this information to improve their measures to identify new identity theft-based refund attempts and to identify especially significant or egregious cases to consider for possible criminal investigations. When either W&I’s analysis of identity theft cases or CI investigations lead to the identification of new schemes, that information is reported to the Return Integrity and Correspondence Services unit so it can strengthen its identity theft filters. Identifying new schemes or significant cases, such as one identity thief using numerous taxpayer identities, depends on analysts noticing patterns or other indications that a few cases may be part of a larger scheme. As a result, some schemes or cases involving multiple taxpayers may go undetected. Characteristics of known identity theft returns. IRS officials told us that the agency does not systematically track characteristics of known identity theft returns, including the type of return preparation (e.g. paid preparer or software), whether the return is filed electronically or on paper, or how the individual claimed a refund (e.g. check, direct deposit, or debit card). They added that the form in which a refund is claimed would be particularly hard to track using the current processes. Officials noted that they can identify the Internet protocol address of computers used to electronically file returns, which is helpful in detecting potential identity theft. While much remains unknown about identity theft, IRS has taken steps to collect program data on its identity theft detection and resolution efforts. IRS developed the internal Refund Fraud and Identity Theft Global Report (Global Report) in July 2012 to consolidate and track existing information about identity theft incidents from multiple sources within IRS.