The number of tax-related identity theft incidents (primarily refund or employment fraud attempts) identified by IRS has grown: 51,702 incidents in 2008, 169,087 incidents in 2009, and 248,357 incidents in 2010. Refund fraud can stem from identity theft when an identity thief uses a legitimate taxpayer’s name and Social Security Number (SSN) to file a fraudulent tax return seeking a refund. In these cases, the identity thief typically files a return claiming a refund early in the filing season, before the legitimate taxpayer files. IRS will likely issue the refund to the identity thief after determining the name and SSN on the tax return appear valid (IRS checks all returns to see if filers’ names and SSNs match before issuing refunds). IRS often first becomes aware of a problem after the legitimate taxpayer files a return. At that time, IRS discovers that two returns have been filed using the same name and SSN, as shown in figure 1. The legitimate taxpayer’s refund is delayed while IRS spends time determining who is legitimate. Employment fraud occurs when an identity thief uses a taxpayer’s name and SSN to obtain a job. IRS subsequently receives income information from the identity thief’s employer. After the victim files his or her tax return, IRS matches income reported by the victim’s employer and the thief’s employer to the tax return filed by the legitimate taxpayer, as shown in figure 2. IRS then notifies the taxpayer of unreported income because it appears the taxpayer earned more income than was reported on the tax return. Employment fraud causes tax administration problems because IRS has to sort out what income was earned by the legitimate taxpayer and what was earned by the identity thief. The name and SSN information used by identity thieves to commit refund or employment fraud are typically stolen from sources beyond the control of IRS. IRS officials told us they are unaware of any incidents where information was stolen from IRS and used to commit employment or refund fraud. However, there are risks at IRS. In a recent audit, we found that although IRS has made progress in correcting previously reported information security weaknesses, it did not consistently implement controls intended to prevent, limit, and detect unauthorized access to its systems and information, including sensitive taxpayer information. In 2009, we also reported that third-party software used to prepare and file returns may pose risks to the security and privacy of taxpayer information. IRS agreed with our recommendations to address these and other issues. We recently followed up with IRS on this issue and learned that IRS has begun monitoring adherence to security and privacy standards in the tax software industry. In 2004, IRS developed a strategy to address the problem of identity theft– related tax administration issues. According to IRS, the strategy has evolved and continues to serve as the foundation for all of IRS’s efforts to provide services to victims of identity theft and to reduce the effects of identity theft on tax administration. Indicators—account flags that are visible to all IRS personnel with account access—are a key tool IRS uses to resolve and detect identity theft. IRS uses different indicators depending on the circumstances in which IRS receives indication of an identity theft–related problem. Once IRS substantiates any taxpayer-reported information, either through IRS processes or the taxpayer providing documentation of the identity theft, IRS will place the appropriate indicator on the taxpayer’s account and will notify the taxpayer. IRS will remove an indicator after 3 consecutive years if there are no incidents on the account or will remove an indicator sooner if the taxpayer requests it. The three elements of IRS’s strategy are resolution, detection, and prevention. Resolution. Identity theft indicators speed resolution by making a taxpayer’s identity theft problems visible to all IRS personnel with account access. Taxpayers benefit because they do not have to repeatedly explain their identity theft issues or prove their identity to multiple IRS units. Indicators also alert IRS personnel that a future account problem may be related to identity theft and help speed up the resolution of any such problems. Since our 2009 report, IRS developed a new, temporary indicator to alert all IRS units that an identity theft incident has been reported but not yet resolved. IRS officials told us that they identified a need for the new indicator based on their ongoing evaluation of their identity theft initiatives. The temporary indicator’s purpose is to expedite problem resolution and avoid taxpayers having to explain their identity theft issues to multiple IRS units. As discussed in our 2009 report, taxpayers with known or suspected identity theft issues can receive assistance by contacting the Identity Protection Specialized Unit. The unit operates a toll-free number taxpayers can call to receive assistance in resolving identity theft issues. Detection. IRS also uses its identity theft indicators to screen tax returns filed in the names of known refund and employment fraud victims. During the 2009, 2010, and 2011 filing seasons, IRS screened returns filed in the names of taxpayers with identity theft indicators on their accounts. There are approximately 378,000 such taxpayers. In this screening, IRS looks for characteristics indicating that the return was filed by an identity thief instead of the legitimate taxpayer, such as large changes in income or a change of address. If a return fails the screening, it is subject to additional IRS manual review, including contacting employers to verify that the income reported on the tax return was legitimate. In addition to U.S. taxpayers with indicators on their accounts, IRS officials also told us that they screened returns filed in the name of a large number—about 350,000—of Puerto Rican citizens who have had their U.S. SSNs compromised in a major identity theft scheme. As of May 12, 2011, 216,000 returns filed in 2011 failed the screens and were assigned for manual processing. Of these, IRS has completed processing 195,815 and found that 145,537 (74.3 percent) were fraudulent. In January 2011, IRS launched a pilot program for tax year 2010 returns (due by April 15, 2011) using a new indicator to “lock” SSNs of deceased taxpayers. If a locked SSN is included on a tax return, the new indicator will prompt IRS to automatically reject the return. PIPDS officials told us they intend to expand the pilot to include more SSNs of deceased taxpayers after analyzing the results of the initial pilot. A program IRS uses to identify various forms of refund fraud—including refund fraud resulting from identity theft—is the Questionable Refund Program. IRS established this program to screen tax returns to identify fraudulent returns, stop the payment of fraudulently claimed refunds, and, in some cases, refer fraudulent refund schemes to IRS’s Criminal Investigation offices. Prevention. As described in our 2009 report, IRS has an office dedicated to finding and stopping online tax fraud schemes. IRS also provides taxpayers with targeted information to increase their awareness of identity theft, tips and suggestions for safeguarding taxpayers’ personal information, and information to help them better understand tax administration issues related to identity theft. Appendix I summarizes information IRS and FTC provide to taxpayers to protect themselves against identity theft. Since our 2009 report, IRS began a pilot program providing some identity theft victims with a 6-digit Identity Protection Personal Identification Number (PIN) to place on their tax return. IRS officials told us they created the PIN based on their ongoing evaluation of their identity theft initiatives. When screening future years’ returns for possible identity theft, IRS will exclude returns with a PIN, which will help avoid the possibility of a “false positive” and a delayed tax refund. IRS sent letters containing an identity theft PIN to 56,000 taxpayers in the 2011 filing season. IRS will provide taxpayers a new PIN each year for a period of 3 years following an identity theft. IRS’s initiatives to address identity theft are limited in part because tax returns and other information submitted to and, in some cases generated by, IRS are confidential and protected from disclosure, except as specifically authorized by statute. As discussed in more detail in our 2009 report, IRS can disclose identity theft–related events that occur on a taxpayer’s account to the taxpayer, such as the fact that an unauthorized return was filed using the taxpayer’s information or that the taxpayer’s SSN was used on another return. However, IRS cannot disclose to the taxpayer any other information pertaining to employment or refund fraud, such as the perpetrator’s identity or any information about the perpetrator’s employer. Additionally, IRS has limited authorities to share identity theft information with other federal agencies. When performing a criminal investigation, IRS can make only investigative disclosures, that is, the sharing of specific, limited information necessary for receiving information from other federal agencies that might support or further IRS’s investigation. Disclosure of taxpayer information to state and local law enforcement agencies is even more limited. Because of the timing of tax return filing, IRS is often unable to detect suspicious cases until well after the fraud occurred. Validating the identity theft and substantiating the victim’s identity takes further time. For example, IRS may not be able to detect employment fraud until after the following year’s tax filing deadline of April 15 when it matches income reported by employers against taxpayers’ filed returns. It is only after IRS notifies a taxpayer of unreported income that IRS may learn from the taxpayer that the income was not the taxpayer’s and that someone else must have been using his or her identity. By the time both the victim and IRS determine that an identity theft incident occurred, well over a year may have passed since the employment fraud. IRS officials told us that IRS pursues criminal investigations of suspected identity thieves in only a small number of cases. IRS’s Criminal Investigations (CI) Division’s investigative priorities include tax crimes, such as underreporting income from legal sources; illegal source financial crimes; narcotics-related financial crimes; and counterterrorism financing. In fiscal year 2010, CI initiated 4,706 investigations of all types, a number far smaller than the total number of identity theft–related refund and employment fraud cases identified in that year. Also, the decision to prosecute identity thieves does not rest with IRS.