Viewed broadly, IDT refund fraud is composed of two crimes: (1) the theft or compromise of PII, and (2) the use of stolen (or otherwise compromised) PII to file a fraudulent tax return and collect a fraudulent refund. Identity theft. The sources of stolen identities are limitless, according to an official in IRS’s Criminal Investigation Division. Identity thieves can hack into government or commercial systems, recruit insiders (such as employees in the healthcare or education industries) to steal PII, or purchase or put pieces of PII together to create an identity (see figure 1). To successfully commit identity theft, thieves can exploit specific digital, physical, or social vulnerabilities (see sidebar). According to Department of Justice (DOJ) officials, the PII used in tax refund fraud can also involve compromised identities, where the real identity holder initially sells his identity to third parties. Identity Theft and Personally Identifiable Information (PII) Vulnerability: An Overview PII is vulnerable to theft and exploitation in three broad areas. Digital vulnerability: Criminals can access large amounts of digital information if it is inadequately safeguarded. For example, thieves can steal it through hacking and computer intrusion, can aggregate publicly available information, or can sell and buy PII from other criminals on the black market. In one case, a foreign national obtained PII from online databases and sold it to other criminals, resulting in 13,673 victims and $65 million claimed in refund fraud. Physical vulnerability: If insufficient attention is paid to the structures and tools used to store, maintain, and safeguard PII, such as hard drives, paper records, or unsecured mailboxes, thieves will exploit these vulnerabilities through computer theft and “dumpster diving.” Social vulnerability: Thieves can trick individuals into divulging their own PII or others’ PII, for example by impersonating IRS officials. Thieves may also recruit individuals with legitimate access to sensitive information. In one case, a ring of thieves used its employment access to steal identities from public and private databases, such as the U.S. Army, several Alabama state agencies, a Georgia call center and employee records from a Georgia company. IRS recognized the challenge of IDT refund fraud in its fiscal year 2014- 2017 strategic plan and increased resources dedicated to combating IDT and other types of refund fraud. In fiscal year 2015, IRS reported that it staffed more than 4,000 full-time equivalents and spent about $470 million on all refund fraud and IDT activities. The administration requested an additional $90 million and 491 full-time equivalents for fiscal year 2017 to help prevent IDT refund fraud and reduce improper payments. IRS estimates that this $90 million would help it protect an additional $612 million in revenue in fiscal year 2017, as well as protect revenue in future years. The Consolidated Appropriations Act, 2016, appropriated IRS an additional $290 million for improvements to customer service, IDT identification and prevention, and cybersecurity efforts. The IRS spending plan indicates that officials will use this funding to (1) reduce the wait times and improve the performance on IRS’s Taxpayer Protection Program/Identity Theft Toll Free Line, and (2) improve network security and protect taxpayer data from unauthorized access by identity thieves, among other things. To detect and prevent IDT refund fraud, IRS has developed tools and programs, including: IDT filters: IRS uses automated filters that search for IDT refund fraud characteristics to identify suspicious returns during processing and to confirm taxpayers’ identities before issuing refunds. These characteristics are based on both IRS’s knowledge of previous refund fraud schemes and clusters of returns with similar characteristics. Taxpayer Protection Program. The Taxpayer Protection Program (TPP) reviews returns that are flagged by IRS’s IDT filters. IRS asks taxpayers to authenticate their identities—either online or by phone— by answering questions that a legitimate taxpayer is likely to know, such as previous addresses, mortgage information, and data about family members. If the taxpayer fails to authenticate himself online or by phone, IRS instructs the respondent to authenticate his identity in person at an IRS Taxpayer Assistance Center. Identity Protection Personal Identification Number (IP PIN): IP PINs are single-use identification numbers sent to IDT victims who have authenticated their identities with IRS. If a return is electronically filed (e-filed) for a Social Security Number assigned an IP PIN, it must include the IP PIN or else IRS will reject the return. If a paper return has a missing or incorrect IP PIN, IRS delays processing the return while the agency determines if it was filed by the legitimate taxpayer. As a result of an ongoing security review, IRS temporarily suspended the IP PIN tool in March 2016 while it assesses how to further strengthen its security features. IRS also works with third parties, such as industry, states, and financial institutions, to try to detect and prevent IDT refund fraud. In March 2015, the IRS Commissioner convened a Security Summit with industry and states to improve information sharing and authentication. IRS officials said that 40 state departments of revenue and 20 tax industry participants have officially signed on to the partnership. IRS is investing $16.1 million for identity theft prevention and refund fraud mitigation actions that come out of the Security Summit. These efforts include developing an Information Sharing and Analysis Center where IRS, states, and industry can share information to combat IDT refund fraud. IRS monitors the extent of IDT refund fraud through its Taxonomy. This research-based effort aims to report on the effectiveness of IRS’s IDT defenses to internal and external stakeholders, help IRS identify IDT trends and evolving risks, and refine IDT filters to better detect potentially fraudulent returns, while reducing the likelihood of flagging legitimate tax returns. As shown in figure 3, IRS’s Taxonomy estimates the number of identified IDT refund fraud cases where IRS (1) prevented or recovered the fraudulent refunds (turquoise band), and (2) paid the fraudulent refunds (purple band). IRS breaks these estimates into categories corresponding to IDT detection strategies, which occur at three key points in the life cycle of a tax refund: before accepting a tax return, during return processing, and post refund. IRS creates the Taxonomy’s estimates through sources including IRS’s Refund Fraud & Identity Theft Global Report (Global Report) and a modeling data set composed of known IDT returns and potential identity theft returns. In response to our recommendation in January 2015, IRS began using the modeling data set to improve Taxonomy estimates for refunds it paid (Categories 4 and 5 in figure 3 above). According to IRS officials, the agency developed its modeling data set to explore IDT characteristics and build the models within its IDT filters to help identify and protect against IDT refund fraud. The modeling data set consolidates data on known and potential IDT returns from various IRS systems and programs. Figure 4 shows IRS’s estimates of attempted IDT refund fraud for 2014. IRS estimates that it prevented or recovered $22.5 billion in IDT refunds. For the cost of IDT refunds paid, IRS estimated a range of values; the $3.1 billion estimate for IDT refunds paid represents the upper bound of IRS’s range for IDT refunds paid. However, IRS recognizes that there is imprecision in these estimates. Further, there is uncertainty in these estimates, as will be discussed later. One of IRS’s key defenses in reducing the risk of IDT refund fraud is TPP, which is intended to verify the identities of suspicious filers. TPP has procedures that help IRS authenticate legitimate taxpayers by requiring filers to answer questions only legitimate taxpayers are likely to know, or in some instances, checking information reported on filers’ returns with information reported by third parties, such as W-2s. Figure 5 illustrates the TPP process. Of the 650,000 filers who responded to TPP notification letters, 450,000 (69 percent) attempted remote authentication—online or by phone— whereas 200,000 (31 percent) claimed to be victims of IDT who had not filed the selected returns. To pass remote authentication, filers first complete “identity proofing” by providing basic identifying information such as their names and dates of birth. Next, they are asked to answer knowledge-based authentication questions obtained from a third-party provider. Examples of authentication questions are “Who is your mortgage lender?” or “Which of the following is your previous address?” If filers pass knowledge-based remote authentication, then IRS releases those filers’ returns for further processing before issuing refunds. If filers cannot pass, IRS will not issue a refund unless those filers pass in-person authentication or IRS receives information return documents from third parties, such as W-2s, that match filers’ return data. Officials stated that TPP authentication poses a challenge to IRS because it must authenticate almost all taxpayers in the program remotely. According to a United States Digital Service (USDS) report, it is costly for fraudsters to attempt in-person authentication at scale because it requires human interaction. As a result, when compared to in-person authentication, fraudsters are incentivized to remotely authenticate because it allows for multiple attempts, allowing the fraudster more opportunity to access the taxpayers’ information more quickly and easily respond to authentication questions. IRS has conducted research both to evaluate the effectiveness of existing TPP authentication procedures and to identify options for strengthening those procedures. Based on research efforts, IRS made improvements to its phone authentication options for filing season 2015. For example, IRS created a more challenging High Risk Authentication (HRA) quiz, which requires taxpayers to recall information from past tax filings.