First, an  identity thief may use a legitimate taxpayer’s identity to fraudulently file a  tax return and claim a refund during the filing season. IRS’s Ability to Detect and Catalog Current Identity Theft Incidents Is Limited and the Amount That Goes Undetected Is Not Known

IRS began systemically cataloging data on identity theft incidents in  January 2008, but limitations on the data mean that the data provides an  incomplete picture of the amount of identity theft-related fraud occurring  at IRS. One reason  for this is that IRS does not investigate every case of potential employment  fraud. According to CI data, in 2008, IRS stopped about 90 percent of suspected  identity theft-related refunds it identified as shown in table 3. For the  other 10 percent, a majority of the refunds were issued to suspected  identity thieves before the legitimate taxpayer filed their return. It is only  when IRS finds a duplicate tax return (a second return filed using the same  name and SSN) that IRS has an indication of potential refund fraud. IRS Has Implemented New Initiatives in an Effort to Detect and Resolve Identity Theft Cases, but Not Enough Is Known about How Well the Initiatives Are Working

In 2008 and 2009, IRS implemented four initiatives to detect and resolve  identify theft cases: identity theft account indicators, screening procedures  for returns with indicators, the Identity Protection Specialized Unit  (IPSU), and call centers with an identity theft telephone hotline. Furthermore, there have  been some glitches with implementation. The presence  of the indicator means that IRS was already working to resolve the  taxpayer’s tax problems before the taxpayer contacted TAS. Privacy and Other Laws Limit IRS’s Coordination with Other Agencies on Identity Theft Cases

Section 6103 of the Internal Revenue Code (I.R.C.) IRS  does not routinely accept this information because it does not meet IRS’s  substantiation requirements. Second, IRS is expanding the identity  theft initiatives for the 2010 filing season. Key contributors to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to (1) describe how much identity theft- related refund and employment fraud the Internal Revenue Service (IRS)  faces and whether incidents of identity theft go undetected by IRS, (2)  assess the actions IRS is taking to prevent and detect identity theft-related  tax problems and to assist affected taxpayers, and (3) describe what IRS is  doing to coordinate its identity theft-related efforts with other government  and nongovernment entities. Additionally, we analyzed  information from PIPDS on the number and characteristics of identity  theft-related refund and employment fraud by cases and affected  taxpayers, including the activity reporting the incident and the type of  identity theft indicator placed on the taxpayer account. We  reviewed the data and documents provided by IRS in conjunction with  discussions with IRS officials in order to describe these new initiatives as  well as to understand the extent to which IRS had performance measures  to determine the effectiveness of the new initiatives.
Why GAO Did This Study

Identity thieves may use a taxpayer's name and social security number to fraudulently claim a refund or gain employment. This creates tax problems for the innocent taxpayer when the Internal Revenue Service (IRS) discovers a duplicate refund claim or unreported wage income. IRS is revising its strategy for preventing, detecting, and resolving identity theft-related tax problems. GAO was asked to (1) describe the extent of identity theft-related refund and employment fraud, (2) assess IRS's actions to prevent and resolve such problems, and (3) describe IRS's identity theft- related coordination with other agencies. GAO analyzed IRS data on identity theft cases, reviewed revisions to the Internal Revenue Manual and other agency documents, and interviewed IRS officials responsible for the new strategy

What GAO Found

IRS's ability to detect identity theft-related refund and employment fraud is limited, but by the end of 2008, IRS had cataloged over 50,000 incidents. According to IRS, about 90 percent of fraudulently claimed refunds were stopped in 2008 with about $15 million issued before IRS became aware of the fraud. IRS does not know the amount of refund or employment fraud that goes undetected. In 2008, IRS began implementing four new initiatives in an effort to better detect and resolve identity theft cases. These include an identity theft indicator that IRS places on victims' accounts so that IRS personnel can more easily recognize and assist the legitimate taxpayer in case of future account problems. The indicator further enables IRS to screen returns to prevent fraudulent refunds from being issued to identity thieves. IRS also decided to resolve legitimate taxpayers' identity theft problems using a decentralized process--the activity that discovers a problem has the responsibility to resolve it. For the 2010 filing season, IRS is considering whether to expand its screening; however, IRS does not know how well its current strategy is working. IRS said it will develop performance measures, but it is not known whether the measures will be suitable for determining the effectiveness of the new initiatives, such as the number of false positives and negatives in the screening process or the success of the decentralized resolution process. Nor is it known when the new measures will be implemented. Measuring effectiveness matters because there have been glitches in implementing the initiatives. IRS is working to correct some discrepancies in the screening process and a GAO analysis of IRS data showed that some fraudulent refunds were issued even though taxpayers had indicators on their accounts. IRS's coordination with other agencies is limited. Statutory Provisions protecting the privacy of tax data prohibit IRS from sharing taxpayer information with other agencies in many cases. Nor does IRS routinely receive identity theft case data because of concerns with substantiation. IRS has coordinated with other agencies on how to manage identity theft programs.