In addition to identifying IDT refund fraud as a major issue and requesting  additional resources, IRS has developed a number of tools to address  IDT refund fraud throughout the tax return filing process—and has done  so amidst budget reductions and other challenges.IDT refund fraud includes efforts to authenticate taxpayer identities as  well as several tools used to detect and prevent IDT refund fraud, as  described below (see appendix II for more detail on these IDT refund  fraud tools). IRS’s response to  Authenticating Taxpayer Identities. IRS has enhanced its  authentication efforts to combat IDT refund fraud. Taxonomy Notes Relevant Cost Assumptions Used, but Does Not Provide the Rationale or Analysis Supporting the Assumptions

Developing loss estimates of illicit activities is challenging because such  activities are difficult to observe. Given the evolving nature of IDT refund fraud, documenting Taxonomy  assumptions and the rationale used to develop the assumptions would  help IRS management and policymakers to determine whether the  assumptions remain valid or need to be revised or updated. They stated that IRS did not  document its rationale for selecting assumptions because of the time and  resources required. That analysis shows that making different assumptions  could affect the estimate of category 5 IDT refunds paid by billions of  dollars in either direction (see appendix III, example 1). As a result, the level of uncertainty associated  IRS officials stated that they did not conduct such analyses because of  resource constraints and methodological challenges. Reporting the uncertainty  that is known already, and conducting further sensitivity analyses when  not cost prohibitive, might help IRS communicate the complexities  inherent in combating the evolving threat of IDT refund fraud. A point estimate, compared to a range or some  other indication of uncertainty, could provide a false sense of precision  leading to different decisions about how to allocate resources to combat  IDT refund fraud. The group has also documented short- and long-term priorities, including  implementation plans. In recent discussions, agency officials said they  would coordinate analysis of costs, benefits and risks with several IRS  offices. However, a commitment to cost, benefit and risk analysis is not  documented in the group’s short- and long-term priorities. The draft  planning documentation that we were given by IRS makes no mention of  where such analyses would be included in IRS’s priorities. Without analysis of costs, benefits and risks, IRS and Congress will not  have quantitative information that could inform decisions about whether  and how much to invest in the various authentication options. Cost, benefit and risk estimates for authentication would have the additional benefit of allowing  comparisons with other options for combating IDT refund fraud, such as  pre-refund W-2 matching. Both approaches could have significant costs  for taxpayers and IRS, so more information about the tradeoffs would  help inform IRS and congressional decision making. Recommendations

To improve the reliability of Taxonomy estimates for future filing seasons,  the Commissioner of Internal Revenue should follow relevant best  practices outlined in the GAO Cost Guide by taking the following two  actions:
Documenting the underlying analysis justifying cost-influencing
Reporting the inherent imprecision and uncertainty of the estimates. With regard to our second recommendation, IRS stated  that its authentication group will develop a repeatable process to estimate  and document the costs, benefits and risks of possible options for  taxpayer authentication, in accordance with OMB and NIST guidance. GAO staff who made key contributions to this report  are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

This report assesses (1) the quality of the Internal Revenue Service (IRS)  Identity Theft Taxonomy’s (Taxonomy) estimates of the cost of identity  theft (IDT) refund fraud, and (2) IRS’s progress in developing processes  to track device identification numbers and to enhance taxpayer  authentication. To assess the quality of the Taxonomy’s estimates of IDT refund fraud,  we reviewed the Taxonomy’s methodology and estimates for filing season  2013 and evaluated them against selected best practices in the GAO  Cost Estimating and Assessment Guide (GAO Cost Guide) that were  applicable to the Taxonomy and consistent with IRS and Office of  Management and Budget (OMB) information quality guidelines (see text  box).Taxonomy is an estimate of the amount of revenue lost to IDT refund  fraud—a cost to taxpayers. Met. To learn about additional actions IRS could take to prevent IDT refund  fraud, we interviewed associations representing software companies,  return preparers, and financial institutions. GAO. GAO. GAO. GAO. GAO. GAO. GAO.
Why GAO Did This Study

IRS estimated it prevented $24.2 billion in fraudulent identity theft (IDT) refunds in 2013, but paid $5.8 billion later determined to be fraud. Because of the difficulties in knowing the amount of undetected fraud, the actual amount could differ from these point estimates. IDT refund fraud occurs when an identity thief uses a legitimate taxpayer's identifying information to file a fraudulent tax return and claims a refund.
GAO was asked to review IRS's efforts to combat IDT refund fraud. This report, the second in a series, assesses (1) the quality of IRS's IDT refund fraud cost estimates, and (2) IRS's progress in developing processes to enhance taxpayer authentication.
GAO compared IRS's IDT estimate methodology to GAO Cost Guide best practices (fraud is a cost to taxpayers). To assess IRS's progress enhancing authentication, GAO reviewed IRS documentation and interviewed IRS officials, other government officials, and associations representing software companies, return preparers, and financial institutions.

What GAO Found

Identity Theft (IDT) Refund Fraud Cost Estimates. The Internal Revenue Service's (IRS) fraud estimates met several GAO Cost Guide best practices, such as documenting data sources and detailing calculations. However, the estimates do not reflect the uncertainty inherent in measuring IDT refund fraud because they are presented as point estimates. Best practices suggest that agencies assess the effects of assumptions and potential errors on estimates. Officials said they did not assess the estimates' level of uncertainty because of resource constraints and methodological challenges. Because making different assumptions could affect IDT fraud estimates by billions of dollars, a point estimate (as opposed to, for example, a range) could lead to different decisions about allocating IDT resources. Reporting the uncertainty that is already known from IRS analysis (and conducting further analyses when not cost prohibitive) might help IRS communicate IDT refund fraud's inherent complexity.
While IRS's fraud estimates note the relevant cost assumptions used to develop estimates, they do not provide the rationale or analysis to support them. Officials stated they did not document the rationale because of the time and resources required. Best practices suggest that agencies should document assumptions. Given the evolving nature of IDT refund fraud, documenting assumptions' rationale would help IRS management and policymakers determine whether the assumptions remain valid or need to be updated.
Taxpayer Authentication. IRS recently created a group aimed at centralizing several prior ad hoc efforts to authenticate taxpayers across its systems. IRS's planning documentation contains goals and short- and long-term priorities (including implementation plans). However, a commitment to cost, benefit and risk analysis is not documented in the group's short- and long-term priorities. The draft planning documentation makes no mention of where such analyses would be included in IRS's priorities. Office of Management and Budget guidance states that agencies should use cost-benefit analyses that consider alternatives to promote efficient resource allocation and that agencies should ensure that authentication processes provide the appropriate level of assurance by assessing risks. Without analysis of costs, benefits and risks, IRS and Congress will not have quantitative information that could inform decisions about whether and how much to invest in the various authentication options. Cost, benefit and risk estimates for authentication would have the additional benefit of allowing comparisons with other options for combating IDT refund fraud. IDT options could have significant costs for taxpayers and IRS, so more information about the tradeoffs would help inform IRS and congressional decision making.

What GAO Recommends

GAO recommends IRS improve its fraud estimates by (1) reporting the inherent imprecision and uncertainty of estimates, and (2) documenting the underlying analysis justifying cost-influencing assumptions. In addition, IRS should estimate and document the economic costs, benefits and risks of possible options for taxpayer authentication. IRS agreed with GAO's recommendations and provided technical comments that GAO incorporated, as appropriate.