IRS estimates that it prevented or recovered $22.5 billion in IDT refunds. Despite Recent Changes, Vulnerabilities in the Taxpayer Protection Program Limit IRS’s Ability to Prevent IDT Refund Fraud

One of IRS’s key defenses in reducing the risk of IDT refund fraud is TPP,  which is intended to verify the identities of suspicious filers. While TPP Protects Billions in Revenue, Some IDT Fraudsters Pass TPP Authentication and Potentially Receive Millions in Fraudulent Refunds

Of the about 1.6 million returns selected for TPP processing in filing  season 2015, IRS estimated that it potentially paid about $30 million to  IDT fraudsters who filed about 7,200 returns that passed TPP  authentication. While we cannot quantify the specific amount by which IRS’s analysis  underestimated the number of fraudulent IDT returns that passed TPP  authentication, we conducted a scenario analysis to demonstrate the  effect of omitting potential IDT returns on IRS’s estimates. IRS’s Most Recent Risk Assessment May Not Reflect the Threat That IDT Refund Fraud Currently Poses to TPP Authentication Procedures

Although IRS conducted a risk assessment for TPP authentication in  October 2012, the agency has not updated this assessment to reflect the  current threat of IDT refund fraud—specifically, the threat that some  fraudsters possess the PII necessary to pass authentication questions. IRS officials said IRS uses  the thresholds because it wants to prioritize IRS enforcement efforts. Further, the GAO Cost  Guide states that analysis should be regularly updated to reflect  significant changes in the methodology and should include all relevant  costs. Further, incomplete Taxonomy estimates  could impede IRS and congressional efforts to assess the effectiveness  of its IDT defenses over time. According to  IRS officials, the Global Report counts each time a return is caught by  IRS defenses as a separate instance of refund fraud. However, officials said they use the Global Report to  develop estimates of prevented IDT refund fraud because it represents  IRS’s official record of IDT fraud and because IRS has invested  substantial resources in improving the report. Further, the  GAO Cost Guide states that estimates be based on primary data sources  and contain few mistakes. In addition, IRS took steps to  incorporate better quality data into its refunds paid estimate by utilizing  both the modeling data set’s return-level information and results from a  new sampling effort. Conclusions

IRS’s continued efforts to improve TPP are critical to combatting IDT  refund fraud. In turn,  strengthened authentication would help IRS reduce revenue lost to IDT  fraudsters, improve the efficiency of fraud filter investments, and reduce  the number of legitimate taxpayers who become victims of IDT refund  fraud. More accurate Taxonomy estimates would help IRS  better understand how and to what extent IDT refund fraud is evading IRS  defenses. Additionally, reducing  overcounting and ensuring all relevant IDT returns—even those that fail to  meet specific refund thresholds—are included in Taxonomy estimates  could help IRS communicate more accurate information on the amount  and cost of IDT refund fraud to decision makers. Recommendations

To further deter noncompliance in the Taxpayer Protection Program, we  recommend that the Commissioner of Internal Revenue take the following  two actions in accordance with OMB and NIST e-authentication guidance:  1.  conduct an updated risk assessment to identify new or ongoing risks  for TPP’s online and phone authentication options, including  documentation of time frames for conducting the assessment, and  2.  implement appropriate actions to mitigate risks identified in the  assessment. To improve the quality of the Taxonomy’s IDT refund fraud estimates, we  recommend that the Commissioner of Internal Revenue take the following  two actions:  1.  remove refund thresholds from criteria used to develop IRS’s refunds- paid estimates, and  2.  utilize return-level data—where available—to reduce overcounting  and improve the quality and accuracy of the refunds-prevented  estimates. IRS did not change its upper threshold. Appendix I: Objectives, Scope, and Methodology

This report (1) evaluates the performance of Internal Revenue Service’s  (IRS) Taxpayer Protection Program (TPP) and (2) assesses IRS efforts to  improve its estimates of identity theft (IDT) refund fraud costs for 2014. To assess IRS’s efforts to improve its Identity Theft Taxonomy  (Taxonomy) estimates of IDT refund fraud for 2014, we reviewed the  Taxonomy’s methodology and estimates. We then evaluated them  against selected best practices in the GAO Cost Estimating and  Assessment Guide (GAO Cost Guide) that were applicable to the  Taxonomy and consistent with IRS and Office of Management and  Budget (OMB) information quality guidelines. Met. We continue to monitor IRS’s progress. High-Risk Series: An Update.
Why GAO Did This Study

IRS estimates that, in 2014, it prevented or recovered $22.5 billion in attempted IDT refund fraud, but paid $3.1 billion in fraudulent IDT refunds. Because of the difficulties in knowing the amount of undetected fraud, the actual amount could differ from these point estimates. IDT refund fraud occurs when a refund-seeking fraudster obtains an individual's identifying information and uses it to file a fraudulent tax return. Despite IRS's efforts to identify and prevent IDT refund fraud, this crime is an evolving and costly problem.
GAO was asked to examine IRS's efforts to combat IDT refund fraud. This report (1) evaluates the performance of IRS's TPP and (2) assesses IRS's efforts to improve its estimates of IDT refund fraud costs for 2014. To evaluate TPP, GAO reviewed IRS studies, reviewed relevant guidance, and met with agency officials. Further, GAO conducted a scenario analysis to understand the effect of different assumptions on IRS's TPP analysis. To assess IRS's IDT cost estimates, GAO evaluated IRS's methodology against selected best practices in the GAO Cost Guide .

What GAO Found

Taxpayer Protection Program (TPP) . While the Internal Revenue Service (IRS) has made efforts to strengthen TPP—a program to authenticate the identities of suspicious tax return filers and prevent identity theft (IDT) refund fraud—fraudsters are still able to pass through and obtain fraudulent refunds. TPP authenticates taxpayers by asking questions only a real taxpayer should know; however, fraudsters can pass by obtaining a taxpayer's personally identifiable information (PII). IRS estimates that of the 1.6 million returns selected for TPP, it potentially paid $30 million to IDT fraudsters who filed about 7,200 returns that passed TPP authentication in the 2015 filing season; however, GAO's analysis suggests the amount paid was likely to be higher. Although IRS conducted a risk assessment for TPP in 2012, IRS has not conducted an updated risk assessment that reflects the current threat of IDT refund fraud—specifically, the threat that some fraudsters possess the PII needed to pass authentication questions. Federal e-authentication guidance requires agencies to assess risks to programs. An updated risk assessment would help IRS identify opportunities to strengthen TPP. Strengthened authentication would help IRS prevent revenue loss and reduce the number of legitimate taxpayers who become fraud victims.
IDT Refund Fraud Cost Estimates . In response to past GAO recommendations, IRS adopted a new methodology in an effort to improve its 2014 IDT refund fraud cost estimates. However, the estimates do not include returns that fail to meet specific refund thresholds. IRS officials said the thresholds allow them to prioritize IRS's enforcement efforts. However, using thresholds could result in incomplete estimates. Improved estimates would help IRS better understand how fraud is evading agency defenses. The GAO Cost Guide states that cost estimates should include all relevant costs. Additionally, IRS's estimates of refunds it protected from fraud are based on the Global Report , which counts each time a fraudulent return is caught by IRS and thus counts some returns multiple times. IRS uses this data source because it is IRS's official record of IDT refund fraud. The GAO Cost Guide states that agencies should use primary data for estimates and the data should contain few mistakes. By using the Global Report , as opposed to return-level data, IRS produces inaccurate estimates of IDT refund fraud, which could impede IRS and congressional efforts to monitor and combat this evolving threat.

What GAO Recommends

GAO recommends that IRS update its TPP risk assessment and take appropriate actions to mitigate risks identified in the assessment. GAO also recommends that IRS improve its IDT cost estimates by removing refund thresholds and using return-level data where available. IRS agreed with GAO's TPP recommendations and will update its risk assessment. IRS took action consistent with GAO's IDT cost estimate recommendations.