Identity theft occurs when someone uses an individual’s or business’s personal information, such as name, taxpayer identification number (TIN) (e.g., social security number (SSN) or employer identification number (EIN)) or other identifying information without permission with the intent to commit fraud or other crimes. When an examiner is advised or otherwise becomes aware that a taxpayer may be a victim of identity theft, the examiner must take certain actions. This IRM provides guidance for actions that must be taken to address and resolve identity theft issues.

All identity theft cases are considered priority workload.

IRM 1.2.1.17.1, Policy Statement 10-1 (formerly P-25-1), Assisting taxpayers who report they are victims of identity theft.

IRC 7529, Notification of suspected identity theft.

The Director, Examination Headquarters, is the executive responsible for providing policy and guidance for field employees and ensuring consistent application of policy, procedures and tax law to effect tax administration while protecting taxpayers’ rights. See IRM 1.1.16.5.5, Examination Headquarters, for additional information.

The Director, Examination Field and Campus Policy, reports to the Director, Examination Headquarters, and is responsible for the delivery of policy and guidance that impacts the field examination process. See IRM 1.1.16.5.5.1, Examination Field and Campus Policy, for additional information.

Field Examination General Processes (FEGP), which is under the Director, Examination Field and Campus Policy, is the group responsible for providing policy and procedural guidance on standard examination processes to field employees. See IRM 1.1.16.5.5.1.1, Field Examination General Processes, for additional information.

Examiners, their managers, and clerical support staff should thoroughly acquaint themselves with the examination procedures and information contained in this IRM.

All examiners must perform their professional responsibilities in a way that supports the IRS Mission. This requires examiners to provide top quality service and to apply the law with integrity and fairness to all.

Examiners are responsible for knowing and acting in accordance with the Taxpayer Bill of Rights (TBOR), which includes the taxpayer’s right to be informed and the right to quality service. See IRM 4.10.1.2.1, Taxpayer Bill of Rights (TBOR), for additional information on the TBOR. Examiners must ensure taxpayers receive prompt and clear communications of IRS determinations regarding identity theft, actions taken to protect and/or correct the tax account, and identity theft resources available to taxpayers. Additionally, examiners should be aware of the impact being an identity theft victim may have on a taxpayer and handle the contact with an additional level of sensitivity and understanding.

Examiners and other group personnel will work closely with employees in the Wage and Investment (W&I) Identity Theft Victim Assistance (IDTVA) and Return Integrity Verification Operations (RIVO) functions to resolve identity theft issues.

For guidance specific to LB&I, please visit the LB&I Identity Theft page in the Exam Procedures Knowledge Base.

Monthly Examination Returns Control System (ERCS) reports are used to track the number of identity theft cases closed during the month, the number of identity theft cases currently open, and to identify cases missing appropriate identity theft tracking codes.

See IRM 25.23.1.1.2, Terms/Definitions/Acronyms, and IRM Exhibit 25.23.1-1, Glossary of Identity Protection Terms and Definitions, for common terms, definitions, and acronyms associated with identity theft.

The following table contains a list of terms used throughout this IRM and their definitions.

The following table lists acronyms used throughout this IRM and their definitions.

There are multiple resources employees will use specific to identify theft, including but not limited to:

There are multiple ways examiners may encounter identity theft during an examination, including (not all-inclusive).

Examiners should be alert in all cases that identity theft may have occurred, including when the taxpayer does not respond to correspondence. A taxpayer who does not respond to correspondence may be a victim of identity theft. Examiners should verify the correct current address of the taxpayer. SB/SE field examiners should refer to IRM 4.10.2.8.3, No Response/No Show Procedures, and IRM 4.10.2.8.4, Undeliverable Initial Contact Letter, for assistance.

SB/SE field examiners should contact their Area PSP Identity Theft Coordinator for assistance on identity theft cases. LB&I examiners should contact the LB&I Identity Theft Point of Contact (POC).

The IDTVA function within W&I handles identity theft inquiries and assists taxpayers who are victims of identity theft. If a taxpayer contacts IDTVA and the identity theft inquiry involves an audit (open or closed), IDTVA will prepare a Form 14027-B and forward it to the Area PSP identity theft coordinator for assignment.

The group's clerical staff will notify the manager when a Form 14027-B and other related identity theft information is received in the group and provide the information to the assigned examiner.

If an examiner receives Form 14027-B, the examiner must acknowledge receipt by filling out Section V on page 2 and faxing the form to the IDTVA employee within 10 business days. The fax number for the IDTVA employee should be located in Section II line 4 of Form 14027-B.

If sufficient documentation supporting the identity theft has not already been submitted to the IRS, the examiner may need to secure additional documentation to authenticate the taxpayer's identity and evidence of the identity theft. See IRM 4.10.27.3 for documentation requirements. If the taxpayer does not provide supporting documentation when requested, proceed with case resolution as if the taxpayer is not an identity theft victim.

The examiner must take applicable steps for resolving the identity theft issue based on the facts and circumstances of the case.

When the case is resolved and/or account actions are complete, the examiner must complete Form 14027-B through Section VIII and return it to the IDTVA employee.

Form 14566 is used when referring BMF identity theft cases between business units for actions needed to resolve the identity theft issue. If an examiner is assigned a case with Form 14566, the examiner must take actions to address the issues noted on the referral.

If the documentation supporting the identity theft has not been submitted to the IRS, the examiner may need to secure additional documentation to authenticate the taxpayer's identity and evidence of the identity theft. See IRM 4.10.27.3 for documentation requirements.

The examiner will take applicable steps for resolving the identity theft issue based on the facts and circumstances of the case.

When the case is resolved and/or account actions are complete, the examiner must document Form 14566 with actions taken to address the BMF identity theft issue. The examiner must return the completed Form 14566, through their BOD’s BMF Identity Theft Liaison, to the employee who initiated the referral via secure e-mail.

See IRM 25.23.9.8, Business Master File (BMF) Identity Theft Referrals, for additional information.

Non-tax related identity theft occurs when a taxpayer’s or dependent’s information has been compromised and/or used without permission (e.g., a lost or stolen wallet, questionable credit card activity, data breach, SSN used by someone else to obtain employment or other types of income (i.e., employment or income related identity theft), etc.), but the identity theft doesn’t affect the taxpayer’s MF tax account. See IRM 25.23.1.1.2(1), Terms/Definitions/Acronyms, and IRM Exhibit 25.23.1-1, Glossary of Identity Protection Terms and Definitions.

If the taxpayer’s identity has been compromised but there is no known impact to the MF tax account, the examiner should take the following actions:

If an IMF taxpayer provides identity theft substantiation (e.g., Form 14039, Identity Theft Affidavit, etc.) for non-tax related identity theft, the examiner should forward the documentation along with Form 4442, Inquiry Referral, to IDTVA by fax at 1-855-807-5720. Upon receipt of identity theft substantiation for non-tax related identity theft (IMF), IDTVA will input identity theft tracking indicators on the account (see IRM 25.23.2.8.1, IMF TC 971 AC 504).

Refer to the following IRMs for additional information:

Identity theft tracking indicator codes are used to facilitate Servicewide tracking and reporting of both tax-related and non-tax related identity theft incidents. Examiners must ensure the proper identity theft tracking indicator codes are on a victim’s account when tax administration is impacted. See IRM 4.10.27.6.1.4 for instructions on requesting tracking indicators be input on a taxpayer’s account.

Each indicator is input as a TC 971 with an action code (AC) and tax administration source code (SC), and is displayed on IDRS via several command codes (e.g., ENMOD (IMF and BMF), IMFOL with definer E (IMF), TXMOD with definer A (BMF), or BMFOL with definer T (BMF)) of the affected taxpayer’s account. The AC and tax administration SC are dependent upon the facts and circumstances of the case.

For assistance with interpreting and using IMF identity theft tracking indicators, examiners should refer to IRM 25.23.2, Identity Protection and Victim Assistance - General Case Processing. The different components of identity theft tracking indicators for IMF identity theft are described and defined throughout IRM 25.23.2, including the following subsections:

For assistance with interpreting and using BMF identity theft tracking indicators, refer to IRM 25.23.9.5.2, Tracking Business Master File (BMF) Tax-Related Identity Theft Inventory.

SB/SE Examination and LB&I monitor identity theft cases open on AIMS/ERCS using ARC 014, Identity Theft, when tax administration is impacted.

Examiners must update AIMS/ERCS with ARC 014 for each impacted open tax year when the taxpayer claims to be a victim of identity theft or provides documentation to substantiate identity theft.

The ARC 014 remains on the AIMS/ERCS record regardless of the taxpayer submitting the substantiation documentation or the examiner’s determination of identity theft.

ARC 014 has priority and will overlay all other ARCs, except ARC 095, TC 150 was determined the perpetrator return, a second valid return posted and selected for examination.

Examiners must input ARC 095 on the AIMS/ERCS and MFT AD record (see IRM 4.10.27.6.3.1) if the victim’s true return is examined after account corrections are completed.

When tax administration is impacted, time spent working identity theft issues must be tracked. Activity Code 557 is used to charge time spent working identity theft issues whether or not the case is open on AIMS/ERCS. See IRM 4.10.27.6.3.1 and IRM 4.10.27.6.3.2.

The examiner should secure a current TXMOD and determine if any tax period(s) impacted by identity theft are in collection Status Codes 22, 24, or 26. Refer to the instructions in CFOL Express for How to Determine if Collection is Assigned to Your Case to determine the collection status.

After determining a tax period impacted by identity theft is in Collection status codes 22, 24, or 26, the examiner must suspend collection activity before the request for victim account corrections are submitted.

The examiner must take the following actions if at least one of the identity theft tax years is in collection Status Code 26:

The examiner must take the following actions if the identity theft tax year(s) is in Status Code 22 or Status Code 24 and no other years are in Status Code 26:

Document the actions taken on the case activity record or the workpapers.

If the return is determined to be a nullity, the examiner should follow the applicable instructions in IRM 4.10.27.12 or IRM 4.10.27.13 for correcting the victim’s account.

This section contains instructions for examiners when it is necessary to reprocess a return to a correct TIN. The instructions can also be used to reprocess a return to a correct tax year.

The examiner will secure the original return. The examiner must determine if the original return was paper filed or electronically filed prior to correcting the TIN (or tax period).

To determine if the original return was paper filed (and secure the paper return):

If the paper filed return still cannot be secured using the procedures above, a Dummy Return must be created. Available command codes, such as CC RTVUE / BRTVU or TRDBV, may provide sufficient information to recreate the return. If enough information is available, a "dummy" return can be completed and forwarded to Submission Processing for posting to the correct TIN (or tax Period).

To determine if the original return was filed electronically, secure a print of CC IMFOL or BMFOLI ‘I’. Under the "Return Posted" column, if the tax period displays "MEF" , it means that the return was filed electronically. An electronically filed return can also be determined by the first two digits of the DLN, associated with the TC 150 - see Document 6209, IRS Processing Codes and Information, Section 4 (3), Campus and File Location Codes, for a list of electronic filing DLNs.

If it is determined that the taxpayer filed an electronic return, the return can be secured using Modernized e-file (MeF) application, Return Request Display (RRD) in the Employee User Portal (EUP). CC TRPRT (Tax Return print) can also be requested and used to reprocess the return. A TRPRT is a graphical (form image) print of a tax return stored on TRDB (Tax Return Data).

The examiner will complete Form 3870 and:

Keep a copy of the return information and other pertinent documents for your files.

Forward the return and Form 3870 to CCP by either mail or EEFax. If the original return is secured, it must be mailed. All other forms of the return can be e-faxed to CCP.

If mailing an original return and Form 3870 to CCP, use the following address and mail via overnight mail:

The reprocessing of returns takes approximately eight weeks to complete.

Once the examiner has been notified by CCP that the reprocessing action has been completed, the group must close both the AIMS and ERCS controls for the incorrect TIN (or tax period) by completing Form 10904, Request for Record Deletion from AIMS/ERCS, using Disposal Code 33.

The group will close the AIMS and ERCS controls on the incorrect TIN (or tax period) once notified by CCP that the reprocessing action has been completed. AIMS and ERCS controls are closed by completing Form 10904, Request for Record Deletion from AIMS/ERCS, using Disposal Code 33. Provide the reason for the request on the form. Update the ERCS record to status 41 and forward Form 10904 to the local AIMS/ERCS analyst for processing.

The group will establish AIMS/ERCS controls using the correct TIN (or tax period) with managerial approval. Assistance from the local AIMS/ERCS analyst is available as needed.

Once the return is reprocessed, AIMS/ERCS controls have been closed on the incorrect TIN (or tax period), and AIMS/ERCS controls have been established on the correct TIN (or tax period), the examiner can forward their completed audit to the appropriate CCP FORT or Technical Services office for final closure of the examination.

When the taxpayer does not have a TIN and an adjustment needs to be made to the taxpayer’s account on MF, the following options are available:

If the taxpayer does not have an EIN or SSN and refuses to file Form SS-4, Application for Employer Identification Number, or Form SS-5, Application for a Social Security Number Card (Original, Replacement or Correction), the examiner can secure an IRSN by completing Form 4442, Inquiry Referral, for BMF taxpayers or Form 9956, Request for Temporary SSN, for IMF taxpayers. Follow the instructions below:

For additional information on TINs, see IRM 3.13.2, BMF Account Numbers, and IRM 3.13.5, Individual Master File (IMF) Account Numbers.

Once the taxpayer has a valid TIN, the valid return filed under someone else’s TIN may be reprocessed to the taxpayer’s TIN following procedures in IRM 4.10.27.9.2.

IRM 4.10.27.12.1.1 through IRM 4.10.27.12.1.5 provide specific instructions for the examiner to take when processing cases where no TC 300 posted to MF based on the five scenarios outlined in Table 1 at IRM 4.10.27.12.

IRM 4.10.27.12.2.1 through IRM 4.10.27.12.2.5 provides specific instructions for the examiner to take when processing cases where a TC 300 posted to MF based on the five scenarios outlined in Table 2 in IRM 4.10.27.12.

The examiner must prepare the Form 4442 package containing the following:

A separate Form 4442 must be prepared and submitted to the BITER team for each tax year that reversals need to be made on a victim’s account. Supporting documentation does not need to be duplicated and attached to each year. The supporting documentation, if the same for all years involved, only has to be attached to the most recent year’s Form 4442 (e.g., 2018, 2019, and 2020, only attach supporting documentation to Form 4442 for 2020).

When preparing Form 4442:

To submit the "Form 4442 Package" to the BITER team, send an encrypted e-mail to *SBSE CCS BSC EXAM IDT.

Incomplete referrals will be rejected back to the originating group.

BITER will assign a CIS number to the referral and provide it to the examiner by email.

While the reversals for the identity thief’s return data are being processed by the BITER team, examiners should continue with the examination of the victim’s return, if warranted. BITER will notify the examiner when the actions are completed.

Examiners should periodically check transcripts to see if the reversals are posted on the account even if a confirmation e-mail has not been received. The examiner should follow-up if no contact from the BITER team is received within 12 to 15 weeks. If needed, contact the Area PSP Identity Theft Coordinator for assistance.

A Form 14566 package is required to be submitted to the W&I-AM BMF function for BMF identity theft account corrections.

The examiner must prepare the Form 14566 package containing the following:

Examiners should refer to IRM Exhibit 25.23.9-6, Business Master File (BMF) Identity Theft Referral Form, for instructions on completing Form 14566. In the "Explanation for identity theft determination (required)" section, enter instructions or language regarding account corrections requested. Some or all of the language used on Form 4442, Inquiry Referral, for IMF identity theft cases (see IRM 4.10.27.12.1.1 through IRM 4.10.27.12.1.5) may be applicable for BMF account correction requests and can be used on Form 14566 as appropriate, based on the facts and circumstances of the case.

A separate Form 14566 must be prepared for each tax year that reversals need to be made on a victim’s account. Supporting documentation does not need to be duplicated and attached to each year. The supporting documentation, if the same for all years involved, only has to be attached to the most recent year Form 14566 (e.g., 2018, 2019, and 2020, only attach supporting documentation to Form 14566 for 2020).

To submit the Form 14566 package, send an encrypted e-mail to your BOD’s (SB/SE Field Exam or LB&I) BMF Identity Theft Liaison. The liaison will review the package for accuracy and completeness and forward to the BMF identity theft liaison for W&I-AM BMF. The W&I-AM BMF liaison will acknowledge receipt of the referral within three business days and advise the referring function the case has been accepted into their inventory and assigned to the appropriate team for resolution.

The estimated timeframe for completion of account corrections is 30 days. W&I-AM BMF may advise more time is needed depending on the account correction actions requested. Once all requested actions have been taken, the W&I-AM BMF employee will return the completed BMF identity theft referral to their liaison, who will then send it through the originator’s BMF identity theft liaison and they will return it to the examiner. See IRM 25.23.9.8, Business Master File (BMF) Identity Theft Referrals.

The examiner should monitor the account and follow-up with their BOD’s BMF identity theft liaison if account corrections are not processed within 60 days.

All Identity theft account corrections must be approved, in writing, by the group manager. Unlike the Form 4442 used for IMF identity theft, the forms used to correct BMF accounts do not include a place for the manager’s signature; therefore, it is necessary to obtain written managerial approval for BMF account corrections in an alternative manner. The written approval method can be at local management’s discretion as long as the written approval:

The following are examples of how written managerial approval can be obtained for BMF account correction (not all-inclusive).

The examiner must save the manager’s written approval in the RGS case file. See IRM 4.10.27.15 for RGS procedures.

The RGS case file will generally include but is not limited to the following:

If the secured delinquent return is accepted as filed, follow procedures in IRM 4.4.9.6.3, Delinquent Return Secured by Examination After SFR TC 150 Posted - Accepted as Filed Procedures, and IRM 4.4.9.6.3.1, Prepare Examination Report and Form 5344, Examination Closing Record, to incorporate the amounts on the secured delinquent return into an examination report and assess as a TC 300. Applicable RGS procedures can be found in the Identity Theft RGS Procedures – IMF (All) and BMF (No TC 300 Posted to MF) and Identity Theft RGS Procedures – BMF (TC 300 Posted to MF) job aids.

After the account is corrected, the secured return or TC 976 duplicate return must be processed as a partial assessment. Prepare the examination report starting with zero per return to reflect tax, credits, etc. per return. Refer to IRM 4.4.9.6.4.1, Prepare Examination Report and Form 5344, Examination Closing Record, and IRM 4.4.9.6.4.2, EFax to Centralized Case Processing (CCP), for partial assessment processing instructions. Applicable RGS procedures for partial assessments can be found in the Identity Theft RGS Procedures – IMF (All) and BMF (No TC 300 Posted to MF) and Identity Theft RGS Procedures – BMF (TC 300 Posted to MF) job aids.

If the audit of the victim’s return does not result in adjustments, refer to IRM 4.4.9.6.5.1, No Additional Adjustments Required/Prepare RAR (Revenue Agent Report) and Form 5344, Examination Closing Record, for examination report and closing procedures.

If the audit of the victim’s return results in additional adjustments, refer to IRM 4.4.9.6.5.2, Additional Adjustments Required/Prepare RAR and Form 5344, Examination Closing Record, for examination report and closing procedures.

Note: See Handling hardcopy original delinquent tax returns and amended returns for required procedures to send the delinquent return to Campus after it has been digitized and saved in the RGS electronic case file.

When the identity theft aspect is resolved and the account has been corrected, the examiner must update the impacted tax year(s) to ARC 095.

If a taxpayer’s account doesn’t show a return as being filed (no TC 150 posted), examiners should review TXMOD and IMFOL transcripts to determine if TPP codes are on the account and/or the return was posted to MFT 32. Follow the instructions in the table below if TPP codes are on the account and/or the return is posted to MFT 32.

Returns for the current tax year and immediately preceding tax year can be systemically posted to MFT 30. RIVO will send returns for earlier years to Submission Processing to be processed and posted.

Once the return is posted to MFT 30, verify the statute is correct on the module and proceed with the examination, if warranted.