The definitions for Individual Master File (IMF) and Business Master File (BMF) identity theft are:

The Identity Protection Strategy & Oversight Program was established to ensure servicewide implementation of federal directives to protect citizens and government employees. The following are the principal documents involving the identity theft program:

The Director, Collection Policy is the executive responsible for the policies and procedures related to W&I’s identity theft program. They are responsible for overseeing program coordination for field collection personnel related to the identity theft program.

The program manager, Case Resolution Alternatives (CRA), is responsible for the delivery of policies and procedures put forward by the W&I identity theft program.

Field collection group managers and territory managers are responsible for ensuring the guidance and procedures described in this IRM are complied with.

Program Effectiveness. The program effectiveness is measured by the following review types and by level of management.

Identity theft indicators. These indicators are utilized to track identity theft cases from the time a victim or IRS initially suspects identity theft through case closure. Identity theft indicators are posted as TC 971 AC 50X or TC 971 52X. Identity theft cases involving a BMF entity are input on the identified modules in CC TXMODA, and identity theft cases involving an IMF entity are posted on the entity (CC ENMOD).

Tax administration source codes. These source codes are utilized to track identity theft cases when they are initially identified. The tax administration source codes are shown with TC 971 AC 52X to identify the claim and your research results.

Frequently used terms within this IRM section, along with their definition, include:

This table lists commonly used acronyms and their definitions within this IRM.

IRM Resources:

Web Resource:

Per IRC 6103(b)(1) - The term "return" means any tax or information return, declaration of estimated tax, or claim for refund required by, or provided for or permitted under, the provisions of this title which is filed with the Secretary by, on behalf of, or with respect to any person, and any amendment or supplement thereto, including supporting schedules, attachments, or lists which are supplemental to, or part of, the return so filed.

An income tax return fabricated by an identity thief, where the thief fraudulently acquires and uses another taxpayer’s name and SSN for purposes of obtaining a fraudulent refund, is not a valid return. Moreover, such a return is not properly signed by the taxpayer in whose name the return is filed and, accordingly, lacks a valid signature.

A Form 1099, Miscellaneous Income and/or Form W-2, Wage and Tax Statement, fabricated by an identity thief and attached to an invalid income tax return is also invalid.

A Form W-2 filed by an employer that reports all the necessary information for the employee with a stolen SSN provided by the employee is a valid information return. The valid form reflects an employment relationship and is covered by IRC 6103(b)(1).

Per IRC 6103(b)(2) - The term "return information" means a taxpayer’s identity, the nature, source, or amount of income, payments, receipts, deductions, exemptions, credits, assets, liabilities, net worth, tax liability, tax withheld, deficiencies, over assessments, or tax payments, whether the taxpayer’s return was, is being, or will be examined or subject to other investigation or processing, or any other data, received by, recorded by, prepared by, furnished to, or collected by the Secretary with respect to a return or with respect to the determination of the existence, or possible existence, of liability (or the amount thereof) of any person under this title for any tax, penalty, interest, fine, forfeiture, or other imposition, or offense.

The information reported by an identity thief on a return is considered return information under IRC 6103(b)(2)(A).

The return information on Form W-2, Wage and Tax Statement, and Form 1099, Miscellaneous Income, with a stolen SSN is the return information of both the employer who filed it and the employee/individual who used the SSN for employment.

Also, see IRM 11.3.2.4.1.2, Identity Theft and Access to Tax Returns and Information Returns, regarding disclosing information from Form W-2 and Form 1099.

Information used by the IRS to determine the victim's tax liability is return information and can be disclosed to the victim. This includes information related to the original assessment that was based on the Form 1040, Form W-2, or Form 1099 filed under the victim’s SSN.

Information not used by the IRS to determine the victim’s tax liability, including information about the IRS’s investigation of the person who misuses the victim’s SSN, is not the return information of the victim and may not be disclosed to the victim.

An identity-theft victim may obtain from the IRS a copy of the "bad return" and other return information associated with the processing of the "bad return" filed by the identity thief if the disclosure will not seriously impair federal tax administration. Information about the IRS’s investigation is not the return information of the victim and may not be disclosed to the victim. Instructions for taxpayers to request a copy are available on IRS.gov, https://www.irs.gov/Individuals/Instructions-for-Requesting-Copy-of-Fraudulent-Returns.

An incorrect SSN on a Form W-2 is employer return information; however, any information about the investigation of the use/theft of the SSN or the person who used the SSN for employment cannot be disclosed to the employer.

If the taxpayer is a victim of identity theft, review the case history for any outstanding enforcement activity that may need to be addressed, e.g., levies, liens, and bankruptcy claims.

Cases in inventory will not be systemically blocked from automated levy action, (e.g., State Income Tax Levy Program (SITLP), and Federal Payment Levy Program (FPLP)). Manually block the case from levy by requesting the appropriate IDRS input if the assessment is a result of identity theft.

See IRM 5.12.11.2.1, Identity Theft and Liens, for additional procedures regarding Notices of Federal Tax Lien (NFTL).

See IRM 5.9.5.12, Identity Theft (IDT) - Introduction, for additional procedures regarding taxpayers in bankruptcy.

The IRS established the Taxpayer Protection Program (TPP) to identify and prevent the processing of potentially fraudulent returns. The program was established to help combat identity theft by preventing fraudulent returns from being filed using another person’s SSN. For these accounts, any Incoming tax returns using the taxpayer’s SSN are to be systemically screened using a series of filters in an attempt to distinguish legitimate tax returns from fraudulent returns. If the tax return is deemed to be potentially fraudulent, processing of the tax return is halted and the return is sent to the unpostable unit. Refer to IRM 5.1.11.5.11, The Taxpayer Protection Program, to identify early detection of potentially fraudulent tax returns with indications of identity theft.

If the identity theft return is posted on MFT 32, then the revenue officer needs to determine whether there is apparent identity fraud connected with the return. The MFT 32 is subject to the revenue officer’s verification and checks to verify the return filing legitimacy. See IRM 5.1.11.5.12, MFT 32 and Unpostable 126 procedures, to authenticate the taxpayer’s identity. When a return is flagged, the system freezes the claimed tax refund until the return’s legitimacy is verified.

If the flagged return is, in fact, legitimate, the return needs to be moved (reversed) from MFT 32 to MFT 30 for the refund to be issued.

If an unpostable condition appears on an account on IDRS, and there are indicators of an open TPP issue, the revenue officer must follow the procedures outlined in IRM 25.25.6.2.3, Exam/Collection/Compliance Office Employees - Procedures for Cases with Taxpayer Protection Program (TPP) Involvement, to resolve the account.

If unable to resolve the account by using internal information sources and/or by information already provided by the taxpayer, request additional information. Refer to IRM 25.23.2.3.6, When to Request Additional Information to Support an Allegation of Identity Theft. Taxpayer information to substantiate identity theft may include:

Follow the information in this table regarding acknowledging receipt of the taxpayer's claim/additional information:

A claim should be legible and accurately associated with the correct taxpayer.

Apply stringent safeguards when storing and retaining a claim. Store the claim along with the case file.

Secure and handle a claim and information in the same manner as other sensitive taxpayer personal information.

See IRM 5.1.28.8.2, Step 1 below for procedures to request input of TC 971, AC 522 PNDCLM. If after the account has been marked with identity theft indicator, the employee determines identity theft did not occur or the taxpayer did not provide supporting documents (Form 14039 or police report and personal identification), the identity theft tracking will be reversed. This removes the case from identity theft inventory. See IRM 5.1.28.8.6, Identity Theft Code TC 971 AC 522 Reversal Procedures (TC 972 AC 522), for additional guidance.

After receipt of the taxpayer's identity theft claim, conduct research to verify the taxpayer's claim.

If the identity theft claim received is not complete or legible, but a determination can be made based on internal research, then proceed using the internal research results.

The following is a list of the common research tools available to validate the claim. This list is not all inclusive:

If additional clarification or information is needed, contact the taxpayer and request the information.

The following is a list of suggested documents that can be secured from the employer that may help to verify a taxpayer’s claim of employment-related identity theft. The list is not all inclusive and not all documents will be necessary in every circumstance:

Consider the following when reviewing the documentation:

Research available locator sources.

If additional clarification or information is needed, contact the taxpayer and request the information.

Identity theft can be alleged by the taxpayer or identified by an IRS employee.

If an identity theft claim is secured from the taxpayer, follow IRM 5.1.28.8.2, Individual Taxpayer Alleges Identity Theft, for inputting the appropriate TC 971 action codes.

If an identity theft claim is not secured from the taxpayer, follow IRM 5.1.28.8.3, IRS Identified Identity Theft, for inputting the appropriate TC 971 action codes.

Instances of identity theft can either be alleged by the taxpayer, or third-party such as a taxpayer representative or bankruptcy trustee.

Below are step-by-step instructions for inputting the identity theft transaction codes to identify the claim and source code and preparing Form 4844, Terminal Input Request, in instances of IMF taxpayer alleged identity theft.

Below are step-by-step instructions for inputting the identity theft transaction codes and preparing Form 3870, Request for Adjustment, in instances of IMF taxpayer alleged identity theft.

Routing information for Form 3870 in IMF identity theft cases can be found at IRM 5.1.28.8.4(2)b. The routing will depend on the type of assessment that is being adjusted.

During the normal course of business, you may determine that identity theft occurred and the case is not yet resolved. In most instances, you will attempt to secure the identity theft claim from the taxpayer.

If you are unable to secure the identity theft claim (for example, the taxpayer is deceased), or the taxpayer is unwilling to provide the identity theft claim because they are receiving the benefit of the refund from the identity theft return, follow the procedures for IRS identified identity theft.

The function that completes the account adjustment and inputs the TC 971 AC 506 requested on Form 3870 will notify the taxpayer (victim), by letter, that someone may have attempted to use their SSN. This victim notification letter will include information about:

If it is determined that the individual taxpayer is a victim of identity theft, Form 3870, Request for Adjustment, is prepared to correct the victim’s account. The following guidelines should be followed when preparing Form 3870:

The completed Form 3870 will be routed based on the type of assessment that needs to be adjusted.

In cases involving employment related identity theft, also prepare Form 9409, IRS/SSA Wages Worksheet, to correct taxpayer wage records. Form 9409 includes the Social Security mailing address for the form.

If the taxpayer has been assessed a frivolous return penalty under IRC 6702 based on the return filed under the taxpayer's SSN by an identity thief, the civil penalty must be abated by the Frivolous Return Program (FRP). The penalty can be identified by MFT 55 with penalty reference code 543. The tax period must be the same as the identity theft return. A copy of the Form 3870 that was prepared and sent based on the routing instructions in (2) above should be sent to the FRP at the following address:

The Identity Protection Program developed and implemented identity theft indicator codes to centrally mark and track identity theft incidents. Each indicator is input as a Transaction Code (TC) with Action Code (AC) and displayed on Integrated Data Retrieval System (IDRS) command codes ENMOD and IMFOL with the definer "E" on the affected taxpayer's account.

Request input or reversal of the identity theft transaction code according to the following procedures:

TC 972 AC 522 is used to close identity theft allegations when the IRS determines that identity theft has not occurred or in situations where the taxpayer fails to provide an identity theft claim as described in IRM 5.1.28.6(2).

For effective identity theft case tracking and reporting, include the Administration Source Fields on Form 4844 when appropriate depending upon the facts and circumstances of the case. The following table provides the Source Codes, their descriptions and Secondary Date Fields needed for IDRS input of TC 972 AC 522.

In some instances it may be necessary to reverse a TC 971 AC 501 or TC 971 AC 506 identity theft action code. Reversal may be necessary because of any of the following reasons:

Use Form 4844, Request for Terminal Action, to request the input of TC 972 with the action code 501 or 506.

Complete the miscellaneous fields with any applicable, specific information for detailed reporting. The miscellaneous field has three parts:

Request input of the required miscellaneous field information in the Miscellaneous Field Input block of Form 4844.

Use the following codes to complete the first two miscellaneous fields:

Use the codes displayed in the following table to complete the third miscellaneous field (reason field codes and descriptions):

Complete the miscellaneous fields for TC 972 in the same format as for TC 971.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

Prior to validating BMF identity theft, conduct sufficient research to substantiate the identity theft and rule out any other problematic issues, such as a mixed entity. A mixed entity occurs when two or more taxpayers file a tax return for the same period using the same TIN. This may not be identity theft and instead is the result of taxpayer error, return preparer error, or IRS processing error.

Research the following on IDRS for the entity as appropriate,

Research CC IRPTR for documents filed by the

Review returns filed using CC TRDBV, CC BRTVU, Modernized e-File (MEF)/Employee User Portal (EUP), AMS

ESTAB copies of the Form 941 to verify the name and signature on the form.

Research payment patterns on the Remittance Transaction Register (RTR) for existing payments or the lack of payments

Review other sources as appropriate such as AMS history and/or Accurint.

Complete Form 4844, Request for Terminal Action, to request input of the BMF identity theft codes and forward to DITA team located as follows:

The BMF identity theft indicator is input to the MFT and Tax Period affected by the identity theft and will post to TXMOD and BMFOLT. See examples of completed Forms 4844 at Exhibit 5.1.28-3. and Exhibit 5.1.28-4. Complete the applicable blocks of Form 4844, including:

If the taxpayer alleged identity theft, but internal research cannot substantiate the claim and the taxpayer has not provided the requested claim, then complete Form 4844 to request input of TC 972 AC 522 with the tax administration source code NORPLY in the miscellaneous field with the BOD and program name.

If you determine identity theft is not a factor in the case, then complete Form 4844 to request TC 972 AC 522 with the tax administration source code NOIDT in the miscellaneous field with the BOD and program name.

If you determine the original identity theft claim was received fraudulently, then complete Form 4844 to request input of TC 972 AC 522 with the tax administration source code FALSE in the miscellaneous field with the BOD and program name.

Enter the secondary date of the TC 971 AC 522 being reversed.

When it is confirmed BMF identity theft occurred and the appropriate transaction codes have been requested, follow the steps in this table to address any refund(s) issued:

If you have determined the EIN is fictitious and was established for the sole purpose of defrauding the government through the filing of individual and business false refund returns or income documents, see IRM 5.1.28.17(2), Form 14566, BMF Identity Theft Referral, below.

If the balance due is the result of an IRS-CAWR or SSA-CAWR assessment (for more information on assessment identification, see IRM 5.1.15.7, Combined Annual Wage Reconciliation (CAWR) Adjustment), then prepare Form 3870, Request for Adjustment, to request abatement of the TC 290 assessment. Attach all information supporting the determination including IDRS research and forward the findings to the CAWR unit using the state mapping guide in Exhibit 5.1.15-3, State Mapping for IRS-CAWR and SSA-CAWR.

See the example below for suggested wording to write in Item 11 of Form 3870.

If the balance due on a BMF return involving identity theft is the result of an SFR assessment with a TC 300, then prepare Form 3870, Request for Adjustment, to request abatement of TC 300.

When it is confirmed that BMF identity theft occurred, the appropriate transaction codes have been requested and the balance dues are for a business operated by a third-party who established the business using a stolen SSN, first consult with Area Counsel.

If, with Counsel's concurrence, the unpaid liabilities are to be moved to a new EIN, then secure a new EIN for the third-party by preparing a “dummy” Form SS-4, Application for Employer Identification Number, and faxing it to the Cincinnati Accounts Management Campus at ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡. This fax number is for Internal Use Only.

Include your name, position, fax, phone number, and any special instructions on the fax cover sheet.

Prepare Form 12810, Account Transfer Request Checklist, to transfer the assessment to the new EIN and forward to DITA per contact information at IRM 5.1.28.14.1(1).

Proceed with collection.

In a case involving a BMF refund for a refundable credit where identity theft has been confirmed, and the TC 971 AC 522 requested, take the appropriate actions in this table:

If the EIN on the return is determined to be fictitious, see IRM 5.1.28.17(2) below.