Stolen identity refund fraud

What it is

A thief gets hold of a real person’s Social Security number, often someone unlikely to notice quickly: a child, a deceased relative, someone incarcerated, or simply someone who always files late. Early in the next filing season, before the real taxpayer has filed anything, the thief submits a tax return in that person’s name, invents or inflates income and withholding to produce a refund, and has the money sent somewhere only they control: a prepaid debit card, a bank account opened in the stolen name, or a mailing address they have arranged to receive.

The IRS pays most refunds before it has independently verified the return against third-party income records, because those records, from employers and banks, are not required to reach the agency until March 31, weeks after filing season opens in mid-January. That gap is the entire scheme.

This is not a small-time tactic. One ring led by a single Texas man sought $110 million in fraudulent refunds over three years. A separate, unrelated scheme used 3,493 stolen identities to open bank accounts across 443 financial institutions. The government’s own watchdog estimated the IRS paid out $3.1 billion in fraudulent identity-theft refunds in a single recent filing season, after preventing a further $22.5 billion.

How it actually works

1. The identity gets stolen

   A data breach, a purchased list, a stolen mailbox, or in one documented case, stolen professional credentials that let the thief access many taxpayers’ records at once. The best targets are people unlikely to file a return themselves any time soon.

2. Filing first, before the real taxpayer does

   The thief files electronically as early as possible in the season, with invented or inflated income and withholding figures calculated to produce a refund rather than a bill.

   Where it could have stopped

   A taxpayer enrolled in the IRS’s Identity Protection PIN program stops this at the door. An IP PIN is a six-digit number known only to the taxpayer and the IRS; without it, the IRS will not accept an e-filed return bearing that Social Security number from anyone else. The program is opt-in for most taxpayers, which is exactly why it only works for people who signed up before the thief filed.

3. Taking over the paper trail

   In the largest case on this page, the ringleader used stolen Centralized Authorization File (CAF) numbers to pose as the real taxpayers’ own authorized representatives, then changed the address and email the IRS had on file so the agency’s correspondence, including identity-verification letters, went to an address he controlled instead of reaching the real taxpayer.

4. Routing the refund somewhere the thief controls

   Refunds were split across prepaid debit cards registered in the stolen names, or sent to bank accounts opened with the same stolen identities, 3,493 of them in one documented scheme.

5. Passing the IRS’s own verification

   When the IRS flags a return and mails an identity-verification letter, the fraudster who has already redirected that mail photographs it, destroys the original, and impersonates the taxpayer to answer the verification questions and release the refund anyway.

6. Laundering the money out

   Cash is pulled out as money orders kept deliberately under the dollar amounts that would trigger currency-reporting or identification requirements, then spent directly or moved through domestic accounts and on to accounts abroad.

7. The real taxpayer finds out last

   Months later, the actual person tries to file their own return and it is rejected as a duplicate, or they receive an IRS notice about income, a refund or an online account they never had anything to do with.

Why it works

The IRS pays first and checks later. Filing season opens in mid-January, but employers and banks do not have to submit the W-2 and 1099 records that would let the IRS cross-check a return until March 31. A return filed in the first few weeks of the season is checked against almost nothing.

The best targets never file quickly enough to catch it. A deceased relative, a young child, someone incarcerated, or anyone who habitually files late is unlikely to notice a fraudulent return has already used their Social Security number until long after the refund is gone.

Stolen professional access multiplies the damage. A stolen CAF number does not just unlock one taxpayer’s file, it unlocks every client that preparer was ever authorized to represent, which is why the largest documented case on this page reached hundreds of victims from a single point of compromise.

The paper trail itself can be hijacked. Once a thief controls the address and email the IRS has on file, the agency’s own fraud-detection correspondence, the identity-verification letters meant to catch exactly this, is delivered straight to the person committing the fraud.

Laundering hides in ordinary financial instruments. Prepaid debit cards and money orders are designed for people without full banking access, which makes them unremarkable individually and easy to split a large fraudulent refund across without tripping a single reporting threshold.

Where it comes from

Overwhelmingly domestic conspiracies, often with international money movement once the refund is out.

These are organised, multi-person rings, not lone actors. The Texas case on this page sentenced seven people across different roles: the leader, people who received redirected mail, and people who structured the cash out. The Brooklyn case described co-conspirators operating in the United States, Ghana, Nigeria and Ireland.

Enforcement is criminal and federal. The Justice Department’s Tax Division and IRS Criminal Investigation prosecute these cases as wire fraud, mail fraud, conspiracy and aggravated identity theft, not as a civil consumer-protection matter, and sentences on this page run from 18 months to more than 14 years.

The government’s own numbers describe a persistent, large-scale problem. The GAO added identity-theft refund fraud to its high-risk list for federal tax enforcement in 2015, after the IRS itself estimated paying out $3.1 billion in a single recent filing season while preventing a further $22.5 billion, numbers that have never been fully measured because, as the GAO’s own reporting puts it, the full extent of this fraud is inherently difficult to detect.

Real cases

Red flags

• Your e-filed tax return is rejected as a duplicate, the single clearest sign someone already filed using your Social Security number.
• A W-2 or 1099 arrives from an employer you never worked for.
• An unexpected IRS notice about income, a refund, or an online account you never had anything to do with, including a CP2000 notice about unreported income.
• Your Social Security Administration earnings statement shows wages you never earned.
• You receive a password reset or login alert for an IRS Online Account you never created.
• Someone claims your dependent on their own return before you file.
• You are the parent of a young child, the family of someone recently deceased, or someone who has been incarcerated, the profiles this scheme’s documented cases targeted specifically because they are unlikely to file soon.

If it’s happening to you

1. Try to file your real return anyway. If it is rejected as a duplicate, that confirms a fraudulent return has already used your Social Security number.
2. Get an Identity Protection PIN through your IRS Online Account or Form 15227 if you do not already have one, both to resolve the current fraud and to stop it happening again next year.
3. File Form 14039, the Identity Theft Affidavit, only if the IRS has not already sent you a letter or notice about it and you have not already reported it through IdentityTheft.gov.
4. Follow the recovery steps at IdentityTheft.gov, and keep a record of every letter, call and notice from the IRS; recovery can take months.
5. Request a copy of the fraudulent return with Form 4506-F if you need to see exactly what was filed in your name.
6. Check your Social Security earnings statement for wages you never earned, a sign your number was also used for employment fraud, not only a refund claim.
7. Report it. See where to report for agencies outside the United States.

Where the money goes

Out of the US Treasury first, through financial instruments built for people without full banking access, and often abroad from there.

The refund itself comes from the IRS, which is why the most immediate financial victim in every documented case on this page is the government, not the person whose identity was stolen. From there it moves onto a prepaid debit card or into a bank account opened in the stolen name, instruments that do not require the thief to pass the same verification a traditional bank account would. Cash comes back out as money orders kept under reporting thresholds, a form of structuring, before being spent directly on ordinary goods, cars, home renovations, or moved through domestic accounts and on to accounts in other countries.

That is also why the cases on this page took years to prosecute and sentence: the money passes through several hands and several financial instruments before anyone outside the ring can trace it back to a single return filed under a stolen name.

By the numbers

No published dataset breaks this scheme out as its own category yet, so there is no chart to show. The data page explains which agency categories exist and why some schemes are invisible in official statistics.