The nation’s top tax watchdog, the Treasury Inspector General for Tax Administration (TIGTA), recently issued a report claiming that between August 12, 2023, and April 16, 2024, fraudsters tried to fraudulently file 4,828 tax returns in an attempt to steal $462 million in refunds. Of those claims, the IRS detected and stopped 4,254 bad claims—fraudsters were still able to file 574 improper returns claiming more than $47 million.
The worst part? Fraudsters were able to access the information using the Practitioner Priority Service (PPS), a hotline set up for tax professionals.
Background
Tax professionals often have to reach out to the IRS on behalf of taxpayers. If you’ve ever called the IRS, you know that getting through to a real person can be challenging. Since tax professionals may require a different level of service—like obtaining transcripts or asking for a hold on collections activities—the IRS offers a dedicated telephone line for practitioners. That line, referred to as PPS, is staffed with assistors who are typically trained to address more challenging and technical requests for information.
When tax professionals call the IRS, they must prove that they are authorized to speak to the IRS about not only a specific taxpayer, but also certain forms and years related to that taxpayer. It’s not enough, for example, for me to call the IRS and say that I’m calling about John Smith. I have to prove that I’m authorized to talk about John Smith’s Form 1040 for the years 2021 and 2022.
The most common way that tax professionals prove that they have the authority to talk to the IRS is through filing Form 2848, Power of Attorney and Declaration of Representative, signed by both the taxpayer and the tax professional. Form 2848 includes a tax professional’s Centralized Authorization File (CAF) number and other identifying information like a Preparer Tax Identification Number (PTIN). Any tax professional who prepares or helps prepare any federal tax return or claim for a refund and receives compensation must have a valid PTIN from the IRS—they are preparer-specific (you’re not allowed to share). Other forms, including Form 8821, Tax Information Authorization, may also be filed.
Forms 2848 are typically uploaded through the IRS Tax Professional system at IRS.gov, faxed over, or occasionally mailed to the CAF unit. When you submit Form 2848 for the first time, the CAF unit assigns you the CAF number—a unique nine-digit identifying number. Like the PTIN, the CAF number is used by the tax practitioner on all authorizations, but unlike the PTIN, there is no annual renewal.
Tax Professional Calls
When you call the PPS, as a tax professional, you must be prepared to walk through Form 2848 to demonstrate that you’re authorized to talk to the IRS. Often, the purpose of the call is to pull a tax transcript for one or more years. You can generally do this through the Tax Pros system, but it can take time for the CAF unit to approve your request. In a time-sensitive situation, like addressing a collections issue, a tax professional can request the transcript over the phone through PPS.
Years ago, when you requested a transcript, the IRS would fax it to you. Now, transcripts are sent to an online Secure Object Repository (SOR) mailbox—tax professionals can access their SOR mailbox online.
If you don’t have or can’t access your SOR mailbox, the IRS can mail the transcript.
Tax professionals can request up to 30 records per taxpayer for up to five taxpayers per call to the PPS telephone line. That may seem like a lot, but it’s common for taxpayers to have issues with multiple years, which means that their tax professional will need to review several years of activity.
The Fraudulent Refund Scheme
The IRS maintains a Cybersecurity Fraud and Analytics (CFAM) group dedicated to detecting and preventing identity theft and other tax-related frauds. In May of 2023, the CFAM group discovered an
impersonation scheme involving fraudsters who were calling PPRS and requesting taxpayer information. In response, CFAM immediately notified TIGTA and IRS Criminal Investigation (CI). As a result, they determined that fraudsters had used at least 22 compromised CAF numbers, impacting approximately 6,900 taxpayers.
Using those CAF numbers, the fraudsters obtained tax records and filed tax returns in an attempt to claim approximately $66 million in fraudulent refunds. Nearly 85% of those claims were blocked—but roughly $10 million in refunds were processed and delivered.
Around that time, the IRS started promoting the Tax Professional Online Account (Tax Pro Account) to allow tax professionals access to taxpayers’ account information. The Tax Pro Account (which I highly recommend for tax professionals) allows verified tax professionals to log in, upload Forms 2848 and requests for information, and view taxpayer information online. To access your Tax Pro Account, you have to sign up and be verified. Once you’re verified, you must log in using secure credentials and a third-party authentication system every time you sign in.
According to the TIGTA report, the IRS needed to act faster to strengthen those protocols. As a result of the extra time, the IRS reported that fraudsters were able to claim additional fraudulent refunds. Specifically, from August 12, 2023, to April 16, 2024, the government identified that fraudsters filed 4,828 tax returns claiming nearly $462 million in refunds. Of the 574 tax returns that were able to get through the system, fraudsters obtained refunds totaling more than $47 million (that works out to over $81,000 per return).
Even more concerning, as of April 16, 2024, the government identified 376 mailbox IDs being used by fraudsters. While the IRS took steps to restrict access to those IDs, TIGTA reports that access for 30 of them was not restricted.
Protections In Place
On September 15, 2023, the IRS issued guidance to its PPS assistors focused on reporting suspicious activity. Additionally, according to TIGTA, PPS assistors were required to check the status of the CAF number to confirm that the tax practitioner was in good standing with the IRS.
TIGTA says these additional protections for over-the-phone requests weren’t implemented quickly enough. Specifically, TIGTA found that the IRS was “slow to stop the PPS fraud despite other IRS functional areas identifying this fraud as far back as August 2021.” On February 8, 2024, in response to what it perceived to be inaction from IRS management, TIGTA issued an alert to request the IRS’s plan to immediately stop the fraud. It wasn’t until much later—April 8, 2024—that the IRS moved to require additional authentication controls.
Moving Forward
TIGTA reports that as of April 8, 2024, the IRS has trained all PPS employees to use increased protocols to prevent theft. Additionally, TIGTA made several recommendations to address these issues—IRS management agreed with three of the four recommendations and partially agreed with one. The outstanding recommendation involved shutting down 17 potentially compromised tax professional mailboxes—the IRS says it reviewed those accounts and found no evidence of fraud. Since those accounts can only be accessed with new protocols, the IRS did not shut them down.
The IRS has to find a balance, and while taking a beat to prevent fraud may be desirable, tax professionals need immediate access to taxpayer accounts to assist them. Notices to lien or levy accounts, for example, are time-sensitive, and requiring long wait times can put taxpayers at risk of wage or account garnishment. This is especially true at a time when the IRS has placed an increased emphasis on collections.
For its part, IRS says it will continue to monitor its systems and take corrective action when needed.
Read the full article here
