Internal Revenue Manual
IRM 25.23.13 — Income Related Identity Theft
Part 25. Special Topics
Chapter 23. Identity Protection and Victim Assistance Section 13. Income Related Identity Theft 25.23.13 Income Related Identity Theft Manual Transmittal September 04, 2025 Purpose (1) This transmits revised IRM 25.23.13, Identity Protection and Victim Assistance, Income Related Identity Theft. Material Changes (1) IRM 25.23.13.1.3 Update title from Responsibilities to Roles and Responsibilities. (2) IRM 25.23.13.1.3(2) (3) Added paragraph 2 to include the oversight responsibility for the Director of Accounts management. Added paragraph (3) for compliance of procedures by managers and leads. Subsequent paragraphs to be renumbered. (3) IRM 25.23.13.1.4 Added new subsection for Program Management and Review. (4) IRM 25.23.13.1.5 Added new subsection for Program Controls. Subsequent sections renumbered. (5) IRM 25.23.13.1.6 Updated subsection name from Acronyms to Terms and Acronyms. (6) IRM 25.23.13.1.7 Updated subsection name from Related Resources and Tools to Related Resources (7) IRM 25.23.13.2(4) Added to row #3 of the "If/Then" chart to include the AUR process code 26. (8) IRM 25.23.13.2(4) If/Then (2)(3) Updates to the AUR process codes for the referral to specialty or to work case. IPU 25U3424 issued 06-23-2025 (9) IRM 25.23.13.2.1(2) Added the income document WARNING - POTENTIAL FRAUDULENT PAYER TIN or WARNING - POTENTIAL FRAUDULENT SUBMISSION. IPU 25U3424 issued 06-23-2025 (10) IRM 25.23.13.2.1(3) Added note to clarify a Compliance assessment is considered Tax-related IDT. IPU 25U3424 issued 06-23-2025 (11) IRM 25.23.13.2.1(5) Clarified the actions when INVALID or TIN Perfected income is present and there is other Income ID Theft. IPU 25U3424 issued 06-23-2025 (12) IRM 25.23.13.2.1(5) Added note after IF/Then chart for procedures if there is other income determined to be IDT and has INVALID or TIN Perfected income. IPU 24U1098 issued 11-01-2024 (13) IRM 25.23.13.2.1(5) If/Then chart(6) Added procedures for accounts marked with TC 971 AC 525. IPU 25U3384 issued 06-06-2025 (14) IRM 25.23.13.2.1(5) Added to the If/Then chart in row #7 to address a scenario in which the taxpayer is a victim of potential fraudulent income-related identity theft. (15) IRM 25.23.13.2.1(7) Added table for working IDT3 cases and determining if taxpayer is a victim of income ID Theft. Subsequent paragraphs renumbered. IPU 25U3384 issued 06-06-2025 (16) IRM 25.23.13.2.1(7) IF/Then chart (3)(4) added the links to IRMs for the description for INVALID and TIN Perfected IRPTR documents. Added note after IF/Then chart for procedures if there is other income determined to be IDT and has INVALID or TIN Perfected income. IPU 24U1098 issued 11-01-2024 (17) IRM 25.23.13.2.1(8) Clarified the actions when INVALID or TIN Perfected income is present and there is other Income ID Theft. IPU 25U3424 issued 06-23-2025 (18) IRM 25.23.13.2.1(8) Added IDT3 clarification. IPU 25U3384 issued 06-06-2025 (19) IRM 25.23.13.2.1(8) Removed from entire table lead/ managerial concurrence requirement. IPU 25U3384 issued 06-06-2025 (20) IRM 25.23.13.2.1(8)(2) Added IRM link to the new IRM for prisoner ID Theft. (21) IRM 25.23.13.2.1(8) (3) Added to IF/Then chart IDT3 not affecting tax administration and a duplicate filing condition. Subsequent paragraphs renumbered. IPU 25U3384 issued 06-06-2025 (22) IRM 25.23.13.2.1(8) Added to the If/Then chart in row #7 to address a scenario in which the taxpayer is a victim of potential fraudulent income-related identity theft. Subsequent paragraphs renumbered. (23) IRM 25.23.13.2.1.2 Added new subsection Accounts with Fabricated Wage Income. IPU 25U3424 issued 06-23-2025 (24) IRM 25.23.13.3(3) Note Updated the xClaim tool to the xMend Tool. IPU 24U1098 issued 11-01-2024 (25) IRM 25.23.13.3(5) Added procedures for when there is a TC 971 AC 527 present on the account. IPU 25U3384 issued 06-06-2025 (26) IRM 25.23.13.3(7) Removed EMPL as a closing code for TC 971 AC 504 and remove the situations requiring a manual letter. IPU 25U3384 issued 06-06-2025 (27) IRM 25.23.13.3(7) Clarified a Letter 4674C letter to be sent. IPU 25U3424 issued 06-23-2025 (28) IRM 25.23.13.3(9) Reminder clarified the date used when creating additional impacted years. IPU 25U3424 issued 06-23-2025 (29) IRM 25.23.13.3(10) Added Reminder to Not send a Form 9409 for INVALID income on IRPTR. IPU 25U3424 issued 06-23-2025 (30) IRM 25.23.13.3(11) Removed the paragraph "u" requirement and added link to the required special paragraph located in IRM 25.23.4-25(4) Example 3. IPU 25U0266 issued 02-25-2025 (31) IRM 25.23.13 Various Editorial updates. IPU 25U3424 issued 06-23-2025, and IPU 25U3384 issued 06-06-2025 Effect on Other Documents IRM 25.23.13, Income Related Identity Theft, dated 09-04-2024 effective 10-01-2024, is superseded. The following IPU's have been added: IPU 24U1098 issued 11-01-2024 IPU 25U0266 issued 02-25-2025 IPU 25U3384 issued 06-06-2025 IPU 25U3424 issued 06-23-2025 Audience The provisions in this manual apply to all divisions, functions units, employees, and contractors within the IRS working identity theft cases. Effective Date (10-01-2025) LuCinda Comegys, Director, Accounts Management Taxpayer Services Division
Program Scope and Objectives
25.23.13.1 (10-01-2022) Program Scope and Objectives Purpose: This manual provides case procedures specific to income related identity theft. In 2022, Taxpayer Services (TS) Accounts Management separated income related identity theft from existing tax-related and non-tax related identity theft procedures. The creation of this new IRM has been done in effort to define specific case processing guidelines for income related identity theft. Audience: The provisions in this manual apply to all divisions, functions units, employees, and contractors within the IRS working identity theft (IDT) cases. Policy Owner: The owner of the policies contained herein is the Director, Accounts Management. Program Owner: The Director of Accounts Management is the program owner. Primary Stakeholders: The primary stakeholders are organizations that Accounts Management collaborates with; Return Integrity & Compliance Services (RICS), Compliance and Submission Processing. Program Goals: The development of short-term and long-term remedies to protect taxpayer information and make the experience of those who are already victims faster and more efficient. The development of Servicewide policy, procedures, and guidelines for the priority of recognizing, marking and acknowledging individual taxpayer claims involving identity theft. Support of Identity Protection Strategy and Oversight (IPSO) activities within the scope of programs associated with identity protection.
Background
25.23.13.1.1 (10-01-2022) Background Employees in the Identity Theft Victim Assistance (IDTVA) organization process Income Related Identity Theft (IDT) claims and respond to IDT victims.
Authority
25.23.13.1.2 (10-01-2024) Authority Refer to IRM 1.2.1.13, Servicewide Policies and Authorities, Policy Statements for Customer Account Services Activities, for information. The Taxpayer Advocate Service is an independent organization within the Internal Revenue Service (IRS), led by the National Taxpayer Advocate, that helps taxpayers and protects taxpayer rights. TAS offers free help to taxpayers when a tax problem is causing a financial difficulty, when they've tried and been unable to resolve their issue with the IRS, or when they believe an IRS system, process, or procedure just isn't working as it should. TAS strives to ensure that every taxpayer is treated fairly and knows and understands their rights under the Taxpayer Bill of Rights. TAS has at least one taxpayer advocate office located in every state, the District of Columbia, and Puerto Rico. The Taxpayer Bill of Rights (TBOR) lists rights that already existed in the tax code, putting them in simple language and grouping them into 10 fundamental rights. Employees are responsible for being familiar with and acting in accord with taxpayer rights. See IRC 7803(a)(3), Execution of Duties in Accord with Taxpayer Rights. For additional information about the TBOR, see https://www.irs.gov/taxpayer-bill-of-rights. Policy Statement 10-1, Assisting Taxpayers who Report they are Victims of Identity Theft. See IRM 1.2.1.17, Servicewide Policies and Authorities, Policy Statements for Security, Privacy and Assurance Activities.
Roles and Responsibilities
25.23.13.1.3 (10-01-2025) Roles and Responsibilities The Taxpayer Services Commissioner has overall responsibility for the policy related to this IRM which is published on a yearly basis. The Director of Accounts Management has oversight responsibility for the instructions to employees contained in the IRM content. Managers and leads ensure compliance with the guidance and procedures in this IRM. Additional information is found in IRM 1.1.13.6.3, Accounts Management, and IRM 21.1.1, Accounts Management and Compliance Services Overview.
Program Management and Review
25.23.13.1.4 (10-01-2025) Program Management and Review Program Reports - For reports concerning quality, inventory, aged listing, refer to IRM 1.4.16, Accounts Management Guide for Managers. To ensure work is resolved timely and inventory reports reflect the correct data, each AM campus MUST download the Case Control Activity (CCA) 4243, IDRS Overage Report, and CCA 4244, IDRS Multiple Case Control Report, from Control-D WebAccess (CTDWA). Program Effectiveness: Program Effectiveness is measured and controlled through: Managerial Reviews Quality Reviews Program Reviews
Program Controls
25.23.13.1.5 (10-01-2025) Program Controls Goals, measures and operating guidelines are provided in the yearly Program Letter. Quality data and guidelines for measurement is referenced in IRM 21.10.1, Embedded Quality (EQ) Program for Accounts Management, Campus Compliance, Field Assistance, Tax Exempt/Government Entities, Return Integrity and Compliance Services (RICS) and Electronic Products and Services Support.
Terms and Acronyms
25.23.13.1.6 (10-01-2025) Terms and Acronyms For a comprehensive listing of any IRS acronyms, please refer to the Acronym Database. The following acronyms will be used throughout this IRM: Acronym Definition AC Action Code ACSS Automated Collection System Support AM Accounts Management AMS Accounts Management System ASED Assessment Statute Expiration Date ASFR Automated Substitute for Return AUR Automated Underreporter BMF Business Master File BS Blocking Series CC Command Code CCA Complete Case Analysis CEAS Correspondence Examination Automation Support CII Correspondence Imaging Inventory CN Common Number CRN Credit Reference Number CSCO Compliance Services Collection Operations DoD Date of death HC Hold Code IAT Integrated Automated Tools IDRS Integrated Data Retrieval System IDT Identity Theft IDTVA Identity Theft Victim Assistance IDTVA-A Identity Theft Victim Assistance Accounts Management IPSU Identity Protection Specialized Unit IR Information Return IRS Internal Revenue Service IRSN Internal Revenue Service Number ITIN Individual Taxpayer Identification Number NKI No Known Impact OAR Operations Assistance Request OSINV Oscar Inventory PC Process Code RC Reason Code RGS Report Generation Software RICS Return Integrity and Compliance Services RPM Return Preparer Misconduct SFR Substitute for Return SNOD Statutory Notice of Deficiency SP Submission Processing SSA Social Security Administration SSN Social Security Number TAS Taxpayer Advocate Service TC Transaction Code TCIS Treasury Check Information System TIN Taxpayer Identification Number TPP Taxpayer Protection Program TS Taxpayer Services U/R Underreported
Related Resources
25.23.13.1.7 (10-01-2025) Related Resources Refer to IRM 1.4.2.1.8, Related Resources, for information on related resources that impact internal controls. The following resources contain information and job aides that can assist in case processing: Document 6209, IRS Processing Codes and Information Accounts Management Research Portal - Identity Theft SERP IDTVA Hub The following systemic tools may be utilized to perform research or to process the work performed by IDTVA. This list is not all inclusive: Account Management Services (AMS) Accurint ACSweb Automated Substitute for Return (ASFR) System Automated Underreporter (AUR) System Integrated Automation Technologies (IAT) Integrated Data Retrieval System (IDRS) Correspondence Examination Automation Support (CEAS) Correspondence Imaging Inventory (CII) Report Generation Software (RGS) Treasury Check Information System (TCIS) In addition to the IRM 25.23, the following IRMs may be utilized for processing work. This list is not all inclusive: IRM 1.2.1.2.36, Policy Statement 1-236 (Rev 1), Fairness and Integrity in Enforcement Selection IRM 2.3, IDRS Terminal Responses IRM 2.4, IDRS Terminal Input IRM 3, Submission Processing IRM 4, Examination Process IRM 5, Collecting Process IRM 20.1, Penalty Handbook IRM 21, Customer Account Services IRM 25, Special Topics IRM 25.23.1, Identity Protection and Victim Assistance - Policy Guidance IRM 25.23.2, Identity Protection and Victim Assistance - General Case Processing IRM 25.23.3, IMF Non-Tax-Related IDT and Specialized Programs IRM 25.23.4, IDTVA Paper Process IRM 25.23.9, Business Master File (BMF) Identity Theft Processing IRM 25.23.10, Compliance Identity Theft Case Processing IRM 25.23.11, Business Master File (BMF) Identity Theft Procedures for Accounts Management IRM 25.23.12, IMF Identity Theft Toll-Free Guidance IRM 25.24.1, Return Preparer Misconduct Victim Assistance - General Overview IRM 25.24.2, Return Preparer Misconduct Victim Assistance Specialized Accounts Management Processing
Income Related Identity Theft - General
25.23.13.2 (06-23-2025) Income Related Identity Theft - General Income related identity theft (IDT) occurs when a taxpayer's TIN is used by someone else for income reporting purposes. Income related IDT is the intentional misuse of a taxpayer's TIN to obtain employment. However, it can also include use of someone else's TIN to claim gambling winnings, receive unemployment benefits, or report any other type of income the TIN owner is unaware of (i.e., sale of assets, cancellation of debt, etc.). Income related IDT is considered non-tax-related because it does not impact the taxpayer's tax account. However, income related IDT will be treated as tax-related when tax administration is impacted. There must be an assessment or refund issue on the taxpayer's account to be considered tax-related. Income related IDT has the potential to negatively impact the taxpayer if left unresolved. Review the list below for examples of common tax administration issues due to income related IDT. Automated Underreporter (AUR) - Identified by a TC 922 with or without a TC 290 with an increase to tax and/or a decrease to credits. Automated Substitute for Return (ASFR) - TC 971 AC 143, TC 150 for .00 SFR followed by a TC 290 assessment (posted or pending), and/or TC 494/495. Exam Substitute for Return (SFR) - Identified by a TC 150 for .00 SFR and/or TC 420/421. Delinquent Return Refund Hold - The refund hold module will be identified by the presence of a TC 971 AC 130, TC 570 with Julian date 999, RF displayed on IDRS on the module of the refund year, and a -R Freeze. The delinquent return module will have a TC 140 or TC 474. IDTVA-A employees that are not trained to work specialty cases will refer the case to the appropriate IDTVA Specialty Function, see the chart below to determine if you will work or refer the case: If Then 1) ACS Refer the case to specialty by following IRM 25.23.4-5(11), IDTVA Routing Matrix 2) There is an AUR TC 922 with process code 03, 9 - 18, 21 - 25, 27-29, 44 - 48, 51, 52, 65, 70 - 74, 76, 80, or 91 - 93. Work the case 3) There is an AUR TC 922 with process code 06, 20, 26, 30, 34, 37, 39, 54, 55, 57 - 60, 67, 69, 75, 77, 81, 87 - 90, 94, 95, 97, or 98. Refer the case to specialty by following IRM 25.23.4-5(11), IDTVA Routing Matrix 4) ASFR Refer the case to specialty by following IRM 25.23.4-5(11), IDTVA Routing Matrix 5) Exam Refer the case to specialty by following IRM 25.23.4-5(11), IDTVA Routing Matrix 6) Delinquent Return Refund Hold Refer the case to specialty by following IRM 25.23.4-5(11), IDTVA Routing Matrix
Income Related Identity Theft - Determinations
25.23.13.2.1 (10-01-2025) Income Related Identity Theft - Determinations It is necessary to research and consider all information available when reviewing accounts potentially impacted by income related IDT. Incomplete research can result in the taxpayer continuing to be negatively impacted by IDT or the incorrect removal of income. Prior to making a determination, consider the following while you conduct research: For the year in question, was the occupation consistent with the taxpayer's age (e.g., a minor child working as a truck driver)? Do all income documents available on CC IRPTR have the taxpayer's correct name (e.g., spelling, last name, or entirely different name)? Do any income documents available on CC IRPTR reflect an address for the taxpayer that does not match the valid taxpayer's current address or address history (e.g., different street address in the same city or different cities/states)? Is the income reported on CC IRPTR consistent with the taxpayer's employment history (e.g., same employer, history of only retirement income, etc.)? Is the location of the employer consistent with the taxpayer's employment history? Is the IRPTR income document flagged as an INVALID or TIN Perfected? Is the IRPTR income document flagged as WARNING - POTENTIAL FRAUDULENT PAYER TIN or WARNING - POTENTIAL FRAUDULENT SUBMISSION? Reminder: Complete Case Analysis (CCA) is required on all identity theft cases potentially impacting tax administration. See IRM 25.23.4.6.4, Complete Case Analysis (CCA), for more information. Refer to the table below for common scenarios to help you determine if the income related IDT issue will be resolved as tax-related IDT or non-tax-related IDT. Tax-Related Scenarios Non-Tax-Related Scenarios AUR assessment that includes income not earned by the taxpayer (TC 922 with a TC 290 assessment) ASFR assessment that includes income not earned by the taxpayer (TC 150 SFR with a TC 290 assessment) Exam SFR assessment that includes income not earned by the taxpayer (TC 150 SFR with a TC 300 assessment) Exam assessment and/or reduction of credits based on income not earned by the taxpayer (TC 420/424 with a TC 300 assessment) Refund Hold due to an unfiled return related to a filing requirement based on income not earned by the taxpayer (See IRM 25.12.1.2(5), How to Identify Delinquent Return Refund Hold) CP 2000 issued but no AUR assessment (TC 922, but no TC 290 assessment) ASFR notice but no assessment (TC 971 AC 143, but no TC 150 SFR/TC 290 assessment) Exam SFR notice(s) but no assessment (TC 150 SFR but not TC 300 assessment) Income earned by someone other than the taxpayer identified through CCA (with or without Compliance involvement) Note: Accounts containing a Compliance assessment will be considered Tax-Related Identity Theft. Note: This table may not include all scenarios. All income related IDT cases will be controlled on IDRS to the affected tax period. Ensure all CII case data is correct, including updating the category code, MFT, and tax year on the CII case. See IRM 25.23.4.3.1, CII and IDRS Case Controls, for additional guidance. When a Form 14039, Identity Theft Affidavit, police report, or correspondence is received, complete all required research, and use the table below to determine if the taxpayer is a victim of income related IDT. Note: When the claim is for the current year, income information may not be available on CC IRPTR before June 1. If working a current year case before June 1, accept the taxpayer's claim when the income information cannot be confirmed. Note: Except for wages, not all income is required to be reported to the IRS; therefore, some income documents may not be available on CC IRPTR. Accept the taxpayer's claim when the income information cannot be confirmed other than wages (e.g. NEC, MERC, etc.). If And Then 1) The taxpayer specifies what income they did/did not earn, or provides a general statement (i.e., I only worked in Texas.) or there is no explanation of the identity theft issue Research supports the taxpayer's claim The taxpayer is a victim of Income Related IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts 2) The taxpayer specifies what income they did/did not earn, or provides a general statement (i.e., I only worked in Texas.), or there is no explanation of the identity theft issue Research does not support the taxpayer's claim See IRM 25.23.4.10.9, No Identity Theft (NOIDT) Determinations Note: For Specialty cases, refer to the appropriate functional guidelines in IRM 25.23.10, Compliance Identity Theft Case Processing, for additional instructions 3) The taxpayer specifies what income they did/did not earn, or provides a general statement (i.e., I only worked in Texas.), or there is no explanation of the identity theft issue Research does not support the taxpayer's claim and you do not have enough information to complete the required research to make a determination See IRM 25.23.4.18.2, Requests for Additional Information (Telephone and/or Written) (4) Income in question is identified as INVALID Caution: In this situation INVALID refers to a TIN DESCRIPTION as seen in IRM 2.3.35-19. Payee online Transcript Document Display Screen: W-2 (DOC CODE 21) and not a determination of IDT. There is no other income determined to be IDT This is not considered Income Related IDT because SSA has already deemed this as invalid income. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts 5) Income in question is identified as TIN perfected as seen in IRM 2.3.35-19. Payee online Transcript Document Display Screen: W-2 (DOC CODE 21) Note: The IRPTR document Payee Entity Data line will state "Valid Perfected SSN". There is no other income determined to be IDT This is not considered Income Related IDT because this is caused by an IRS error. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts 6) If there is a TC 971 AC 525 on the same year as the income related issue The income issue is non- tax related Consider the income issue resolved. Follow the procedures in IRM 25.23.3.2.3.1.1 Non-Tax-Related Identity Theft - IDT4 Determination and Closing Actions. 7) If there is an wage document with WARNING - POTENTIAL FRAUDULENT PAYER TIN or WARNING - POTENTIAL FRAUDULENT SUBMISSION N/A Follow IRM 25.23.13.2.1.2, Accounts with Fabricated Wage Income Note: In situations where INVALID or TIN Perfected income is present and there is other income determined to be IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts. Caution: Due to the inclusion of ID Theft income not identified as INVALID or TIN Perfected, follow IRM 25.23.13.3(6) or (7), Closing Income Related Identity Theft Accounts, as appropriate. Note: If all the income documents in question are TIN Perfected and INVALID follow the procedures for the INVALID Income. Employees trained to work IDTVA Specialty cases, refer to the appropriate functional guidelines in IRM 25.23.10, Compliance Identity Theft Case Processing, for additional instructions. When working IDT3 cases, complete all required research, and use the table below to determine if the taxpayer is a victim of income related IDT. If Then 1) Income documents available on CC IRPTR reflect an address for the taxpayer that does not match the valid taxpayer's current address or address history (e.g., different cities/states) The taxpayer is a victim of Income Related IDT. See paragraph (8) below 2) The income reported on CC IRPTR or the employer's location is not consistent with the taxpayer's employment history (e.g., same employer, history of only retirement income, etc.) The taxpayer is a victim of Income Related IDT. See paragraph (8) below 3) The occupation is not consistent with the taxpayer's age (e.g., a minor child working as a truck driver) The taxpayer is a victim of Income Related IDT. See paragraph (8) below 4) If the scenarios above do not apply An IRS identified Income Related determination cannot be made. Continue to resolve the case following normal procedures to address the amended return or duplicate filing condition. See IRM 25.23.4.6.1 Required Research 5) The IRPTR income document is flagged as an INVALID or TIN Perfected The taxpayer is a victim of Income Related IDT. See paragraph (3) below for INVALID indicators or (4) for TIN Perfected income If the income related IDT issue is IRS identified (IDT3), and there is clear and convincing evidence to support making a determination, take the following actions: IF And Then (1) You have determined the taxpayer is a victim of income related IDT affecting tax administration N/A Document the research you have completed in a CII case note Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (2) You have determined the taxpayer is a victim of income related IDT NOT affecting tax administration You have determined the taxpayer is a prisoner And There are unemployment Form 1099-G documents on IRPTR for any tax year the taxpayer was incarcerated for the entirety of the calendar year. Reminder: CC FTBOLP can be used to verify incarceration dates with data received and compiled from correctional institutions in the United States. Also see IRM 25.23.4.6.2(6)(20) IDTVA- Additional Research and Required Actions and IRM 25.23.4.6.1.1, Researching Accounts for Incarcerated Individuals (Prisoners). Document all research you have completed in a CII case note Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (3) You have determined the taxpayer is a victim of income related IDT NOT affecting tax administration The IDT3 was created for an Amended Return or a duplicate filing condition AND The income related issues were discovered through Complete Case Analysis Do Not send to ITVA HQ Document all research you have completed in a CII case note .Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (4) Discovered an income related issue and IRPTR shows the document as INVALID Caution: In this situation INVALID refers to a TIN DESCRIPTION as seen in IRM 2.3.35-19, Payee online Transcript Document Display Screen: W-2 (DOC CODE 21) and not a determination of IDT. There is no other income determined to be IDT Do Not send to ITVA HQ Document all research you have completed in a CII case note Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (5) Income in question is identified as TIN perfected IRM 2.3.35-19, Payee online Transcript Document Display Screen: W-2 (DOC CODE 21) Note: The IRPTR document Payee Entity Data line will state "Valid Perfected SSN". There is no other income determined to be IDT This is not considered Income Related IDT because this is caused by an IRS error. Document all research you have completed in a CII case note Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (6) Cases with Duplicate Filing Notice CP 36I, 36N, 36P, 36U, 36V present on CC TXMOD that were converted in error to IDT. N/A Do Not send to ITVA HQ Document all research you have completed in a CII case note Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts 7) If there is an wage document with WARNING - POTENTIAL FRAUDULENT PAYER TIN or WARNING - POTENTIAL FRAUDULENT SUBMISSION N/A Follow IRM 25.23.13.2.1.2, Accounts with Fabricated Wage Income (8) You have determined the taxpayer is a victim of income related IDT NOT affecting tax administration and does not meet any scenarios above N/A Prepare and email Form 4442, Inquiry Referral, using subject line: IDT3 need closing procedures (or similar) to ITVA HQ Document all research completed in a CII case note and/or on the Form 4442 Attach Form 4442 to your CII case Suspend case awaiting a response from ITVA HQ. Upon, receipt the account will be research. A response on how to address the account will be received within 7 business days Note: If there are multiple years with income ID Theft notate all years in Section B of the Form 4442. Do NOT send multiple 4442s Note: In situations where INVALID or TIN Perfected income is present and there is other income determined to be IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts. Caution: Due to the inclusion of ID Theft income not identified as INVALID or TIN Perfected, follow IRM 25.23.13.3(6) or (7), Closing Income Related Identity Theft Accounts, as appropriate. Note: If all the income documents in question are TIN Perfected and INVALID follow the procedures for the INVALID Income.
Income Related Identity Theft (IDT) Involving an EIN/Business
25.23.13.2.1.1 (12-01-2023) Income Related Identity Theft (IDT) Involving an EIN/Business A taxpayer may report an identity theft issue when: They suspect an EIN/business account (i.e. Form 1099-K, Payment Card and Third Party Network Transactions) has been obtained in their name, They have an EIN and someone else filed a tax return under the EIN, or They have an EIN/business account and someone reported a payment made to the EIN which they did not receive. Consider the taxpayer's statement, and conduct research. Your research path may include: IDRS CCs TRDBV, RTVUE, and/or IMFOLR to research the taxpayer's filing history. IDRS CC IRPTR to research the taxpayer's income history. INOLES for entity and cross reference information. CII for other open cases and/or cases previously closed. AMS for history items which may provide additional details about the identity theft issue. Applicable Specialty systems. After completing all required research, use the table below to address income related identity theft claims involving an EIN: IF And Then (1) The taxpayer is claiming to have no affiliation with the business/EIN on Form 14039 Or has submitted a Form 14039-B Follow IRM 25.23.2.4.3(8), Tracking Individual Taxpayers Reporting to be Victims of Business-Related Identity Theft Resolve all IMF IDT issues Leave a CII case note detailing research completed and the referral to BMF (2) The EIN (active or inactive)/business belongs to the taxpayer The taxpayer states: A line a credit was opened without their knowledge, They did not receive some or all of the income reported as MERCH, NEC, Other Income, etc. And Research supports the taxpayer's claim Follow IRM 25.23.13.3, Closing Income Related Identity Theft Accounts (3) The EIN/business belongs to the taxpayer Research does not support the taxpayer's claim And You do have enough information to complete the required research to make a determination Follow IRM 25.23.4.10.9, NO Identity Theft (NOIDT) Determination (4) The EIN/business belongs to the taxpayer Research does not support the taxpayer's claim, And You do not have enough information to complete the required research to make a determination Follow IRM 25.23.4.18.2, Request for Additional (Telephone and/or Written) 5) None of the scenarios above apply with EIN/business involvement Prepare and email Form 4442 using subject line: Income Related involving an EIN/Business (or similar) to ITVA HQ Document all research completed in CII case note and/or on the Form 4442 Attach Form 4442 to your CII case Suspend case awaiting a response from ITVA HQ. Upon, receipt the account will be researched. A response on how to address the account will be received within 7 business days
Accounts with Fabricated Wage Income
25.23.13.2.1.2 (10-01-2025) Accounts with Fabricated Wage Income When BMF/RICS has determined an EIN to be Fabricated they will mark all associated W-2s with WARNING - POTENTIAL FRAUDULENT PAYER TIN or WARNING - POTENTIAL FRAUDULENT SUBMISSION. Research is required for these W-2s to determine if the potential fraudulent income is valid or invalid. Use the list below to assist in the determination of income related IDT of potential fraudulent W-2s. If Then 1) Income documents available on CC IRPTR reflect an address for the taxpayer that does not match the valid taxpayer's current address or address history (e.g., different cities/states) Income is determined to Not belong to the taxpayer. IRM 25.23.13.2.1.2Go to table (3) or (4) as applicable 2) The income reported on CC IRPTR or the employer's location is not consistent with the taxpayer's employment history (e.g., different employer, history of only retirement income, etc.) Income is determined to Not belong to the taxpayer. Go to table (3) or (4) as applicable. 3) The occupation is not consistent with the taxpayer's age (e.g., a minor child working as a truck driver) Income is determined to Not belong to the taxpayer. Go to table (3) or (4) as applicable. 4) The income is listed on a valid tax return and you can determine, using CCA, the taxpayer has consistently filed returns with this employer. Prepare and email Form 4442 using subject line: Income Related involving Fraudulent W-2 (or similar) to ITVA HQ When a Form 14039, Identity Theft Affidavit, police report, or correspondence is received, complete all required research, and use the table below to determine if the taxpayer is a victim of income related IDT. If And Then There is return filed with the Fraudulent Income only Research supports the taxpayer's claim The taxpayer is a victim of Tax-Related Income Related IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts and IRM 25.23.13.3(6) for indicator and letter requirements. Complete a Form 9409, IRS/SSA Wage Worksheet. There is a return filed with the taxpayer's valid income only and Fraudulent Income is on IRPTR found during CCA N/A The taxpayer is a victim of Non-Tax-Related Income Related IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts and IRM 25.23.13.3(7) for indicator and letter requirements. Complete a Form 9409, IRS/SSA Wage Worksheet. When working IDT3 cases, complete all required research, and use the table below to determine if the treatment of the income related IDT. If And Then 1) You have determined the taxpayer is a victim of income related IDT affecting tax administration There is a return filed with the income found on IRPTR marked as Fraudulent. The taxpayer is a victim of Tax-Related Income Related IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts and IRM 25.23.13.3(8) for indicator and letter requirements. Complete a Form 9409, IRS/SSA Wage Worksheet 2) You have determined the taxpayer is a victim of income related IDT NOT affecting tax administration There is no return filed and income found on IRPTR marked as Fraudulent. The taxpayer is a victim of Non-Tax-Related Income Related IDT. Follow closing procedures in IRM 25.23.13.3, Closing Income Related Identity Theft Accounts. Complete a Form 9409, IRS/SSA Wage Worksheet. 3) There is a return filed with the Fraudulent W-2, and Research determined the income is the taxpayer's valid income There is indication of other Income Related ID theft not related to the Fraudulent W-2s. The taxpayer is a victim of Tax-Related Income Related IDT. Follow closing procedures in, IRM 25.23.13.3 Closing Income Related Identity Theft Accounts. Prepare and email Form 4442 using subject line: Income Related involving Fraudulent W-2 (or similar) to ITVA HQ. 4) There is return filed with the Fraudulent W-2, and Research determined the income is the taxpayers valid income There is no other indication of ID Theft Continue to resolve the case following normal procedures to address the amended return or duplicate filing condition. See IRM 25.23.4.6.1, Required Research. Prepare and email Form 4442 using subject line: Income Related involving Fraudulent W-2 (or similar) to ITVA HQ
Closing Income Related Identity Theft Accounts
25.23.13.3 (06-23-2025) Closing Income Related Identity Theft Accounts Use the following procedures to resolve accounts determined to be impacted by income related IDT only. If needed, update the taxpayer's entity information. See IRM 25.23.2.3.7, When to Update the Victim's Address, for additional guidance. Note: If the Form 14039, Identity Theft Affidavit is for a dependent child, determine if an entity needs to be established for the dependent in question. See IRM 3.13.5.117, Establishing a New Account (TC 000), for more information. A Form 14039 signed by a parent on behalf of their dependent child never requires documentary evidence such as court order or legal documentation. Note: If the TP is deceased, update the entity information as applicable. See IRM 21.6.6.2.21.1, Updating the Entity on Decedent Accounts. For letter requirements related to decedent accounts, see IRM 25.23.4.18.1, General IDTVA Letter Procedures. Input TC 290 .00 with BS 05, RC 139, and HC 3. If there is a credit that should not be refunded, use HC 4. Exception: TC 290 .00 with RC 139 is not required on a module when any of the following conditions exist: • If there is no TC 150 • If no tax module exists • The module is in retention (unless reversing a tax offset will create a balance due or it is necessary to resolve the taxpayer issue to make the taxpayer whole) • When an impacted module is not active on IDRS CC TXMOD and is not yet in retention. Do not input IDRS CC MFREQ Note: Use of the xMEND tool to input the TC 290 .00 will prevent unnecessary modules from being made active with IDRS CC MFREQ. Document in a CII case note each source of income determined to be the result of IDT individually. Clearly identify the IDT income with the reported dollar amount when there are multiple income documents for the same company (i.e., two Forms W-2) reporting different amounts. See IRM 25.23.2.3.4, Required Case and History Notes. Exception: When all income on CC IRPTR is determined not to belong to the valid taxpayer, a CII case note indicating all income is invalid is acceptable. Exception: When the AMS Fill tool is used to prepare Form 9409, IRS/SSA Wage Worksheet, a case history containing information for all income being removed is automatically populated on AMS. A CII case note indicating Forms 9409 were completed is required; however, documentation detailing each income item removed is not necessary when it has been populated in an AMS history item. Include language "see AMS for the payer information" , or similar verbiage. If Form 9409 is created for a secondary TIN, document AMS under that TIN. If there is a TC 971 AC 527 present on the account, See IRM 25.23.2.8.6.1.1 Resolving Tax-Related Accounts with TC 971 AC 527 if a tax-related determination was made or IRM 25.23.2.8.6.1.2 Resolving Non-Tax-Related Affected Accounts with TC 971 AC 527 if a non-tax-related determination was made. When you have determined the taxpayer is a victim of income related IDT affecting tax administration (tax-related), use a closing TC 971 AC 501 INCOME upon completion of all account actions when a Form 14039 or police report has been received and any of the following conditions exist on the module in question: Income earned by someone other than the valid taxpayer has resulted in a subsequent AUR or Exam assessment Income earned by someone other than the valid taxpayer has resulted in an ASFR, Exam SFR, unfiled return, or refund hold issue See IRM 25.23.2.6.1, Closing Taxpayer Initiated Identity Theft Affecting Tax Administration - TC 971 AC 501, for additional information. If applicable, issue a Letter 4674C, see IRM 25.23.4.18.1(18), General IDTVA Letter Procedures for more information. Exception: For additional impacted years identified through CCA, follow procedures in paragraph (9) below. When you have determined the taxpayer is a victim of income related IDT not affecting tax administration (non-tax-related), update CII data to category code IDT4. Exception: Do not update the category code when: It is an IDI case There is an invalid return Input a closing TC 971 AC 504 upon completion of all account actions when a Form 14039 or police report has been received. Note: For additional impacted years identified through CCA, follow procedures in paragraph (8) below. Use Miscellaneous Field EMPL-M. Use of EMPL-M requires a manual Letter 4674C to be sent. See IRM 25.23.2.8.1.1, TC 971 AC 504 with Miscellaneous Field Codes ACCT, ACCT-M, BOTH, BOTH-M, EMPL, EMPL-M, NKI or NKI-M, for additional information. Note: If unemployment is an issue, also see IRM 25.23.13.3, Closing Income Related Identity Theft Accounts(12) . When you have determined the taxpayer is a victim of income related IDT affecting tax administration (tax-related) and the case is IRS identified (a Form 14039 or police report has not been received - IDT3), use a closing TC 971 AC 506 and issue a closing Letter 4674C, Identity Theft Post-Adjustment Victim Notification Letter, upon completion of all account actions. When you have determined the taxpayer is a victim of income related IDT through CCA and a Form 14039 or police report has been received, use the table below to determine how to mark each additional impacted year: If Then 1) The additional impacted year is tax-related ID Theft Input a TC 971 AC 501 "ICMCCA" 2) The additional impacted year is non-tax-related ID Theft Input a TC 971 AC 504 "ICMCCA" Reminder: Create CII cases for additional impacted years identified through complete case analysis (CCA), see IRM 25.23.4.3.1, CII and IDRS Case Controls, for more information. Example: The taxpayer receives a CP 2000 for tax year 2020 from Automated Underreporter for underreported wage income from SYZ Company. The case is an AUR recon case, and the account has already been assessed for the taxes due on the income. The taxpayer submits Form 14039, listing TY 2020 as the impacted year and states they did not work for that company, someone must be using their SSN to work. A determination is made that the taxpayer is a victim of income related IDT, and through CCA, it is discovered that someone is continuing to work for SYZ Company using the CN owner's SSN for tax years 2021 and 2022, but no AUR notices were issued for either year. Due to an AUR assessment occurring on the 2020 module, this is considered tax-related and would be closed with a TC 971 AC 501 "INCOME" . Since the 2021 and 2022 modules are impacted by identity theft but it has not yet affected their tax account and identified through CCA, this would be treated as non-tax-related IDT and would be closed with a TC 971 AC 504 "ICMCCA" input on tax years 2021 and 2022. If all the income is identified on IRPTR as INVALID complete the following actions: If taxpayer identified input a TC 971 AC 504 NKI-M and send a 4402C if there is only 1 year identified or a TC 971 AC 504 NKI-M if there multiple years involved and send a 4674C letter If IRS identified input a TC 971 AC 506 OTHER for all tax years affected and send 4674C letter Reminder: Do not complete a Form 9409 for wage income identified as INVALID on IRPTR. If all the income is identified on IRPTR as TIN Perfected complete the following actions based on the table below. IF Then The income related issue is taxpayer identified Follow procedures in IRM 25.23.4.10.9(2), No Identity Theft (NOIDT) Determinations The income related issue is IRS identified Follow procedures in IRM 25.23.4.10.9(3), No Identity Theft (NOIDT) Determinations The case IRS Identified or taxpayer identified and a TC 922 is on the TXMOD Follow procedures in IRM 25.23.10.6.3.2.(2), Income Related Identity Theft with AUR Involvement If unemployment compensation benefits are an issue, send Letter 4674C with an open paragraph. Use the following special paragraph (or similar language): "The IRS received third-party information reporting that an unemployment compensation claim may have been filed in your name without your knowledge. If you haven't done so, report this issue to your employer and the state unemployment agency where the claim was filed." When closing the case with TC 971 AC 504 also include the special paragraph from IRM 25.23.4-25(4) Example 3, Closing Letter Paragraph Selections. If the income in question is wage income, complete Form 9409, IRS/SSA Wages Worksheet, unless the taxpayer has provided a Social Security Administration determination letter addressing the income. See IRM 25.23.13.3.1, Form 9409 Procedures - IRS/SSA Wage Worksheet, for specific instructions. Address any modules without returns filed by the CN owner. Refer to IRM 25.23.4.17, Determining Tax Liability/Form 2209 Instructions, for specific procedures. Determine whether the account will be in a balance due status after adjustment action posts. If TC 470 CC 90 was input, TC 472 must also be input when the valid taxpayer will have a balance owed. Take action to resume collection activity when appropriate. Refer to IRM 25.23.4.12.3, Collection Activity - Resume Collection Actions, for guidance. When the account has unresolved TDI issues, see IRM 25.23.2.6.5, Closing Identity Theft Cases with Tax Delinquency Inquiries (TDI), for additional information. If there is a Delinquent Return Refund Hold issue, see IRM 25.23.10.4.2.1, Refund Hold Program, for specific instructions.
Form 9409 Procedures - IRS/SSA Wage Worksheet
25.23.13.3.1 (01-31-2023) Form 9409 Procedures - IRS/SSA Wage Worksheet When a social security number is used by someone other than the SSN owner for employment purposes, SSA must be notified to correct the earnings record for that SSN. While reviewing an IDT claim, verify the IRP data. When income is incorrectly reported under an SSN, Form 9409, IRS/SSA Wage Worksheet, must be completed and sent to the SSA. Note: The Form 9409 must be completed any time you identify, during your research, any wage income on IRP docs that should not be reported under the valid taxpayer's SSN (The SSN Owner). This should be done for any type of identity theft (non-tax-related or tax-related). Note: Complete the Form 9409 based on who was paid the wages (primary or secondary). If the impacted taxpayer is the secondary taxpayer, ensure all history items are recorded under their TIN. Example: TY 2014 account contains TC 150 and TC 976 returns. The returns contain addresses from different states. An Invalid/Valid determination is made. Each return contains income that is verifiable. The TC 150 return will be moved to an IRSN and Forms 9409 will need to be completed for the Forms W-2 associated with the invalid return. Complete Form 9409only for wage income containing Social Security Wages. Do not complete Form 9409 when: The SSN has been TIN perfected. (These will be rejected by SSA) CC IRPTR indicates the income is INVALID The income is reported under an ITIN (that begins with "9" ) The employer indicates that the information has been corrected with SSA (Form W-2C, Statement of Corrected Income and Tax Amounts) The taxpayer has provided an SSA determination letter IRPTR data is no longer available A Form 9409 was previously completed for the income in question Wages are reported beyond one year of the Date of Death (DoD) Note: Wages reported prior to the DoD must still be addressed even if the ID theft is identified after the taxpayer's DoD. Caution: When completing Form 9409, input the amount as a whole dollar figure. If necessary, round the income to the nearest whole dollar amount (i.e., $54,661.82 would be entered as $54,662.00). Make sure the form is complete (with special attention to Section B) indicating why the form is being sent to the SSA. This will prevent the form from being rejected and causing additional delays to our customers. If you have determined the valid taxpayer earned only a portion of the income on the wage document shown on CC IRPTR, and the amount reported is due to an act of fraud or IDT, complete Form 9409. In Section B, select Box 6, and input the amount the taxpayer reported for the wage amount. If allowing the wages on the ITIN holders return, prepare Form 9409, IRS/SSA Wage Worksheet, (for the SSN) to remove the information from the true SSN owner's account. Prepare a Form 3210, Document Transmittal, and include the following information: Sender's full name, SEID, Stop Number, Mailing Address, Fax/EE-Fax Number and Phone Number Individually list each taxpayer's last four digits of their SSN, their name control, and the CII case ID Include a count of how many Forms 9409 are being sent for each SSN listed Tax period(s) of the Forms 9409 In the remarks area include the total number of Forms 9409 that are being sent ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ Note: Retain a copy of the entire package being sent until the SSA has acknowledged receipt of the package by returning a copy of the Form 3210. Caution: Do not suspend the case waiting for a reply from SSA. Note: Document CII and/or AMS to show that Form 9409 was mailed to SSA and which income documents were removed. Exception: When the AMS Fill tool is used to prepare Form 9409, a case history containing information for all income being removed is automatically populated on AMS. A CII case note indicating Forms 9409 were completed is required; however, documentation detailing each income item removed is not necessary when it has been populated in an AMS history item. Include language "see AMS for the payer information" , or similar verbiage. If Form 9409 is created for a secondary TIN, document AMS under that TIN. Note: Upon receipt of the Form 3210 from the SSA, document AMS with "3210- SSA Received XX/XX/XXXX." Retain the Form 3210 for one year as required in Document 12990, IRS Records Control Schedule (RCS) 29, Item 91. If after 60 days the Social Security Administration has not acknowledged receipt of the Forms 9409 by returning a copy of the Form 3210, resubmit them. Document AMS with the re-submission of the Forms 9409. If the Forms 9409 and Form 3210 were resubmitted and the Social Security Administration has not acknowledged receipt, document the Form 3210 with" No Response from SSA" (or similar). Do not submit the same documents more than two times. If a Form 9409 was prepared and submitted to the SSA in error, take the following actions: Fill in the taxpayer's identifying information (SSN, Name, Address, etc.) Complete Section A, with the same amounts used on the erroneously prepared Form 9409 Check the corrected box in the upper right-hand portion of the form Note: Do not check any of the boxes in section B. Complete the bottom portion of the form and submit the form as outlined in paragraphs (6) and (7) Document CII and/or AMS to show that a corrected Form 9409 was mailed to SSA and which income documents were revised
Source: official text