Employment-Related Identity Fraud: Improved Collaboration and Other Actions Would Help IRS and SSA Address Risks

Employment-related identity fraud poses risks to IRS's ability to collect taxes owed on wages and to SSA's ability to correctly calculate and manage Social Security benefits.

GAO was asked to review employment-related identity fraud. This report examines (1) the potential scope of employment-related identity fraud, including what IRS knows about this type of fraud and what GAO could determine by analyzing Department of Health and Human Services' National Directory of New Hires (NDNH) and IRS data; (2) SSA and IRS actions to detect and deter this fraud as well as notify victims; and (3) SSA and IRS's collaboration on the issue.

GAO analyzed 3 months of 2016 NDNH wage data and 2016 IRS taxpayer data to identify potential employment-related identity fraud. GAO also reviewed relevant IRS and SSA documentation and interviewed agency officials.

This is a public version of a sensitive report that GAO issued in January 2020. Information that SSA deemed sensitive has been omitted.

Employment-related identity fraud occurs when people use a name or Social Security number (SSN) other than their own to get a job. People may do this if they are not authorized to work in the United States or are trying to avoid child support payments, among other reasons. Victims may face Internal Revenue Service (IRS) enforcement actions based on wages earned by fraudsters. IRS identified more than 818,000 cases in 2018, but this included only one form of employment-related identity fraud—mismatches between the identity listed on the Form W-2, Wage and Tax Statement (W-2) and the identity on the tax return. The true scope of employment-related identity fraud is unknown.

GAO reviewed additional forms of this fraud and identified 1.3 million SSNs that for 2016 had both (1) characteristics associated with employment-related identity fraud; and (2) wages reported by the employer on a W-2, but not reported by the employee on a tax return. This includes about 9,000 individuals whose employers reported W-2s in five or more states, but who did not include them all on their tax return (see figure).

The Social Security Administration (SSA) processes W-2s before sending W-2 data to IRS for enforcement purposes. SSA has developed processes to detect some inaccurate W-2s and notify potential fraud victims. IRS uses W-2 information to deter some potential fraudsters, but has not assessed the costs and benefits of expanding its enforcement efforts to include certain individuals who may underwithhold taxes or not file returns. Doing so could help IRS determine if such an effort would enable the agency to collect additional revenue.

SSA and IRS entered into a memorandum of understanding (MOU) to collaborate to exchange wage data. However, they have not established performance goals and measures for the MOU, implemented the MOU's monitoring provisions, or clearly defined the data elements they exchange.

GAO is making 12 recommendations to IRS and SSA, including that IRS assess the feasibility of adding checks to its review of employment-related identity fraud, and assess the costs and benefits of expanding enforcement; and that both agencies improve the implementation of their MOU. SSA agreed and IRS neither agreed nor disagreed with the recommendations.

Employment-related identity fraud occurs when people use a name or  Social Security number (SSN) other than their own to get a job.  Individuals may commit employment-related identity fraud for a variety of  reasons, including because they are not authorized to work in the United  States, are trying to avoid child support payments, or are trying to conceal  a criminal record that makes them ineligible for certain employment.

This type of fraud poses risks to the Social Security Administration’s  (SSA) ability to correctly calculate and manage benefit payments for  programs such as Social Security retirement and Supplemental Security  Income. It can also lead the Internal Revenue Service (IRS) to incorrectly  determine that some individuals failed to report wages and owe taxes.  IRS may expend enforcement resources following up with these  individuals, only to find that they are victims of employment-related  identity fraud.

Employment-related identity fraud can also hurt victims whose names and  SSNs are used by others to gain employment. Victims risk being held  liable by IRS for unpaid taxes on wages earned by fraudsters, receiving  reduced benefit payments from some federal programs, or facing  challenges planning for retirement if identity fraud wages are credited to  their master earnings records. Further, it can be burdensome for victims  to notify IRS and SSA of fraudulent wages, particularly if victims’ identities  are repeatedly used to commit fraud. Victims may also be at risk of other  types of fraud if fraudsters use their identities for other purposes, such as  applying for credit.

Although federal agencies have attempted to identify limited instances of  employment-related identity fraud, the full scope of employment-related  identity fraud or its impact on the tax system remains unknown. In 2016,  the Treasury Inspector General for Tax Administration (TIGTA) reported  that IRS identified almost 1.1 million taxpayers whose names and SSNs  were used by employment-related identity fraudsters to obtain jobs  between 2011 and 2015. Some fraudsters might obtain employment  using combinations of names and SSNs that do not belong to a specific  individual listed in SSA’s records. In 2013, the SSA Office of the Inspector  General (OIG) reported that 100 employers submitted more than 2.3  million Forms W-2, Wage and Tax Statement (W-2) where the  employee’s name and SSN did not match SSA records; some of these W- 2s may be fraudulent.

You asked us to examine the impacts of employment-related identity  fraud. This report examines (1) the potential scope of employment-related  identity fraud, including what IRS knows about this type of fraud and what  we could determine by analyzing the Department of Health and Human  Services’ National Directory of New Hires (NDNH) and IRS data; (2) SSA  actions to detect and deter this fraud as well as notify victims; (3) IRS  actions to detect and deter this fraud as well as notify victims; and (4) the  extent to which SSA and IRS are collaborating to address the issue.

This report is a public version of a sensitive report that we issued in  January 2020. SSA deemed some of the information in our January  report as sensitive, which must be protected from public disclosure.  Therefore, this report omits sensitive information about SSA’s controls for  detecting potential employment-related identity fraud. Although the  information provided in this report is more limited, the report addresses  the same objectives as the sensitive report and uses the same  methodology.

To describe and analyze the potential scope of employment-related  identity fraud, we identified wage records associated with individuals at  risk of identity theft. Specifically, we reviewed relevant TIGTA, SSA OIG,  Federal Trade Commission, and our work on SSN misuse to identify  characteristics of groups that may be at risk of SSN misuse. To do this,  we used SSA’s full death file; SSA’s Numerical Index File (Numident),  SSA’s master file of all assigned SSNs; and a 3-month extract of NDNH  data to identify SSNs that appeared to belong to individuals who were  deceased, elderly (over 84), or children (under 14) or who had three or  more wage records between August and October 2016, the oldest data  available at the time of our review that aligned with IRS data.

Focusing on these groups of SSNs, we used IRS data to determine the  number of SSNs at risk of employment-related identity fraud and possible  tax compliance issues. Specifically, we identified SSNs with a wage listed  on one or more employer-submitted W-2 that was not reported to IRS on  a tax return by the taxpayer. Last, we used tax return data to analyze  selected tax characteristics of both groups of individuals we identified as  having indicators of employment-related identity fraud as well as those we  did not. For example, we analyzed data on wage withholding rates, the  prevalence of select IRS identity theft indicators on taxpayers’ accounts,  and IRS enforcement actions taken against these individuals.

We assessed the reliability of the SSA full death file, SSA Numident, the  Department of Health and Human Services’ NDNH quarterly wage data,  and select elements of IRS’s Compliance Data Warehouse by reviewing  relevant documentation, interviewing knowledgeable agency officials, and  performing electronic testing to determine the validity of specific data  elements in the data. We determined that the data elements used in our  analysis were sufficiently reliable for the purpose of our work.

To assess SSA and IRS actions to detect and deter employment-related  identity fraud as well as notify victims, we reviewed relevant  documentation including IRS’s Internal Revenue Manual and SSA’s  Policy Operations Manual System and also interviewed knowledgeable  agency officials. We compared IRS’s and SSA’s efforts to relevant  Standards for Internal Control in the Federal Government. We also  assessed the agencies’ efforts against IRS’s and SSA’s respective  strategic plans as well as select leading practices to combat fraud, as  identified in the Framework for Managing Fraud Risks in Federal  Programs.

To evaluate the extent to which SSA and IRS are effectively collaborating  to address the issue, we reviewed relevant agency documents, such as  IRS and SSA’s main information sharing agreement, other IRS-SSA legal  agreements, meeting minutes from IRS-SSA joint meetings, and policy  manuals. We interviewed knowledgeable officials from IRS and SSA, as  well as agency officials from the Federal Trade Commission, which  assists victims and collects statistics on identity theft. We also interviewed  officials at the Department of Homeland Security (DHS) because it helps  employers verify the identities of employees. We assessed IRS and  SSA’s collaboration efforts against leading practices we previously  identified for collaboration. Specifically, we identified key elements of  each leading practice and assessed the extent to which SSA and IRS  collaboration on employment-related identity fraud aligned with leading  practices. For a more detailed discussion of our scope and methodology,  see appendix I.

The performance audit upon which this report is based was conducted  from November 2017 to January 2020 in accordance with generally  accepted government auditing standards. Those standards require that  we plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives. We worked with SSA from October 2019 to May 2020 to  prepare this public version of the original sensitive report for public  release. This public version was also prepared in accordance with these  standards.

Individual Taxpayer Identification Number  (ITIN)  An ITIN is a tax processing number issued by  IRS to individuals who are required to have a  U.S. taxpayer identification number but who  do not have and are not eligible to obtain a  Social Security number from the Social  Security Administration.  IRS issues ITINs to help individuals comply  with the U.S. tax laws, and to provide a  means to efficiently process and account for  tax returns and payments for those not  eligible for Social Security numbers.

Taxpayers may first realize they are victims of employment-related  identity fraud when IRS notifies them of discrepancies in the reporting of  income earned using their names and SSNs. After filing deadlines have  passed, IRS’s Nonfiler and Automated Underreporter (AUR) programs  use W-2 information to identify and follow up with taxpayers who appear  to owe taxes but either have not filed returns (Nonfiler) or have filed  returns but underreported earnings (AUR). Other taxpayers may become  aware that their SSNs were used by other people when IRS sends them  an Employment-Related Identity Theft (CP01E) notice. IRS sends these  notices to taxpayers whose SSNs appear on W-2s that have been  attached to tax returns (Forms 1040, U.S. Individual Income Tax Return)  that were filed with Individual Taxpayer Identification Numbers (ITIN) (see  sidebar). In these cases, IRS marks the taxpayer accounts with an  employment-related identity theft indicator. Victims may also notice  wages they did not earn appearing on their Social Security earnings  record or may be alerted by SSA that their Supplemental Security Income  benefits are being reduced or eliminated because of wages earned by  someone else using their SSN.

Information Exchanges Involved in Employment- Related Identity Fraud

The following individuals and agencies are involved in verifying  individuals’ eligibility for employment, in processing wage information, or  in monitoring identity fraud cases.

Employer: Employers are required to complete the Form I-9,  Employment Eligibility Verification for new hires. As part of  completing the form, employers certify that they have examined  documentation demonstrating that new hires are who they say they  are, are eligible for employment, and that the documentation appears  to be genuine. The employer is required to submit a W-2 to each  employee as well as SSA by January 31 each year.

Employee: As part of obtaining employment, the employee provides  the employer with documentation to authenticate his or her identity. It  is at this point that the employee could provide someone else’s SSN  or other information.

DHS: DHS manages E-Verify, a free, internet-based system that  employers can use to verify employees’ employment eligibility. SSA  supports DHS in this effort. Federal agencies are required to use E- Verify for federal employees and contractors. Some states also  require employers to use E-Verify to verify the eligibility of some or all  employees or contracts. According to DHS, by the end of fiscal year  2019, more than 890,000 employers were enrolled in E-Verify.

SSA: SSA receives W-2s from employers and uses this information to  update earnings records and to make determinations about benefits.  After receiving and processing W-2s, SSA sends the W-2 information  to IRS as part of the Combined Annual Wage Reporting (CAWR)  process. SSA also maintains the Social Security Number Verification  Service, a free SSN verification program that registered employers  can use to verify that employee names and SSNs match SSA’s  records before they submit W-2s to SSA.

IRS: IRS uses W-2 information to verify tax return information, such  as wages, withholdings, and Employer Identification Numbers (EIN),  and to enforce tax law. IRS has legal authority to penalize  employers $250 for each inaccurate W-2 they submit up to a  maximum of $3 million in total penalties per year. In 2013, the SSA  OIG reported that IRS does not routinely penalize employers who  consistently submit erroneous or inaccurate wage information.

Federal Trade Commission: It collects and reports to the public  aggregated data from self-reported victims of identity fraud. Victims  can visit www.IdentityTheft.gov to report identity theft and access  resources.

A Million SSNs May Be at Risk of Employment-Related Identity Fraud and Tax Noncompliance, but the Extent of Such Fraud Is Unknown

Our analysis shows that millions of SSNs in NDNH data exhibited risk  characteristics associated with employment-related identity fraud in tax  year 2016. More than a million of those were also at risk of not meeting all  IRS tax return requirements, such as reporting all associated W-2s.  However, IRS did not identify all of those noncompliant returns. Further,  employment-related identity fraud can diminish tax revenues. IRS’s  method for tracking employment-related identity fraud likely understates  the extent of the problem.

More Than 2.9 Million SSNs in NDNH Data Had Risk Characteristics in Tax Year 2016

We identified more than 2.9 million SSNs that had risk characteristics  associated with SSN misuse, and had evidence of employment activity  based on our analysis of NDNH verified quarterly wage records for 122.8  million individuals from August to October 2016. The risk characteristics  included:  Individuals who had wages reported for three or more employers in  the same quarter;  Individuals who were deceased;  Individuals under age 14; and  Individuals over age 84 (see table 1).

We previously reported that the existence of three or more wage records  in the same time frame for the same individual indicates possible SSN  misuse, which could include employment-related identity fraud. We also  previously reported, along with the Department of Justice and SSA OIG,  that deceased persons, children, and elderly populations are at risk of  identity theft (IDT). Fraudsters may target these groups because they  believe there is a lower chance the SSNs are being used for legitimate  employment.

Individuals with three or more employers within the same  quarter. Our analysis of NDNH data identified millions of SSNs with  three or more wage records from August to October 2016.  Specifically, of the 122.8 million SSNs included in the data, we found  2.8 million with three or more wage records in the same quarter.  Further, we found almost 10,000 of those SSNs had wages reported  by 10 or more employers in the same quarter. It is not uncommon for  individuals to have second jobs or to change employers. However,  when wages are reported by three or more employers for the same  calendar quarter, it can indicate potential misuse of an SSN (see table  2).

As an illustrative example of potential SSN misuse, one SSN had wages  reported by 15 employers from 14 different states for a 3-month period in  2016 (see figure 1). According to the wage data, on average, each of  these employers was paying the employee approximately $26,900 a year.

Deceased individuals. We identified several thousand SSNs for  deceased individuals included in the NDNH data. Specifically, the  NDNH data August-October 2016 showed 13,600 SSNs for  individuals SSA identified as deceased prior to May 2016. Of these,  8,400 are reported to have died before 2014. In some cases, we  found individuals who had been deceased for a decade.

Children. We identified tens of thousands of SSNs for children under  the age of 14. Specifically, NDNH data included 33,856 SSNs of  individuals who, according to SSA data, were under the age of 14 with  earned income reported. One reason children can be at risk of long- term victimization of employment-related identity fraud is because it  usually takes children a while before they start working or applying for  financial credit. This gives a fraudster ample opportunity to exploit  their stolen identities. Still, there are legitimate circumstances for  children to be earning wages, such as in the entertainment and  advertising industries.

Elderly. We identified tens of thousands of wage records from elderly  individuals. Specifically, the 2016 NDNH data included 65,823 SSNs  with earned income reported that SSA data identified as being over  84. The Federal Trade Commission reported that in 2016,  approximately one-fifth of IDT complaints they received involved  people age 60 years or older. Further, the elderly have low  participation rates in the workforce. The Bureau of Labor Statistics  reported that, in 2016, the workforce participation rate for those ages  75 and above was 8.4 percent, compared to a rate of 62.8 percent for  the overall workforce.

Over a Million SSNs with Risk Characteristics Were Also Associated with Tax Compliance Issues for 2016, Not All of Which Were Pursued by IRS

Some SSNs with risk characteristics were sometimes also associated  with IRS returns that did not include required W-2 forms. Specifically,  more than 1.3 million individuals—of the 2.9 million SSNs we determined  to have risk characteristics associated with SSN misuse—had at least  one wage record they did not report to IRS. Of these 1.3 million  individuals, more than half failed to include at least one W-2 on their tax  return, and slightly less than half (43 percent) did not include any W-2s in  a tax return (see table 3).

IRS has enforcement tools that are intended to detect reporting  deficiencies, but these tools did not always detect the reporting issues we  identified. IRS can use Automated Underreporter (AUR) and the Nonfiler,  as well as seven IDT-related indicators to mark a taxpayer’s account or  W-2 if it has determined that the SSN was compromised (see sidebar).  We compared data from these enforcement tools and IDT indicators to  the 1.3 million individuals identified above and found that IRS did not  mark all accounts or W-2s.

Action Code 501: closed identity theft  cases initiated by a taxpayer.   Action Code 506: closed identity theft  cases initiated by IRS.    Action Code 524: deceased taxpayer. It  prevents the use of a deceased  taxpayer's identity on a federal income  tax return.    Action Code 525: mismatch between the  identity listed on the W-2 and on the tax  return. These are cases where returns  filed with an Individual Taxpayer  Identification Number include a W-2 with  an SSN belonging to another person.

Individuals with three or more W-2s for the same period. More  than a million individuals with three or more wage records did not  declare at least one W-2. Additionally, we found that, in general, the  more W-2s an individual had, the less likely it was that all of them  would be reported to IRS (see figure 2). For instance, individuals with  three W-2s declared all of them 68 percent of time, while individuals  with seven declared all of them 29 percent of the time.

Using its enforcement tools, IRS identified some of these individuals with  three or more W-2s. Of the 1.25 million individuals in our analysis with  three or more wage records who did not include all W-2s in tax year 2016,  about 600,000 had wages totaling more than $23,200, meaning that they  were required to file a tax return. Of these, about 340,000 individuals  had at least one of the seven IDT-related indicators or were pursued  through AUR or Nonfiler. In addition, IRS pursued—with AUR or  Nonfiler—about half of the nearly 100 individuals who had 50 or more W- 2s reported by employers for 2016. In addition, approximately 9,000  individuals with wages totaling more than $23,200 and that did not include  all W-2s in tax year 2016 also lived in five or more states (see figure 3 for  an illustrative example).

Deceased individuals. IRS did not apply IDT-related indicators to  some of the accounts of deceased individuals we identified as having  employer-reported wages not included on a tax return. Out of the  11,573 deceased individuals who reported earned income, we  identified nearly 2,627 who earned at least $23,200, a threshold  requiring the filing of a tax return. Of these, about 2,441 had at least  one of the seven IDT-related indicators or were pursued under IRS’s  AUR or Nonfiler enforcement programs. However, there were still 186  individuals that IRS did not identify.

Elderly. Out of the 19,460 elderly individuals who reported earned  income, we identified nearly 3,800 who earned enough to be required  to file a tax return. Of these, about 1,700 had at least one out of the  seven IDT-related indicators on their account or were pursued under  IRS’s AUR or Nonfiler enforcement programs. However, there were  still about 2,100 individuals that IRS did not identify.

Children. For tax year 2016, individuals under age 14 were only  required to file taxes if they earned more than $7,850. However,  nearly 1,900 met this filing threshold and failed to include at least one  W-2 on their tax returns. Of these, nearly 1,000 had at least one of the  seven IDT-related indicators applied to their account by IRS or were  pursued under IRS’s AUR or Nonfiler enforcement programs.  However, there were still about 900 individuals that IRS did not  identify.

In considering employment-related identity fraud, IRS focuses on only  one of the seven IDT-related indicators. Specifically, IRS considers  mismatches between the identity listed on the W-2 and the identity on the  tax return as a type of employment-related identify fraud. IRS does not  consider other characteristics, such as individuals with multiple wage  records, in its checks for employment-related identity fraud. Doing so  would require the development of new codes or the modifications of  existing ones.

According to the Fraud Risk Framework, two leading practices for  managing fraud risks include (1) identifying specific tools, methods, and  sources for gathering information; and (2) designing and implementing  control activities such as data-analytics activities to prevent and detect  fraud. IRS addressed these leading practices, in part, through the AUR  program, Nonfiler program, and seven IDT-related indicators, but there  were still individuals in the population we examined that IRS did not  identify. By assessing and documenting the feasibility of incorporating  additional checks—such as multiple wage records or wage records for  children under 14—into its checks of employment-related identity fraud, IRS may be able to develop a method for identifying additional taxpayers  at risk of this type of fraud.

Employment-Related Identity Fraud Can Reduce Tax Revenue

IRS officials stated that employment-related identity fraud has limited tax  consequences, as employees will nonetheless pay required taxes— including federal, state, and payroll taxes—through payroll withholding  even if the fraudster fails to file a tax return. However, we found that  federal income tax withholding was lower for SSNs that did not declare all  the W-2s than for SSNs with all W-2s reported (see table 4).

Additionally, we found individuals who did not withhold any federal  income taxes across all of their related W-2s in 2016. Specifically, 37,868  individuals had at least one W-2 not declared on a tax return and withheld  no federal income tax over the course of the year. Together, these  individuals earned approximately $340 million in 2016.

Further, 18 W-2s that were not reported on a tax return showed wages  earned of more than $100,000 yet had $0 of federal income tax withheld  (see figure 4 for example).

IRS’s Code for Tracking Employment-Related Identity Fraud Likely Understates the Extent of the Problem

Of the indicators IRS uses to track IDT, the only action code that directly  relates to employment is Action Code 525, “Employment-related Identity  Theft.” IRS applies the code to a taxpayer’s account when IRS processes  a return filed by an individual with an Individual Taxpayer Identification  Number (ITIN), and the return includes a W-2 with an SSN that does not  belong to the person identified on the ITIN return. IRS refers to this  situation as an ITIN/SSN mismatch. In 2018, IRS marked 818,097  accounts with Action Code 525.

IRS officials acknowledged that forms of employment-related identity  fraud, other than that captured by Action Code 525, are likely, but they  said they do not systematically track these situations for several reasons.  First, unless a taxpayer contacts IRS to say he or she did not earn the  wages and disclaims them, the agency does not know whether a  suspected case is employment-related identity fraud or someone who  may not have included legitimate wages on his or her tax return. Second,  IRS may be unable to distinguish between employment-related identity  fraud and fabricated W-2s for jobs that were not worked (i.e., fake  employees of a fake business). Third, while our analysis shows that  employment-related identity fraud may be a more widespread problem  than the ITIN/SSN mismatch that IRS currently tracks, IRS officials told us  that other types of employment-related identity fraud would be identified  and addressed through processes the agency applies broadly to all  taxpayers, such as the AUR or Nonfiler programs.

For example, according to IRS officials, if IRS receives a fraudulent W-2  from an employer using a legitimate taxpayer’s SSN, AUR or the Nonfiler  program will detect it as IRS matches W-2s with tax returns. However, our  analysis of NDNH and IRS data described earlier in this report shows that  there are potential cases that these IRS enforcement programs did not  identify.

Standards for Internal Control in the Federal Government states that  management should use quality information that is appropriate and  complete to achieve the entity’s objectives, and that it should  communicate quality information externally. However, our analysis of  SSNs at risk of employment-related identify fraud indicates that the count  of cases that IRS identifies under Action Code 525 likely understates the  universe of employment-related identity fraud. By modifying the title of its  employment-related IDT action code to more accurately reflect the data  covered by the code, IRS can ensure that the agency is appropriately  conveying the risk this specific type of employment-related identity fraud  poses both to victims and tax administration without suggesting its  statistics cover other types of employment-related identity fraud.

SSA Is Taking Steps to Better Detect Inaccurate W-2s and Notify Potential Fraud Victims, but Faces Challenges Addressing Risks Associated with Some Victims

SSA Detects Inaccurate W-2s and Monitors the Effectiveness of W-2 Accuracy Checks

As illustrated in figure 5, SSA analyzes W-2s to detect inaccuracies. For  W-2s determined to be accurate, SSA adds wages to the individual’s  record on the Master Earnings File, a database that SSA uses to  determine an individual’s eligibility for Social Security benefits and the  amount of benefits paid. For W-2s determined to be inaccurate, SSA  posts the wage information to the Earnings Suspense File. Inaccurate W- 2s may be attributable to various reasons, including employment-related  identity fraud or administrative errors.

SSA receives hundreds of millions of W-2s each year. SSA analyzes  incoming W-2s to detect inaccuracies and adds inaccurate W-2s to the  Earnings Suspense File. Based on SSA data from tax year 2016, SSA  added millions of W-2s to the Earning Suspense File. On a daily basis,  SSA electronically forwards IRS W-2s that it has analyzed, including both  accurate and inaccurate W-2s.

SSA monitors the effectiveness of its checks for inaccurate W-2s by  testing its software prior to the filing season. Prior to each filing season,  SSA creates test data that have characteristics of inaccurate W-2s. SSA  then processes these data through the annual wage reporting software to  ensure automated checks identify potentially inaccurate W-2s according  to SSA’s criteria. SSA also has an electronic reporting system in place  that SSA employees can use to identify and document problems for  management throughout the year. SSA officials told us they have not  identified any problems that have prevented checks from working as  intended.

This public report omits information that SSA has deemed sensitive  related to (1) SSA’s efforts to improve W-2 accuracy checks, and (2)  SSA’s challenges in addressing risks associated with employment-related  identity fraud.

SSA Is Taking Steps to More Effectively Communicate Relevant Information to Both Victims and Employers

SSA is taking steps to more effectively communicate to both victims and  employers information on potentially inaccurate W-2s, including potential  employment-related identity fraud W-2s. When SSA detects a potentially  inaccurate W-2, SSA may send a letter to the employer or employee  listed on the W-2 that notifies them of the potential inaccuracy. SSA first  sends letters to employers. Responses can help SSA resolve  inaccuracies by identifying correct wage earners. Responses can also  support SSA’s efforts to provide taxpayers with correct benefits. SSA  sends different letters to employees and employers depending on the  type of potential inaccuracy detected:

Mismatched name and SSN. In March 2019, SSA resumed sending  Educational Correspondence (EDCOR) letters to employers who  submitted W-2s electronically, notifying them of the number of W-2s  they electronically submitted with mismatched names and SSNs. The  letters request that employers use SSA’s Business Services Online  portal to view specific names and SSNs that did not match and  provide necessary Form W-2C corrections. According to SSA,  EDCOR letters are meant to educate employers about mismatches  and help SSA post wages to correct earnings records.

SSA officials told us that SSA had mailed about 577,000 EDCOR  letters for electronically submitted W-2s as of June 2019 since  resuming the process. Officials said the agency also began sending  EDCOR letters for W-2s submitted on paper beginning in October  2019. SSA previously sent EDCOR notices from 1994 through 2007,  but SSA stopped sending these notices in response to litigation  surrounding a proposed DHS regulation that would have required  employers to follow a prescribed course of action upon learning of an  employee name or SSN mismatch. DHS rescinded its proposed rule  in October 2009. SSA officials told us the agency decided to resume  sending EDCOR notices in 2019 because employers are using  Business Services Online to file more W-2s electronically. Therefore,  employers may be more familiar with the system used to submit W-2C  corrections.

SSA has taken action to improve the effectiveness of EDCOR letters  since the letters were discontinued in 2007. In 2008, the SSA OIG  reported that EDCOR letters were not effective in either  communicating wage-reporting problems to employers or identifying  correct wage earners. For example, the OIG found that 74 percent  of employers who reported W-2s with mismatched names and SSNs  did not receive letters. Most employers that did not receive letters  submitted 10 or fewer mismatched W-2s whereas SSA only sent  letters to employers that submitted more than 10 mismatched W-2s.  SSA officials told us that EDCOR letters sent beginning in 2019 are  sent to every employer who submits a W-2 with a mismatched name  and SSN.

Disclaimed wages. When an individual disclaims wages, SSA staff  have the option of sending a letter to the employer who paid the  wages to attempt to identify the wage earner. In 2008, the SSA OIG  found that SSA seldom sent letters to employers, and recommended  that SSA consider generating a standard, annual letter to each  employer that submitted a W-2, which was later disclaimed. SSA  officials told us that, as of May 2019, SSA staff in all SSA region  offices routinely send letters to employers notifying them of disclaimed  wages. SSA officials reported the agency sent 20,945 letters in fiscal  year 2018.

IRS Has Not Assessed Opportunities to Expand Detection and Deterrence Activities

IRS’s Use of Nonfiler to Detect and Deter Employment-Related Identity Fraud Is Limited

IRS uses relevant information to detect inaccurate W-2s, including  potentially fraudulent W-2s, and makes this information available to  relevant enforcement programs, including Nonfiler, which IRS uses to  follow up with individuals who appear to owe taxes but have not filed.

IRS detects inaccurate W-2s using the results of SSA’s annual wage  reporting checks and its own efforts to reconcile and correct some  inaccuracies. As part of this process, IRS receives Earnings Suspense  File W-2s that have mismatched names and SSNs from SSA and  attempts to locate the wage earner’s correct name and SSN. IRS does so  by identifying previously filed tax returns that list the same address as the  mismatched W-2s. IRS then compares the names and SSNs listed on W- 2s to those on the tax returns to identify accurate name and SSN  combinations.

Accurate and inaccurate W-2s are then made accessible to IRS  enforcement programs, including Nonfiler. Nonfiler and other programs  that support IRS’s efforts to collect taxes owed from wage earners,  including potential employment fraudsters, also may deter fraudulent  activity by reducing the likelihood fraudsters succeed in not paying taxes  owed.

In reviewing IRS actions that may help deter employment-related identity  fraud, we found that Nonfiler uses W-2 information to identify and follow  up with individuals who appear to owe taxes but did not file required  returns. However, we also found that IRS’s use of Nonfiler to collect taxes  owed by potential employment fraudsters is limited. Nonfiler is capable of  addressing cases involving certain types of employment-related identity  fraudsters who appear to owe taxes—specifically fraudsters for whom  IRS receives W-2s that have mismatched names and SSNs as well as  SSNs associated with deceased persons or children. However, the  agency has made limited use of Nonfiler to collect taxes owed on such  cases and faces the following resource challenges in doing so:

Reduced staffing capacity. IRS determines the number of  noncompliance cases pursued by its enforcement programs based on  available resources. IRS’s budget declined by about $2.1 billion (15.7  percent) from fiscal years 2011 through 2018 after adjusting for  inflation, and corresponding staff reductions have been most  significant within IRS enforcement programs, such as Nonfiler. In  2018, the Treasury Inspector General for Tax Administration (TIGTA)  reported that resource constraints have left IRS with fewer resources  to work cases involving individuals who do not respond to nonfiler  notices. For example, TIGTA found that IRS created 430,000 new  compliance cases in fiscal year 2017 involving individuals who did not  respond to nonfiler notices compared to 1.6 million in fiscal year  2013.

Competing priorities. IRS is focusing its resources on modernizing  its information technology systems and implementing Public Law 115- 97—commonly referred to as the Tax Cuts and Jobs Act. This law  was enacted in December 2017 and included significant changes to  corporate and individual tax law.

Costly follow-up contacts. According to IRS officials, collecting  taxes owed by employment-related identity fraudsters typically  requires IRS staff to make in-person contact with taxpayers by  locating them at their places of work, which is resource intensive.  According to IRS, in-person contact is typically required because  employment fraudsters are unlikely to provide employers and IRS  accurate address information on W-2s; therefore IRS often lacks  information needed to reach employment fraudsters through mailed  Nonfiler notices.

IRS Has Not Assessed Opportunities to Expand Activities That May Deter Some Fraudsters Who Underwithhold

To help reduce the number of nonfilers and underreporters, IRS uses the  Withholding Compliance Program (WHC) to pre-emptively identify  taxpayers who appear to be substantially underwithholding taxes based  on prior year W-2 and other information. Through this program, IRS  issues “lock-in letters” to employers of individuals who appear to be  underwithholding. Lock-in letters require employers to adjust employees’  withholding amounts to rates specified by IRS rather than the employees.  IRS adjusts withholding rates based on the number of withholding  allowances IRS determines the taxpayer is entitled to claim. Employees  are also sent lock-in letters informing them of changes to their withholding  rates.

WHC may be a more cost-effective opportunity than Nonfiler for IRS to  collect appropriate taxes from those employment-related identity  fraudsters who do not otherwise file returns and pay taxes owed. First,  WHC lock-in letters would be more likely to reach their intended  recipients, making them potentially more effective in obtaining their  intended responses. IRS sends lock-in letters to employers, and IRS  officials said the agency typically has accurate address information for  employers. IRS also sends notices to employees affected by lock-in  letters, but these letters do not request or require taxpayer action.

Second, businesses that employ employment-related identity fraudsters  may be more likely to comply with lock-in letters than fraudsters would to  Nonfiler notices. According to a 2018 TIGTA report, compliance with lock- in letters could further be improved if IRS took action against employers  who do not comply with the letters and adjust employees’ withholdings  accordingly. TIGTA recommended that IRS penalize employers who do  not respond. IRS has agreed to consider penalties, and officials told us  the agency is evaluating opportunities to do so.

Third, we have previously reported that IRS is less likely to collect taxes  owed the longer it takes IRS to contact taxpayers. Therefore, it is likely  more effective for IRS to use WHC to address potential tax liabilities  before they accrue, rather than use Nonfiler to assess and attempt to  contact fraudsters and collect taxes owed months after filing deadlines  have passed.

According to IRS officials, WHC issues lock-in letters to address  underwithholding by some employees who use matching names and  SSNs; however, the program does not issue lock-in letters for cases  involving W-2s with mismatched names and SSNs because of privacy  concerns. IRS officials said the agency has an obligation to protect all  taxpayers, including potential employment-related identity fraudsters. IRS  officials told us that IRS previously sent lock-in letters for cases involving  mismatched names and SSNs but stopped in 2012 because the agency  wanted to avoid potentially disclosing an employment-related identity  fraudster’s identifying information, such as the names of their employers,  to those individuals whose SSNs were used to commit employment fraud.

However, IRS could also redact personally identifiable information in the  lock-in letters as it already does this when mailing tax return transcripts.  For example, in response to data privacy concerns, in September 2018  IRS began including just the first four characters of business names on  tax return transcripts requested by taxpayers. This approach could also  be used for sending lock-in letters to employees to reduce disclosures of  personally identifiable information in instances where lock-in letters do not  reach their intended recipients.

IRS officials told us that WHC’s limited resources prevent the program  from addressing all underwithholding cases currently identified by the  program. Officials also said that, for that reason, expanding WHC to  include cases with mismatched names and SSNs would not result in  WHC selecting additional cases. However, by not including cases with  mismatched names and SSNs, IRS may be missing an opportunity to  identify and select a population of underwithholding cases that could lead  to greater revenue collection. This is because some cases with  mismatched names and SSNs may have greater underwithholding than  those cases that are currently selected by WHC.

If IRS were able to allocate more resources toward generating additional  lock-in letters in the future, these potential benefits could also increase. In  addition, WHC may be more affordable than other enforcement programs  to administer on a case-by-case basis because unlike enforcement cases  initiated through Nonfiler, WHC does not result in IRS pursuing taxpayers  through progressively more costly methods of contact to collect additional  revenue. IRS officials acknowledged this possibility and told us the  agency has not assessed the potential costs and benefits of expanding  WHC to include cases with mismatched names and SSNs.

Internal control standards state that federal managers should use quality  information to achieve their objectives, communicate relevant information  throughout the agency, and both assess and address risks to their  mission. Additionally, leading practices in managing fraud risks include  considering the benefits and costs of controls for addressing fraud-related  risks. Further, IRS’s Strategic Plan has goals to use data analytics to  inform decision making and protect the integrity of the tax system.

Because IRS has not evaluated and documented the costs and benefits  of expanding WHC to address risks posed by employment-related identity  fraudsters, the agency cannot determine whether or not expanding WHC  to include mismatch cases would enable IRS to collect additional revenue  and deter employment fraud. By conducting such an assessment, IRS  could determine whether expanding WHC to include mismatch cases  would likely enable IRS to collect additional revenue and deter  employment fraud.

IRS’s Approach to Managing Impacts on Victims Creates an Enforcement Gap

To manage the impacts of employment-related identity fraud on victims,  IRS limits the circumstances under which these victims may be selected  by enforcement programs. In analyzing IRS data, we found about 3  million taxpayers who have either been identified as “employment-related  identity theft” victims by IRS (Action Code 525) or who have identified  themselves as victims to IRS (Action Code 501). Automated  Underreporter (AUR) programming prevents these taxpayers from being  selected due to wage discrepancies. Instead, AUR analyzes these  taxpayers for reporting discrepancies for other income types, such as  investment income.

IRS officials told us excluding these taxpayers from AUR’s W-2 checks  helps IRS avoid burdening some victims who may be otherwise selected  based on wages earned by a fraudster using the taxpayers’ name and  SSN. Selected victims would be required to follow up with IRS to avoid  being assessed tax liabilities. Following up would be particularly  burdensome for victims whose names and SSNs are used by fraudsters  year after year.

Taxpayers with IDT action codes on their accounts are eligible for  analysis and selection by other enforcement programs based on  discrepancies in W-2 reporting; however, these programs’ low selection  rates suggest that it is unlikely IRS will follow up with these victims and  notify them of these discrepancies. For example, although Nonfiler  analyzes these taxpayers for evidence of income indicating a filing  requirement, TIGTA found that IRS notified just 25,105 or 14 percent of  all 179,878 nonfiler cases identified in fiscal year 2016 of these  discrepancies. Likewise, although IDT victims may be selected for  examination, IRS data show that the agency examined about 892,000 or  0.6 percent of all individual income tax returns in fiscal year 2018, the  most recent year for which data are available.

IRS officials acknowledge that some of the approximately three million  taxpayers with Action Codes 501 or 525 may underreport their own  incomes, and excluding these taxpayers from AUR’s W-2 discrepancy  checks creates an enforcement gap, enabling some victims who actually  underreported their own wages to avoid enforcement. IRS does not know  how many of these taxpayers have underreported wage income.

However, some IDT victims excluded from AUR’s wage discrepancy  checks may be incentivized to underreport wages and pay less tax than  they owe if they learn IRS is unlikely to hold them accountable for paying  those taxes. Individuals could learn about this enforcement gap, for  example, if they accidentally failed to report wages from an employer and  were not later contacted by IRS. In addition other taxpayers may be  incentivized to falsely claim they are IDT victims to take advantage of this  enforcement gap. In its research into behavioral insights, IRS has found  that taxpayers are more likely to be noncompliant when they perceive  doing so can yield substantial benefits with minimal costs. We have also  previously reported that the extent to which taxpayers misreport income  closely aligns with IRS’s ability to detect such noncompliance.

In some instances, IRS has information needed to distinguish wages  earned by legitimate taxpayers from those potentially earned by  employment-related identity fraudsters using that same taxpayer’s name  and SSN. For example, IRS can reasonably conclude the legitimate  taxpayer earned the wages if they are reported on a current- or prior-year  return filed by the taxpayer, as this indicates the taxpayer attests to  having worked for the employer who paid the wages.

Because IRS excludes IDT victims from AUR’s W-2 discrepancy checks,  IRS may not identify or collect taxes owed by some who unintentionally  underreport their wages (e.g., by forgetting to include a W-2 from a  second employer). In addition, IRS is missing an opportunity to incentivize  taxpayers to accurately report their income and avoid intentional  underreporting.

As previously stated, federal internal control standards call for managers  to both use quality information and respond to risks. According to IRS  officials, modifying AUR to effectively identify the underreporting of wages  actually earned by identity theft victims would require IRS to not only  adjust AUR to include wage discrepancy checks for these taxpayers but  also to change how AUR identifies wage discrepancies. IRS officials told  us that when AUR evaluates a taxpayer’s wage information for  discrepancies, the program evaluates taxpayers based on aggregated W- 2 information. AUR is not programmed to evaluate taxpayers by analyzing  some of their W-2s but not others, such as potential employment fraud W- 2s.

IRS officials told us modifying AUR to include W-2 discrepancy checks of  these taxpayers while excluding potentially fraudulent W-2s would not be  a cost-effective use of IRS resources at this time. Specifically, officials  noted that AUR discrepancy checks are programmed in the legacy  assembly language code, a low-level computer language initially used in  the 1950s. Although they were unable to provide an estimate for the costs  of modifying this code, IRS officials said the effort would be resource  intensive.

IRS is modernizing outdated information technology systems, and officials  said it would be more cost effective for the agency to modify W-2  discrepancy checks once the assembly language is replaced. IRS plans  to retire 75 percent of the agency’s legacy assembly language code and  Common Business-Oriented Language code legacy by the end of fiscal  year 2024. Officials told us the agency does not have a specific timeline  in place for updating the assembly code that supports AUR, though doing  so is a program goal.

Modifying AUR to include wage discrepancy checks for IDT victims as  part of IRS’s broader effort to update AUR’s programming code would  enable IRS to avoid making costly and redundant changes to legacy  coding that IRS plans to replace. It would also be consistent with a goal  outlined in IRS’s Strategic Plan to advance the use of data and analytics  to inform decision making and could potentially result in IRS collecting  additional revenue by enabling IRS to analyze wage information for about  three million additional taxpayers to identify any wage reporting  discrepancies. Some of these taxpayers may have greater revenue  collection potential than cases AUR would otherwise select.

SSA and IRS Share Wage Reporting Data, but Opportunities Exist to Improve Collaboration

SSA and IRS Collaborate on Combined Annual Wage Reporting with Defined Roles and Responsibilities

SSA and IRS both have responsibility for parts of the Combined Annual  Wage Reporting (CAWR) process to exchange W-2 information between  the two agencies and to help ensure that taxpayers report and pay the  proper amount of taxes on their wages. The CAWR Memorandum of  Understanding (MOU), which was signed in 2007, is a key part of their  collaborative effort, and SSA and IRS are legally bound to the mutually  agreed upon purpose and functions. Specifically, the CAWR MOU  covers the collaborative processes through which SSA and IRS share  earnings information, including establishing clear roles and  responsibilities for this effort, as called for by leading practices for inter- agency collaboration.

IRS oversees tax administration, including ensuring compliance with tax  laws. SSA acts as an agent to these activities by processing W-2s. As  illustrated in figure 6, processes covered by the CAWR MOU include SSA  sending accurate and inaccurate W-2s to IRS. Also, if wages are  disclaimed through IRS, or IRS is able to correct a Social Security  number-name mismatch using tax information, IRS sends this information  to SSA. Federal law requires the Commissioner of Social Security and the  Secretary of the Treasury to share W-2 information, and permits use of  the CAWR MOU to effectuate this process. It also requires that the  MOU remain in full force and in effect until modified or otherwise changed  by mutual agreement of the heads of each agency.

SSA and IRS Have Been Working to Update the 2007 CAWR MOU Since 2016

SSA and IRS have taken steps to update the 2007 CAWR MOU, but the  effort has been underway for more than 3 years. As we reported in  September 2012, continually updating agreements is an important part of  the leading practice for written guidance and agreements.

SSA and IRS officials told us that discussions about the update began in  2012 and the substantive work of updating the MOU began in August  2016. Since the MOU has not been updated in more than a decade,  certain data-exchange materials and provisions in the MOU have become  outdated, such as the references to microfilm.

According to SSA and IRS officials, the MOU update has been driven by  efforts at the staff level with executives briefed on the status. We have  previously found that leadership involvement in collaborative efforts is  needed to overcome the many barriers to working across agency  boundaries. SSA officials noted that having highly involved executives  would indicate problems with the MOU update process. IRS officials said  that the staff level is the appropriate place to negotiate the MOU update  with oversight from executives, as needed. However, at both agencies,  officials at the staff level do not have the authority to agree to any updates  or modifications of the MOU. SSA and IRS are responsible for ensuring  the MOU update process is thorough, complete, and carried out in a  timely manner.

SSA and IRS officials stated that while the MOU is the cornerstone of  SSA-IRS collaboration, completing the update is challenging because  there are competing priorities. Additionally, the agencies are not legally  required to update the MOU; instead, the MOU is in effect until modified  or otherwise changed by mutual agreement of the Commissioner of  Social Security and the Secretary of the Treasury (who delegated this  authority to the Commissioner of Internal Revenue).

In September 2019, SSA and IRS officials told us they plan to complete  the update of the MOU in spring 2020, more than 3-and-a-half years after  the effort to update the MOU began. Standards for project management  call for developing a plan with specific actions and time frames. A plan  could also identify the resources, processes, and individuals necessary to  carry out the update. SSA and IRS officials acknowledged that they did  not develop such a plan for the ongoing effort to update the MOU. By  developing a plan for future updates that includes actions, time frames,  and responsible individuals, including executive leadership, SSA and IRS  would have greater assurance that the MOU would be updated when  needed.

SSA and IRS Have Not Developed Shared Goals and Performance Measures or Conducted Required Annual Reviews of the MOU Process

While SSA and IRS have established joint functions in the CAWR MOU,  the agencies do not have shared goals and performance measures to  help track progress in implementing these functions and identify potential  improvements. As we reported in September 2012, defining short- and  long-term outcomes is an important part of the leading practice for  outcomes and accountability for collaborative efforts. This includes  defining and articulating common goals based on what the group shared  in common and developing mechanisms, such as performance goals and  measures, to evaluate the results.

SSA officials said existing goals and measures in the MOU were  sufficiently effective. However, we did not find evidence of goals and  measures in the MOU and neither SSA nor IRS officials could provide  documentation of specific examples of such. Establishing shared goals  and performance measures for the CAWR MOU functions would help  SSA and IRS monitor and evaluate its results, as well as identify potential  weaknesses and potential improvements.

While the MOU lacks goals and measures, it does contain provisions for  the agencies to conduct annual studies of the CAWR process and to  submit a report to each commissioner on the results. However, the  agencies have not consistently implemented these provisions. Monitoring  progress is an important part of the leading practice for outcomes and  accountability for collaborative efforts. Continually monitoring agreements  is an important part of the leading practice for written guidance and  agreements. For SSA and IRS, this means monitoring progress toward  fulfilling their legal obligation to implement the CAWR MOU.

In the 2007 CAWR MOU, SSA and IRS agreed to the following monitoring  provisions related to conducting an annual review of the CAWR process.

Conduct annual joint studies of the CAWR process. Since the  MOU was implemented in 2007, IRS and SSA have not conducted a  joint study of the CAWR process. These reviews were intended to  assist the required annual review of the MOU and help inform the  agencies of potential improvements to the CAWR process.  Specifically, the MOU requires that upon completion of the annual  review, a joint SSA and IRS report should be sent to each  commissioner consisting of the results of the review, a list of any  changes that have occurred in the process, and any recommendation  for changes. This is intended to serve as an important monitoring  function for the MOU. IRS officials said the agencies have been  unable to conduct annual joint studies or submit the required annual  reports primarily because the MOU is extensive and affects many  offices at both agencies. SSA and IRS officials said that they plan to  change to a biannual interagency review of the MOU so they can do a  better job of keeping the MOU updated and relevant. However,  officials did not provide information about any steps they plan to take  to ensure that the reviews would occur as required.

According to SSA officials, SSA and IRS plan to meet every 3 or 6  months to review existing agreements, including the CAWR MOU.  This may be a means of identifying necessary changes to the CAWR  process since regular communication can facilitate effective  collaboration; however, officials did not provide additional details on  these potential new meetings.

Conduct annual independent studies of the CAWR process. SSA  had no records that it had conducted an independent study of the  process in the past 3 years. IRS conducted two independent studies  in 2018 on the CAWR process which primarily focused on IRS’s  adherence to its policy guidance. Annual independent studies were  intended to serve as another feedback mechanism to assist in the  review of the MOU.

According to SSA and IRS officials, they have not implemented these  monitoring provisions because of resource constraints. As previously  discussed, the agencies are updating the CAWR MOU and plan to  finalize the updated MOU by spring 2020. Officials told us that, similar to  the 2007 MOU, the updated MOU will include requirements for  periodically reviewing the MOU to identify potential improvements to the  CAWR process. However, the time frames may change. Developing and  documenting a strategy for implementing the monitoring provisions in the  updated MOU would provide greater assurance that SSA and IRS are  periodically assessing the CAWR process and identifying opportunities for  improvement, as required.

SSA and IRS Have Developed Ways to Operate Across Agency Boundaries, but Lack Sufficient Common Terminology Related to the CAWR Process and Identity Fraud

As we reported in September 2012, agreeing on common terminology  and definitions is an important part of bridging organizational cultures.  One way to operate across agency boundaries is to foster open lines of  communication. SSA and IRS do this by holding interagency meetings,  including quarterly executive-level and monthly technical-level meetings.  In addition, officials from SSA and IRS said that the agencies have a  strong working relationship and that officials at both agencies have  frequent informal communication. The agencies also established a fraud  working group, which held introductory meetings in 2018 and 2019. While  the group does not have a formal mission statement, the general scope of  responsibility for the group is to identify areas of common interest related  to mitigating fraud and to collaborating on best practices and efforts to  mitigate fraud risks.

However, SSA and IRS have developed limited common terminology and  definitions related to their CAWR collaboration effort. The agencies have  agreed on 10 definitions in their MOU, but these definitions are very  limited in scope; for example, two of these definitions simply spell out the  agency names and none of the definitions are for the 20 data variables  the agencies exchange daily.

Both SSA and IRS officials stated that common terminology related to  identity fraud would be helpful, and acknowledged that they use different  terminology and have to call each other to ask what different terms mean.  SSA officials cited the use of different terminology at SSA and IRS as a  barrier to collaboration.

Because of the absence of common terminology, IRS has been unaware  of information it receives from SSA in some cases. For example, through  the common format record exchange, SSA shares information with IRS  about why SSA determined that a W-2 is inaccurate, but IRS was  unaware of this information. SSA told us that it sends a table to IRS  annually that includes code combinations for their data transfers and their  meanings which explain why the W-2 was accurate or inaccurate.

However, SSA officials were unsure of the extent to which IRS officials  understood the codes. One reason that SSA determines a W-2 is  inaccurate is if earnings with the same name, SSN, and EIN were  disclaimed in previous years. SSA communicates this to IRS using codes  within the W-2 record that are labeled “invalid due to SWED.” However,  SSA and IRS have not defined “SWED” and IRS officials said that they  were unaware of receiving information from SSA about previously  disclaimed wages. Officials said they interpreted the information to relate  to invalid wages due to name and SSN mismatches and spent time trying  to resolve the mismatch issue. They said that such information could be  useful for future enforcement efforts. Further, IRS officials said that they  were also unaware of other code combinations that SSA officials told us  they use to inform IRS about accurate and inaccurate wages.

IRS attributed its unfamiliarity with the data elements coming from SSA to  staff turnover since key IRS officials who were familiar with the data  elements retired. However, IRS could have been aware of the meaning of  the variables if the agencies had established and documented common  definitions for these data elements. In addition, according to IRS officials,  they have limited resources for following up on information that SSA is  sharing because they have been focused on competing priorities,  including implementing the Tax Cuts and Jobs Act of 2017.

SSA and IRS officials noted that the next version of the MOU will define  additional terminology that was not defined in previous MOU documents.  For example, officials said that “EIN” and “TIN” are key IRS terminology  that may be defined in the new MOU. Until SSA and IRS clearly define  the data elements they exchange as part of the CAWR process, SSA and  IRS are at risk of not communicating effectively about CAWR and, thus,  missing opportunities to use data more effectively to identify fraudulent or  otherwise inaccurate W-2s. This could be done, for example, by  developing a shared data dictionary that clearly defines all of the data  elements the agencies are exchanging.

Employment-related identity fraud can have negative impacts on victims  and poses risks to both SSA and IRS. Victims may face IRS enforcement  actions or a reduction in benefits for some federal programs based on  wages earned by fraudsters. The full scope of this fraud is unknown. In  2018, IRS marked more than 800,000 taxpayer accounts with Action  Code 525 “employment-related identity theft.” However, IRS’s use of the  term “employment-related identity theft” likely understates the true scope  and impact of this type of fraud and may be misleading to both agency  decision makers and Congress. Additionally, by assessing the feasibility  of incorporating additional compliance checks into its checks of  employment-related identity fraud, IRS may be able to develop a method  for identifying additional taxpayers at risk of this type of fraud.

SSA and IRS rely on accurate W-2 information to carry out their missions  and have taken steps to detect the submission of fraudulent W-2s.  Evaluating the costs and benefits of expanding IRS’s Withholding  Compliance Program (WHC) to include cases with mismatched names  and SSNs may provide IRS an opportunity to increase revenue collection.

Additionally, while IRS has taken steps to manage the impacts of identity  fraud on victims, the agency’s decision to exclude approximately 3 million  individuals with IDT action codes from Automated Underreporter’s (AUR)  wage discrepancy checks has resulted in a gap in enforcement coverage.  IRS plans to update most of the agency’s legacy programming code by  the end of fiscal year 2024. Updating AUR’s programming to include  these individuals would enable IRS to close this enforcement gap and  potentially increase revenue.

Further, SSA and IRS’s 2007 CAWR MOU plays an important role in IRS  and SSA’s efforts to accurately report wage information and resolve  mismatches. While the agencies expect to finalize their first update of the  MOU by spring 2020, efforts to update the MOU have been ongoing for  more than 3 years. Developing a plan for implementing future updates  would provide greater assurance that the MOU would be updated when  needed. Additionally, developing performance goals and measures for the  MOU as well as a strategy for assuring the studies called for by the MOU  are completed within the specified time frames would help ensure that  SSA and IRS are periodically assessing the CAWR process, and  identifying opportunities for improvement. Moreover, by clearly defining  the data elements IRS and SSA exchange as part of the CAWR process,  the agencies would be better positioned to effectively use the data to  identify fraudulent or otherwise inaccurate W-2s.

We are making a total of 12 recommendations, including eight to IRS and  four to SSA.

The Commissioner of Internal Revenue should modify the title of IRS’s  employment-related identity theft action code 525 to reflect the type of  employment-related identity fraud encompassed by this action code.  (Recommendation 1)

The Commissioner of Internal Revenue should assess and document the  feasibility of incorporating additional checks into its automated checks of  employment-related identity fraud for populations at risk of employment- related identity fraud, such as children, elderly, deceased persons, and  individuals associated with multiple wage records. (Recommendation 2)

The Commissioner of Internal Revenue should assess and document the  costs and benefits of using WHC to address compliance risks posed by  potential employment-related identity fraudsters who owe taxes and take  appropriate action, as needed. (Recommendation 3)

The Commissioner of Internal Revenue should modify AUR to include  wage discrepancy checks for victims of employment-related identity fraud  once IRS has updated AUR’s legacy programming code.  (Recommendation 4)

The Commissioner of Internal Revenue should, in collaboration with the  Commissioner of Social Security, develop and document a plan for  updating future CAWR MOUs. The plan should identify actions, time  frames, and responsible parties, including executive leadership.  (Recommendation 5)

The Commissioner of Internal Revenue should, in collaboration with the  Commissioner of Social Security, develop and implement goals and  performance measures for the CAWR MOU. (Recommendation 6)

The Commissioner of Internal Revenue should, in collaboration with the  Commissioner of Social Security, develop and document a strategy for  assuring that the reviews required by the updated MOU are completed  within the specified time frames. (Recommendation 7)

The Commissioner of Internal Revenue should, in collaboration with the  Commissioner of Social Security, clearly define data elements they  exchange with SSA. (Recommendation 8)

The Commissioner of Social Security should, in collaboration with the  Commissioner of Internal Revenue, develop and document a plan for  updating future CAWR MOUs. The plan should identify actions, time  frames, and responsible parties, including executive leadership.  (Recommendation 9)

The Commissioner of Social Security should, in collaboration with the  Commissioner of Internal Revenue, develop and implement goals and  performance measures for the CAWR MOU. (Recommendation 10)

The Commissioner of Social Security should, in collaboration with the  Commissioner of Internal Revenue, develop and document a strategy for  assuring that the reviews required by the updated MOU are completed  within the specified time frames. (Recommendation 11)

The Commissioner of Social Security should, in collaboration with the  Commissioner of Internal Revenue, clearly define the data elements they  exchange with IRS. (Recommendation 12)

We provided a draft of the sensitive version of this report to IRS, SSA, the  Federal Trade Commission, the Department of Health and Human  Services, and the Department of Homeland Security for comment. In  comments reproduced in appendix II, IRS neither agreed nor disagreed  with the recommendations. In comments reproduced in appendix III, SSA  agreed with the recommendations and noted that SSA and IRS officials  are meeting on a recurring basis to complete an updated memorandum of  understanding. IRS, SSA, the Department of Homeland Security, and the  Federal Trade Commission provided technical comments which were  incorporated as appropriate. The Department of Health and Human  Services had no comments on the report.

We are sending copies of this report to the appropriate congressional  committees, the Commissioner of Internal Revenue, Commissioner of  Social Security, Chairman of the Federal Trade Commission, Secretary of  Health and Human Services, Acting Secretary of Homeland Security,  Secretary of the Treasury, and other interested parties. In addition, the  report is available at no charge on the GAO website at  https://www.gao.gov   If you or your staff have any questions about this report, please contact  Jessica Lucas-Judy at (202) 512-9110 or LucasJudyJ@gao.gov, or  Rebecca Shea at (202) 512-6722 or SheaR@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs are on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) the potential scope of employment-related  identity fraud, including what the Internal Revenue Service (IRS) knows  about this type of fraud and what we could determine by analyzing the  Department of Health and Human Services’ National Directory of New  Hires (NDNH) and IRS data; (2) Social Security Administration (SSA)  actions to detect and deter this fraud as well as notify victims; (3) IRS  actions to detect and deter this fraud as well as notify victims; and (4) the  extent to which SSA and IRS are collaborating to address the issue.

To describe and analyze the potential scope of employment-related  identity fraud, we took the following steps:  1.  Identified groups at risk of identity theft. We first reviewed  Treasury Inspector General for Tax Administration, SSA Office of the  Inspector General, and our prior reports on Social Security number  (SSN) misuse to determine common characteristics of individuals who  are at risk of SSN misuse. These characteristics include being  deceased, elderly, a child, or having three or more wage records  during the 3-month period of our review. Based on these reports, we  defined “elderly” as over age 84 and “children” as under age 14 for the  purposes of this review.  2.  Identified SSNs at risk of SSN misuse. We used SSA’s full death  file for dates of death for deceased individuals, and its Numerical  Index File (Numident) for dates of birth for living individuals.We next  compared full death file and Numident data to a quarterly extract of  NDNH data listing the names and SSNs of individuals who earned  wages between August and October 2016. We selected data from this  quarter because, at the time of our review, these were the oldest data  for which relevant IRS tax data were also available. We used this  comparison to identify individuals employed between August and  October 2016 who also met at least one of these at-risk  characteristics.

NDNH is a database of individuals employed in the United States.  Data are collected and reported by state workforce agencies and  federal agencies, and the database is administered by the  Department of Health and Human Services’ Office of Child Support  Enforcement. NDNH data are comprised of three types: verified,  unverified, and unverifiable. The verified data—used in this analysis— have been checked against SSA records to confirm that the name and  SSN match SSA records. Unverified data include data that do not  match on name or SSN, and unverifiable data include data that did  not include enough information to attempt a match (e.g., when states  submit partial or missing name information).

According to the Department of Health and Human Services, there  were 584,013,484 verified wage records, 18,629,720 unverified, and  91,134,352 unverifiable as of December 31, 2018. Verified data were  used in this analysis to make the estimate more conservative since  cases of potential synthetic identity theft—where the name and SSN  do not match—are excluded from verified data.

NDNH is designed to assist state child support agencies in locating  parents and taking appropriate, interstate actions concerning child  support orders. Some authorized agencies also use NDNH data to  help prevent overpayments and detect fraud. For example, IRS has  access to NDNH to administer the Earned Income Tax Credit.  However, IRS and SSA are not authorized to use NDNH information  to detect potential employment-related identity fraud.

We were authorized to use NDNH through the GAO Access and Oversight Act of 2017,  Pub. L. No. 115-3, 131 Stat. 7.

Form W-2, Wage and Tax Statement (W-2) was not reported on a  2016 tax return.

When possible, we also limited the analysis to cases where the  taxpayer had a known filing requirement. We also identified cases  that were consistent with misuse of SSNs for employment-related  identity fraud, rather than taxpayer noncompliance. However, we were  unable to determine the total extent of taxpayer noncompliance for  taxpayers included in this analysis.

Our analysis is not intended to be a comprehensive effort to identify  all potential cases of employment-related identity fraud. We focused  our analysis on cases where matching names and SSNs were used to  obtain employment. These cases pose a risk to SSA, IRS, and  victims, yet little is known about these cases.  4.  Analyzed tax characteristics of potential employment-related  identity theft victims and other taxpayers. Last, we used CDW to  analyze selected tax characteristics of both individuals we identified  as having at least one employer-submitted Form W-2 that was not  reported on a 2016 tax return as well as those where employer- submitted Forms W-2 were reported. For example, we analyzed data  on wage withholding rates, the prevalence of selected IRS identity  theft indicators on taxpayers’ accounts, and IRS enforcement actions  taken against these individuals.

We assessed IRS procedures against the information gathering and data  analytics leading practices in the Framework for Managing Fraud Risks in  Federal Programs. We did not conduct a comprehensive fraud risk  assessment of the IRS enforcement programs. Our assessment was  limited to the control activities surrounding employment-related identity  fraud.

We assessed the reliability of the full death file, Numident, NDNH  quarterly wage data, and selected elements of CDW by reviewing  relevant documentation, interviewing knowledgeable agency officials, and  performing electronic testing to determine the validity of specific data  elements in the data. We determined that the data elements used in our  analysis were sufficiently reliable for the purpose of our work to describe  and analyze the potential scope of employment-related identity fraud.

To assess IRS and SSA actions to detect and prevent employment- related identity fraud as well as notify victims, we reviewed relevant  documentation including IRS’s Internal Revenue Manual and SSA’s  Policy Operations Manual System. We also interviewed knowledgeable  officials from both agencies on SSA and IRS processes for detecting and  preventing employment-related identity fraud and notifying victims. We  compared IRS’s and SSA’s efforts to relevant federal internal control  standards. We also assessed the agencies’ efforts against IRS and  SSA’s respective strategic plans as well as select leading practices to  combat fraud, as identified in the Framework for Managing Fraud Risks in  Federal Programs.

To evaluate the extent to which IRS and SSA are effectively collaborating  to address employment-related identity fraud, we reviewed relevant  agency documents, such as IRS and SSA’s Combined Annual Wage  Reporting Memorandum of Understanding, other IRS-SSA legal  agreements, meeting minutes from IRS-SSA joint meetings, and policy  manuals. Because of its role with assisting victims and collecting statistics  on identity theft, we interviewed agency officials from the Federal Trade  Commission in addition to knowledgeable officials from IRS and SSA.  Because of its role helping employers verify the identities of employees,  we interviewed officials at the Department of Homeland Security.

We focused our assessment on SSA and IRS because those agencies  are most directly involved in the wage reporting process used to detect and resolve employment-related identity fraud. We assessed IRS and  SSA’s collaboration efforts against leading practices for collaboration we  have identified in our prior work and against standards for project  management. We identified key elements of each leading practice and  assessed the extent to which SSA and IRS collaboration on employment- related identity theft aligned with leading practices or key elements.

Appendix II: Comments from the Internal Revenue Service

Appendix III: Comments from the Social Security Administration

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the individual named above, the following staff made key  contributions to this report: Neil A. Pinney (Assistant Director), Philip D.  Reiff (Assistant Director), Melissa L. King (Analyst-in-Charge), Priyanka  Sethi Bansal, Heather A. Collins, Ann L. Czapiewski, Celina F. Davidson,  Pamela R. Davidson, Julia C. DiPonio, Shannon J. Finnegan, Steven  Flint, Robert L. Gebhart, James A. Howard, Grace H. Kwon, Krista Loose,  Maria C. McMullen, Kevin C. Metcalfe, J. Daniel Paulk, Lindsay W.  Swenson, Sonya Vartivarian, Ariel Vega, and Miranda J. Wickham.

Employment-related identity fraud occurs when people use a name or Social Security number (SSN) other than their own to get a job. This fraud makes it harder for IRS to collect taxes and harder for the Social Security Administration to manage benefits.

Though the true scope of this fraud is unknown, we identified 1.3 million SSNs from 2016 that were associated with both signs of potential fraud (e.g., wages reported for the SSNs of children or the elderly), and underreported wages to IRS by the taxpayer.

Our recommendations include improving how both agencies share wage data to better detect this type of fraud.