Use of Stolen Business EINs for Tax Fraud

How criminals use stolen and fraudulent business EIN numbers for tax fraud and tax identity theft

Businesses are popular (and unsuspecting) victims in tax fraud schemes

There is great deal of focus and public attention on the rapidly increasing number of incidents of consumer tax refund fraud and tax identity theft, in which thieves use stolen personal identity information (name and Social Security number) to file fraudulent individual tax returns and obtain the tax refunds of their victims.

Tax refund fraud and tax identity theft have become wildly popular with street gangs, organized crime, and many other criminal opportunists. The IRS National Taxpayer Advocate reports that tax-related identity theft has increased 650% since 2008. As a result, the IRS has implemented multiple new processes and devoted considerable resources to detect and address incidents of individual tax identity theft.

But... there is another side to the tax fraud epidemic. One that remains largely non-addressed, and largely unrecognized in the media. It is the side of tax fraud in which unsuspecting businesses are the victims.

The Business EIN

A business EIN (federal employer identification number) is, in many respects, a business form of Social Security number because of the numerous ways it is commonly required and used to uniquely identify the business. It is required for business bank accounts, business loan and credit accounts, merchant credit card processing accounts, state and federal tax filing, and a host of other routine business activities. Despite this, an EIN is generally not provided the same protections as an SSN.

Many business identity theft schemes occur, and many fraudulent accounts can be opened, with just your business name, address, and EIN.

And, as hundreds of thousands of businesses have been alarmed to discover, tax fraud / tax refund fraud is now right at the top of the list.

Business EINs used in Tax Fraud Schemes to Report Fraudulent Wages and Tax Withholding

Individuals who report wages (income) and tax withholding on a Form 1040, U.S. Individual Income Tax Return, must attach a Form W-2 - Wage and Tax Statement, to a paper-filed tax return to support the income and withholding reported. For an electronically filed (e-filed) tax return, the filer must input the information from the Form W-2 into the e-filed tax return.

Criminals attempting to commit tax refund fraud frequently file tax returns reporting false income and withholding to generate a fraudulent tax refund. Even if the individual did not actually work or earn income, by fraudulently reporting wages and tax withholding, he or she appears to be entitled to a tax refund payment. Claiming additional false income can also inflate an otherwise legitimate tax refund, because some tax credits are based on reported income.

In order for criminals to perpetrate this type of tax fraud, the fraudulent wages and withholding must appear to come from a real employer; and therefore, requires the use of an employer’s business name, address, and Employer Identification Number (EIN). Demonstrative of the ways creative criminals learn to identify and capitalize on system weaknesses, consider that with the proliferation of e-filing and electronic tax filing software, an actual W-2 document is not even required. It can be accomplished by simply entering the information in an online form. The business information needed is often readily available, in business filings and business credit reports, among other places.

A Look at Business EINs being used for Tax Fraud:
Audit Report by the Treasury Inspector General for Tax Administration (TIGTA)

On September 23, 2013, the Treasury Inspector General for Tax Administration (TIGTA) published an audit report entitled “Stolen and Falsely Obtained Employer Identification Numbers are Used to Report False Income and Withholding.”

TIGTA conducted the audit because “perpetrators of fraud are using stolen or falsely obtained EINs to submit tax returns with false income and withholding documents to the IRS for the sole purpose of receiving a fraudulent tax refund.”

Summary of Key Findings of the Treasury Inspector General’s Report

TIGTA estimated that the IRS could issue almost $2.3 billion in potentially fraudulent tax refunds based on stolen or falsely obtained EINs each year, and roughly $11.4 billion over the next five years.

For Tax Year 2011 alone, TIGTA identified 767,071 electronically filed individual tax returns with fraudulent refunds based on falsely reported income and withholding. There were 285,670 EINs used on these tax returns. Of these:

• 8,046 were falsely obtained EINs used to report false income and withholding on 14,415 tax returns with potentially fraudulent refunds issued totaling more than $50 million.


• 277,624 were stolen EINs used to report false income and withholding on 752,656 tax returns with potentially fraudulent refunds issued totaling more than $2.2 billion.

These numbers provide considerable insight into a rapidly growing criminal trend, and a fundamental risk with ominous implications for businesses. They also highlight a major area of weakness in IRS tax fraud detection and prevention processes involving business EINs.

Delay in Detecting Use of Stolen Business EINs means Opportunity for Tax Fraud

The IRS has processes in place to verify the validity of the EIN on W-2 forms associated with income and withholding reported on tax returns. In other words, it can confirm the EIN was actually issued by the IRS.

For example, the IRS’s e-file system rejects e-filed tax returns if the EIN used to report income is not valid, such as a fictitious EIN or a number that was entered incorrectly. This system is not foolproof, and some do slip through, as was the case for the 8,046 returns discovered in the TIGTA audit for the 2011 tax year. For calendar year 2013, by May 27, 2013 the IRS reportedly had already rejected more than 1.1 million e-filed tax returns because an invalid EIN was used to report income and withholding.

However, as the TIGTA report shows, there is a significant gap in effectiveness when the tax fraud involves the use of stolen EINs - those that are legitimately issued and belong to a legitimate business.

This is because the IRS may not have access to third-party reported Form W-2 information at the time individual tax returns are processed, and is unable to verify income and withholding reported on tax returns when they are processed (i.e.- match the income and withholding reported on an individual tax return to a third-party Form W-2).

The Employee Wage Reporting and Review Process

Each year, employers must send Copy A of Form W-2 (Wage and Tax Statement) to the Social Security Administration to report each employee’s wages and tax withholding for the previous calendar year. A Form W-2 must also be given to each employee. W-2 forms are sent to Social Security along with a Form W-3 (Transmittal of Income and Tax Statements).

The Problem that Creates the Opportunity: The IRS does not begin to receive and match W-2 information until after the January 31st deadline for W-2 distribution. Knowing this, criminals commonly file their fraudulent returns as early as possible, with the expectation that it could be quite some time before the IRS actually has an opportunity to compare the reported wage and income information to the actual wage and income information reported by the employer. By that time, the fraudulent individual tax return has already been processed, and the fraudulent refund has already been received.

Clearly, with 752,656 fraudulent federal tax returns using 277,624 stolen EINs - resulting in fraudulent refunds issued totaling more than $2.2 billion in tax year 2011 alone - criminals have an understanding of the process, and their expectations have merit.

The Impact on Victimized Businesses:
Suddenly, the IRS and state tax agencies come calling...