4.10.27. Identity Theft Case Processing for Field Examiners

(1) Identity theft occurs when someone uses an individual’s or business’s personal information, such as name, taxpayer identification number (TIN) (e.g., social security number (SSN) or employer identification number (EIN)) or other identifying information without permission with the intent to commit fraud or other crimes. When an examiner is advised or otherwise becomes aware that a taxpayer may be a victim of identity theft, the examiner must take certain actions. This IRM provides guidance for actions that must be taken to address and resolve identity theft issues.

(2) All identity theft cases are considered priority workload.

(1) IRM 1.2.1.17.1, Policy Statement 10-1 (formerly P-25-1), Assisting taxpayers who report they are victims of identity theft.

(2) IRC 7529, Notification of suspected identity theft.

(1) The Director, Examination Headquarters, is the executive responsible for providing policy and guidance for field employees and ensuring consistent application of policy, procedures and tax law to effect tax administration while protecting taxpayers’ rights. See IRM 1.1.16.5.5, Examination Headquarters, for additional information.

(2) The Director, Examination Field and Campus Policy, reports to the Director, Examination Headquarters, and is responsible for the delivery of policy and guidance that impacts the field examination process. See IRM 1.1.16.5.5.1, Examination Field and Campus Policy, for additional information.

(3) Field Examination General Processes (FEGP), which is under the Director, Examination Field and Campus Policy, is the group responsible for providing policy and procedural guidance on standard examination processes to field employees. See IRM 1.1.16.5.5.1.1, Field Examination General Processes, for additional information.

(4) Examiners, their managers, and clerical support staff should thoroughly acquaint themselves with the examination procedures and information contained in this IRM.

(5) All examiners must perform their professional responsibilities in a way that supports the IRS Mission. This requires examiners to provide top quality service and to apply the law with integrity and fairness to all.

(6) Examiners are responsible for knowing and acting in accordance with the Taxpayer Bill of Rights (TBOR), which includes the taxpayer’s right to be informed and the right to quality service. See IRM 4.10.1.2.1, Taxpayer Bill of Rights (TBOR), for additional information on the TBOR. Examiners must ensure taxpayers receive prompt and clear communications of IRS determinations regarding identity theft, actions taken to protect and/or correct the tax account, and identity theft resources available to taxpayers. Additionally, examiners should be aware of the impact being an identity theft victim may have on a taxpayer and handle the contact with an additional level of sensitivity and understanding.

(7) Examiners and other group personnel will work closely with employees in the Wage and Investment (W&I) Identity Theft Victim Assistance (IDTVA) and Return Integrity Verification Operations (RIVO) functions to resolve identity theft issues.

(8) For guidance specific to LB&I, please visit the LB&I Identity Theft page in the Exam Procedures Knowledge Base.

(1) Monthly Examination Returns Control System (ERCS) reports are used to track the number of identity theft cases closed during the month, the number of identity theft cases currently open, and to identify cases missing appropriate identity theft tracking codes.

(1) See IRM 25.23.1.1.2, Terms/Definitions/Acronyms, and IRM Exhibit 25.23.1-1, Glossary of Identity Protection Terms and Definitions, for common terms, definitions, and acronyms associated with identity theft.

(2) The following table contains a list of terms used throughout this IRM and their definitions.

(3) The following table lists acronyms used throughout this IRM and their definitions.

(1) There are multiple resources employees will use specific to identify theft, including but not limited to:

• IRM 25.23, Identity Protection and Victim Assistance

• IRM 25.25, Revenue Protection

• SB/SE Field Examination Identity Theft - Assistance to Victims book on Knowledge Management

• LB&I Identity Theft page on Knowledge Management

• Area Planning and Special Programs (PSP) Identity Theft Coordinators

• Lead Sheet Issue Reference Guide (LSIRG)

• Identity theft is an emerging area resulting in frequent updates. Examiners should regularly check for Servicewide Electronic Research Program (SERP) Interim Procedural Updates (IPU) and Interim Guidance (IG) updates.

(1) There are multiple ways examiners may encounter identity theft during an examination, including (not all-inclusive).

• Integrated Data Retrieval System (IDRS) research may reflect an identity theft indicator. See IRM 25.23.2.4, IDT Indicators - Tax Related, and IRM 25.23.2.8, Miscellaneous Identity Theft Indicators.

• The taxpayer may inform the examiner they did not file the tax return under examination.

• The taxpayer may advise the examiner their identity was compromised (e.g., a lost or stolen wallet or questionable credit card activity), but there is no known tax administration impact. See IRM 4.10.27.4.1.

• The taxpayer may inform the examiner they never requested an employer identification number (EIN) or never had a business.

• Examiners may discover Forms W-2 or 1099 posted to the taxpayer's account that do not appear to belong to the taxpayer. For example, Form W-2 has a different name or address as a result of identity theft.

• A duplicate return (TC 976) that is not an amended return may be posted to the account.

• Examiners may receive Form 4442, Inquiry Referral.

• The taxpayer may appear to be a nonfiler, but their return is posted to MFT 32 instead of MFT 30 or the return is unpostable with an unpostable code (UPC) 126-0 as a result of the IRS’s Taxpayer Protection Program. This applies only to IMF taxpayers. See IRM 4.10.27.17 for additional information.

Caution: A taxpayer’s account may indicate that no return was filed. Before creating a substitute for return (SFR) (see IRM 4.12.1, Nonfiled Returns), examiners must verify the taxpayer’s valid return was not posted to MFT 32 or went unpostable with UPC 126-0. IRM 4.10.27.17 and IRM 4.10.27.17.1 provide guidance for determining if a taxpayer’s return was posted to MFT 32 or went unpostable with UPC 126-0.

(2) Examiners should be alert in all cases that identity theft may have occurred, including when the taxpayer does not respond to correspondence. A taxpayer who does not respond to correspondence may be a victim of identity theft. Examiners should verify the correct current address of the taxpayer. SB/SE field examiners should refer to IRM 4.10.2.8.3, No Response/No Show Procedures, and IRM 4.10.2.8.4, Undeliverable Initial Contact Letter, for assistance.

(3) SB/SE field examiners should contact their Area PSP Identity Theft Coordinator for assistance on identity theft cases. LB&I examiners should contact the LB&I Identity Theft Point of Contact (POC).

(1) The IDTVA function within W&I handles identity theft inquiries and assists taxpayers who are victims of identity theft. If a taxpayer contacts IDTVA and the identity theft inquiry involves an audit (open or closed), IDTVA will prepare a Form 14027-B and forward it to the Area PSP identity theft coordinator for assignment.

(2) The group's clerical staff will notify the manager when a Form 14027-B and other related identity theft information is received in the group and provide the information to the assigned examiner.

(3) If an examiner receives Form 14027-B, the examiner must acknowledge receipt by filling out Section V on page 2 and faxing the form to the IDTVA employee within 10 business days. The fax number for the IDTVA employee should be located in Section II line 4 of Form 14027-B.

(4) If sufficient documentation supporting the identity theft has not already been submitted to the IRS, the examiner may need to secure additional documentation to authenticate the taxpayer's identity and evidence of the identity theft. See IRM 4.10.27.3 for documentation requirements. If the taxpayer does not provide supporting documentation when requested, proceed with case resolution as if the taxpayer is not an identity theft victim.

(5) The examiner must take applicable steps for resolving the identity theft issue based on the facts and circumstances of the case.

(6) When the case is resolved and/or account actions are complete, the examiner must complete Form 14027-B through Section VIII and return it to the IDTVA employee.

(1) Form 14566 is used when referring BMF identity theft cases between business units for actions needed to resolve the identity theft issue. If an examiner is assigned a case with Form 14566, the examiner must take actions to address the issues noted on the referral.

(2) If the documentation supporting the identity theft has not been submitted to the IRS, the examiner may need to secure additional documentation to authenticate the taxpayer's identity and evidence of the identity theft. See IRM 4.10.27.3 for documentation requirements.

(3) The examiner will take applicable steps for resolving the identity theft issue based on the facts and circumstances of the case.

(4) When the case is resolved and/or account actions are complete, the examiner must document Form 14566 with actions taken to address the BMF identity theft issue. The examiner must return the completed Form 14566, through their BOD’s BMF Identity Theft Liaison, to the employee who initiated the referral via secure e-mail.

(5) See IRM 25.23.9.8, Business Master File (BMF) Identity Theft Referrals, for additional information.

(1) Non-tax related identity theft occurs when a taxpayer’s or dependent’s information has been compromised and/or used without permission (e.g., a lost or stolen wallet, questionable credit card activity, data breach, SSN used by someone else to obtain employment or other types of income (i.e., employment or income related identity theft), etc.), but the identity theft doesn’t affect the taxpayer’s MF tax account. See IRM 25.23.1.1.2(1), Terms/Definitions/Acronyms, and IRM Exhibit 25.23.1-1, Glossary of Identity Protection Terms and Definitions.

(2) If the taxpayer’s identity has been compromised but there is no known impact to the MF tax account, the examiner should take the following actions:

1. Inform the taxpayer that identity theft resource information can be obtained by visiting the IRS identity theft website, https://www.irs.gov/identity-theft-central, or by calling the IRS identity theft toll-free number, 1 800-908-4490.

2. Advise the taxpayer that additional information is available in Pub 5027, Identity Theft Information for Taxpayers. If needed, provide a copy of Pub 5027 to the victim.

3. For individual taxpayers, advise the victim the best way to protect their TIN (SSN/ITIN) is by participating in the IP PIN Program. See IRM 25.23.2.9, Identity Protection Personal Identification Number (IP PIN), for options available for individuals to enroll in the program. The information is also available on the IRS identity theft website.

4. Continue the examination as normal as there is no tax administration impact due to identity theft. The examiner should not input identity theft tracking indicators.

   Note: For all cases of employment-related identity theft involving Form W-2, Wage and Tax Statement, the examiner must assist the taxpayer by notifying the Social Security Administration (SSA) to correct the earnings record for the victim’s SSN. See IRM 25.23.13.3.1, Form 9409 Procedures - IRS/SSA Wage Worksheet, for procedures on submitting the form.

(3) If an IMF taxpayer provides identity theft substantiation (e.g., Form 14039, Identity Theft Affidavit, etc.) for non-tax related identity theft, the examiner should forward the documentation along with Form 4442, Inquiry Referral, to IDTVA by fax at 1-855-807-5720. Upon receipt of identity theft substantiation for non-tax related identity theft (IMF), IDTVA will input identity theft tracking indicators on the account (see IRM 25.23.2.8.1, IMF TC 971 AC 504).

(4) Refer to the following IRMs for additional information:

• IRM 25.23.2.2.1, Taxpayer Interaction

• IRM 25.23.12.3, Non-Tax-Related Identity Theft - Self Identified

• IRM 25.23.9.2.1, Non-Tax related Identity Theft

(1) Identity theft tracking indicator codes are used to facilitate Servicewide tracking and reporting of both tax-related and non-tax related identity theft incidents. Examiners must ensure the proper identity theft tracking indicator codes are on a victim’s account when tax administration is impacted. See IRM 4.10.27.6.1.4 for instructions on requesting tracking indicators be input on a taxpayer’s account.

(2) Each indicator is input as a TC 971 with an action code (AC) and tax administration source code (SC), and is displayed on IDRS via several command codes (e.g., ENMOD (IMF and BMF), IMFOL with definer E (IMF), TXMOD with definer A (BMF), or BMFOL with definer T (BMF)) of the affected taxpayer’s account. The AC and tax administration SC are dependent upon the facts and circumstances of the case.

1. The AC is a three digit code. While some ACs are used to track the progression of inventory (AC 522) others provide taxpayer protections (AC 501 and AC 506). See IRM 25.23.2.4, IDT Indicators - Tax Related, and IRM 25.23.2.8, Miscellaneous Identity Theft Indicators, for additional information regarding identity theft related action codes.

2. The tax administration SC flags accounts at different stages of processing, from initial identity theft allegation to closure, dependent upon case specifics. Additional information for the tax administration SCs per business operating division and AC is in IRM Exhibit 25.23.2-10, IMF Only TC 971 AC 522 Tax-Related Identity Theft, Case Status (Initial Claim/Suspicion), and IRM 25.23.9.6, Business Master File (BMF) Identity Theft Tracking Indicators.

(3) For assistance with interpreting and using IMF identity theft tracking indicators, examiners should refer to IRM 25.23.2, Identity Protection and Victim Assistance - General Case Processing. The different components of identity theft tracking indicators for IMF identity theft are described and defined throughout IRM 25.23.2, including the following subsections:

1. IRM 25.23.2.4.1, Tracking and Reporting Identity Theft Cases - Identity Theft Indicators

2. IRM 25.23.2.4.4, Initial Allegation or Suspicion of Tax-Related Identity Theft - IMF Identity Theft Indicators

3. IRM Exhibit 25.23.2-1, Acronyms and Definitions

(4) For assistance with interpreting and using BMF identity theft tracking indicators, refer to IRM 25.23.9.5.2, Tracking Business Master File (BMF) Tax-Related Identity Theft Inventory.

(1) SB/SE Examination and LB&I monitor identity theft cases open on AIMS/ERCS using ARC 014, Identity Theft, when tax administration is impacted.

(2) Examiners must update AIMS/ERCS with ARC 014 for each impacted open tax year when the taxpayer claims to be a victim of identity theft or provides documentation to substantiate identity theft.

(3) The ARC 014 remains on the AIMS/ERCS record regardless of the taxpayer submitting the substantiation documentation or the examiner’s determination of identity theft.

(4) ARC 014 has priority and will overlay all other ARCs, except ARC 095, TC 150 was determined the perpetrator return, a second valid return posted and selected for examination.

(5) Examiners must input ARC 095 on the AIMS/ERCS and MFT AD record (see IRM 4.10.27.6.3.1) if the victim’s true return is examined after account corrections are completed.

(1) When tax administration is impacted, time spent working identity theft issues must be tracked. Activity Code 557 is used to charge time spent working identity theft issues whether or not the case is open on AIMS/ERCS. See IRM 4.10.27.6.3.1 and IRM 4.10.27.6.3.2.

(1) The examiner should secure a current TXMOD and determine if any tax period(s) impacted by identity theft are in collection Status Codes 22, 24, or 26. Refer to the instructions in CFOL Express for How to Determine if Collection is Assigned to Your Case to determine the collection status.

1. If yes, collection suspension must be made before the request for victim account corrections are submitted. The examiner will follow the directions per IRM 4.10.27.8.2 depending on the collection status code.

2. If no, the examiner will notate the case activity record or the workpapers to reflect that the TXMOD analysis reflected no collection activity.

(1) After determining a tax period impacted by identity theft is in Collection status codes 22, 24, or 26, the examiner must suspend collection activity before the request for victim account corrections are submitted.

(2) The examiner must take the following actions if at least one of the identity theft tax years is in collection Status Code 26:

1. Complete Form 14394, Identity Theft Collection Alert, and notate whether a balance due will remain on the identity theft tax period after the adjustment.

2. Fax or e-mail the completed Form 14394 to the applicable Collection function.

   Note: Obtain the revenue officer’s assignment number from the CL-ASGMT field on the TXMOD. Form 14394 provides instructions to help the examiner locate the assigned revenue officer and fax number.

(3) The examiner must take the following actions if the identity theft tax year(s) is in Status Code 22 or Status Code 24 and no other years are in Status Code 26:

1. Complete Form 14394 and notate whether a balance due will remain on the identity theft tax period after the adjustment.

2. E-mail the completed Form 14394 to the appropriate location identified in the instructions on Form 14394.

(4) Document the actions taken on the case activity record or the workpapers.

(1) If the return is determined to be a nullity, the examiner should follow the applicable instructions in IRM 4.10.27.12 or IRM 4.10.27.13 for correcting the victim’s account.

(1) This section contains instructions for examiners when it is necessary to reprocess a return to a correct TIN. The instructions can also be used to reprocess a return to a correct tax year.

(2) The examiner will secure the original return. The examiner must determine if the original return was paper filed or electronically filed prior to correcting the TIN (or tax period).

(3) To determine if the original return was paper filed (and secure the paper return):

1. Secure a print of Command Code (CC) IMFOL or BMFOL ‘I’. Under the "Return Posted" column, if the tax period displays "Posted", it means that a paper return was filed. The examiner can secure the original paper return from the campus by requesting CC ESTAB using Form 2275, Records Request, Charge and Recharge. Submit the completed form to the Area AIMS/ERCS Analyst for processing.

2. The Area AIMS/ERCS Analyst will either receive the return and forward it to the requestor or a Form 4251, Return Charge-Out, will be sent stating where the return can be located or that the return is "Not in File."

3. The Area AIMS/ERCS Analyst will follow the lead provided on Form 4251 and inform the requestor of their findings. If the return is "Not in File" follow instructions in (d) below.

4. If the return cannot be secured through ESTAB, submit a "Special Search" request on Form 2275 to the Area AIMS/ERCS Analyst to forward to campus to search the files. See IRM 3.5.61.16.1, Background.

5. If the original return could not be secured using the procedures above, contact the taxpayer to request a copy of the return (if not already provided). The copy may be reprocessed by following the applicable steps outlined in paragraph 4 below.

(4) If the paper filed return still cannot be secured using the procedures above, a Dummy Return must be created. Available command codes, such as CC RTVUE / BRTVU or TRDBV, may provide sufficient information to recreate the return. If enough information is available, a "dummy" return can be completed and forwarded to Submission Processing for posting to the correct TIN (or tax Period).

1. Attach a print of the command code information secured to the back of the "dummy" return. Secure a CC TRDBV print to obtain the correct tax return numbers to enter on a tax return you will complete for the reprocessing. Write Dummy Return across the top of the tax return.

2. Write the Document Locator Number (DLN) from the document that could not secured across the top right hand corner of the "Dummy Return."

(5) To determine if the original return was filed electronically, secure a print of CC IMFOL or BMFOLI ‘I’. Under the "Return Posted" column, if the tax period displays "MEF", it means that the return was filed electronically. An electronically filed return can also be determined by the first two digits of the DLN, associated with the TC 150 - see Document 6209, IRS Processing Codes and Information, Section 4 (3), Campus and File Location Codes, for a list of electronic filing DLNs.

(6) If it is determined that the taxpayer filed an electronic return, the return can be secured using Modernized e-file (MeF) application, Return Request Display (RRD) in the Employee User Portal (EUP). CC TRPRT (Tax Return print) can also be requested and used to reprocess the return. A TRPRT is a graphical (form image) print of a tax return stored on TRDB (Tax Return Data).

(7) The examiner will complete Form 3870 and:

1. Annotate in Item 11, "Reason for Adjustment," the following comments: "Return posted to the incorrect TIN (or tax period). Please reprocess the attached return to the following TIN (or tax period)", whichever is applicable.

2. In Item 30, "Remarks," provide a complete explanation of how the account is to be reprocessed.

(8) Keep a copy of the return information and other pertinent documents for your files.

(9) Forward the return and Form 3870 to CCP by either mail or EEFax. If the original return is secured, it must be mailed. All other forms of the return can be e-faxed to CCP.

(10) If mailing an original return and Form 3870 to CCP, use the following address and mail via overnight mail:

SB/SE Areas 201-207:
IRS - Centralized Case Processing
ATTN: FORT (Field Office Resource Team)
5333 Getwell Road
Memphis, TN 38118
EFax: See CCP Exam EFax Numbers for the EFax number to CCP in Memphis.

Areas 212-214 and 315:
IRS - Centralized Case Processing
ATTN: CCP Manager
Mail Stop 8412-G
7940 Kentucky Drive
Florence, KY 41042
Fax: See CCP Exam EFax Numbers for the EFax number to CCP in Cincinnati.

LB&I Groups:
IRS - CCP - Mail Stop 4020
ATTN: FORT
1973 N. Rulon White Blvd.
Ogden, UT 84404-5402
Fax: See CCP Exam EFax Numbers for the EFax number to CCP in Ogden.

(11) The reprocessing of returns takes approximately eight weeks to complete.

(12) Once the examiner has been notified by CCP that the reprocessing action has been completed, the group must close both the AIMS and ERCS controls for the incorrect TIN (or tax period) by completing Form 10904, Request for Record Deletion from AIMS/ERCS, using Disposal Code 33.

(13) The group will close the AIMS and ERCS controls on the incorrect TIN (or tax period) once notified by CCP that the reprocessing action has been completed. AIMS and ERCS controls are closed by completing Form 10904, Request for Record Deletion from AIMS/ERCS, using Disposal Code 33. Provide the reason for the request on the form. Update the ERCS record to status 41 and forward Form 10904 to the local AIMS/ERCS analyst for processing.

(14) The group will establish AIMS/ERCS controls using the correct TIN (or tax period) with managerial approval. Assistance from the local AIMS/ERCS analyst is available as needed.

(15) Once the return is reprocessed, AIMS/ERCS controls have been closed on the incorrect TIN (or tax period), and AIMS/ERCS controls have been established on the correct TIN (or tax period), the examiner can forward their completed audit to the appropriate CCP FORT or Technical Services office for final closure of the examination.

(1) When the taxpayer does not have a TIN and an adjustment needs to be made to the taxpayer’s account on MF, the following options are available:

• The taxpayer may request a temporary TIN called an Individual Taxpayer Identification Number (ITIN). The ITIN is given by the IRS, not the Social Security Administration, and begins with the number "9".

• The IRS may request a TIN for the taxpayer called an Internal Revenue Service Number (IRSN).

(2) If the taxpayer does not have an EIN or SSN and refuses to file Form SS-4, Application for Employer Identification Number, or Form SS-5, Application for a Social Security Number Card (Original, Replacement or Correction), the examiner can secure an IRSN by completing Form 4442, Inquiry Referral, for BMF taxpayers or Form 9956, Request for Temporary SSN, for IMF taxpayers. Follow the instructions below:

1. Form 4442 is faxed to the Entity function at the Cincinnati Campus or Ogden Campus for BMF taxpayers.

2. Form 9956 is faxed to the Entity function at the Austin Campus or Fresno Campus for IMF taxpayers.

3. Instructions for completion of Form 4442 are included on the form. In addition, when requesting an EIN for a BMF taxpayer, include your request in "Section B - Taxpayer Inquiry/Proposed Resolution" stating you are requesting an IRSN for a BMF taxpayer and request the account be established on MF.

4. When completing Form 9956 be sure to check the "YES" box next to the question "Would you like the account established on Master File."

(3) For additional information on TINs, see IRM 3.13.2, BMF Account Numbers, and IRM 3.13.5, Individual Master File (IMF) Account Numbers.

(4) Once the taxpayer has a valid TIN, the valid return filed under someone else’s TIN may be reprocessed to the taxpayer’s TIN following procedures in IRM 4.10.27.9.2.

(1) IRM 4.10.27.12.1.1 through IRM 4.10.27.12.1.5 provide specific instructions for the examiner to take when processing cases where no TC 300 posted to MF based on the five scenarios outlined in Table 1 at IRM 4.10.27.12.

(1) IRM 4.10.27.12.2.1 through IRM 4.10.27.12.2.5 provides specific instructions for the examiner to take when processing cases where a TC 300 posted to MF based on the five scenarios outlined in Table 2 in IRM 4.10.27.12.

(1) The examiner must prepare the Form 4442 package containing the following:

1. Form 4442

   Note: The group manager must sign Form 4442 (Part I, Line 7) to show approval for account corrections.

2. Copy of the victim’s identity theft substantiation documentation (e.g., Form 14039, police report, etc.)

3. CC MFTRA U print, if secured (do not attach any other IDRS prints because the BITER team will secure if needed)

4. Any correspondence to or from the victim

(2) A separate Form 4442 must be prepared and submitted to the BITER team for each tax year that reversals need to be made on a victim’s account. Supporting documentation does not need to be duplicated and attached to each year. The supporting documentation, if the same for all years involved, only has to be attached to the most recent year’s Form 4442 (e.g., 2018, 2019, and 2020, only attach supporting documentation to Form 4442 for 2020).

(3) When preparing Form 4442:

1. Write "EXPEDITE - IDENTITY THEFT" across the top of each Form 4442.

2. Input "FIELD EXAM" or "LB&I" and include your Area’s primary business code (PBC) in Part 1, Box 4 - Location.

3. Include specific instructions (in Part III Section B) on actions needed to correct the account. See IRM sections referenced in Table 1 or Table 2 in IRM 4.10.27.12 for specific language to be used in Part III Section B. Attach a continuation sheet to Form 4442 if additional space is needed to provide instructions to the BITER team.

(4) To submit the "Form 4442 Package" to the BITER team, send an encrypted e-mail to *SBSE CCS BSC EXAM IDT.

(5) Incomplete referrals will be rejected back to the originating group.

(6) BITER will assign a CIS number to the referral and provide it to the examiner by email.

(7) While the reversals for the identity thief’s return data are being processed by the BITER team, examiners should continue with the examination of the victim’s return, if warranted. BITER will notify the examiner when the actions are completed.

(8) Examiners should periodically check transcripts to see if the reversals are posted on the account even if a confirmation e-mail has not been received. The examiner should follow-up if no contact from the BITER team is received within 12 to 15 weeks. If needed, contact the Area PSP Identity Theft Coordinator for assistance.

(1) A Form 14566 package is required to be submitted to the W&I-AM BMF function for BMF identity theft account corrections.

(2) The examiner must prepare the Form 14566 package containing the following:

1. Form 14566

2. Copy of the victim’s identity theft substantiation documentation (e.g., Form 14039, Identity Theft Affidavit; Form 14039-B, Business Identity Theft Affidavit; police report, etc.)

3. Other documentation supporting a determination of identity theft (IDRS research, etc.)

4. Any correspondence to or from the victim

(3) Examiners should refer to IRM Exhibit 25.23.9-6, Business Master File (BMF) Identity Theft Referral Form, for instructions on completing Form 14566. In the "Explanation for identity theft determination (required)" section, enter instructions or language regarding account corrections requested. Some or all of the language used on Form 4442, Inquiry Referral, for IMF identity theft cases (see IRM 4.10.27.12.1.1 through IRM 4.10.27.12.1.5) may be applicable for BMF account correction requests and can be used on Form 14566 as appropriate, based on the facts and circumstances of the case.

(4) A separate Form 14566 must be prepared for each tax year that reversals need to be made on a victim’s account. Supporting documentation does not need to be duplicated and attached to each year. The supporting documentation, if the same for all years involved, only has to be attached to the most recent year Form 14566 (e.g., 2018, 2019, and 2020, only attach supporting documentation to Form 14566 for 2020).

(5) To submit the Form 14566 package, send an encrypted e-mail to your BOD’s (SB/SE Field Exam or LB&I) BMF Identity Theft Liaison. The liaison will review the package for accuracy and completeness and forward to the BMF identity theft liaison for W&I-AM BMF. The W&I-AM BMF liaison will acknowledge receipt of the referral within three business days and advise the referring function the case has been accepted into their inventory and assigned to the appropriate team for resolution.

(6) The estimated timeframe for completion of account corrections is 30 days. W&I-AM BMF may advise more time is needed depending on the account correction actions requested. Once all requested actions have been taken, the W&I-AM BMF employee will return the completed BMF identity theft referral to their liaison, who will then send it through the originator’s BMF identity theft liaison and they will return it to the examiner. See IRM 25.23.9.8, Business Master File (BMF) Identity Theft Referrals.

(7) The examiner should monitor the account and follow-up with their BOD’s BMF identity theft liaison if account corrections are not processed within 60 days.

(1) All Identity theft account corrections must be approved, in writing, by the group manager. Unlike the Form 4442 used for IMF identity theft, the forms used to correct BMF accounts do not include a place for the manager’s signature; therefore, it is necessary to obtain written managerial approval for BMF account corrections in an alternative manner. The written approval method can be at local management’s discretion as long as the written approval:

• Includes a description of the specific BMF identity theft issues (e.g., identity thief’s return posted to the victim’s account, prior audit assessment based on the identity thief’s return), similar to the information included on Form 4442 to correct IMF identity theft.

• Clearly shows what actions the examiner is taking to correct the account (e.g., submit Form 14566 package to reverse the identity thief’s return, submit an abatement request to CCP to reverse a prior audit assessment), and

• Shows the manager approved each action.

(2) The following are examples of how written managerial approval can be obtained for BMF account correction (not all-inclusive).

(3) The examiner must save the manager’s written approval in the RGS case file. See IRM 4.10.27.15 for RGS procedures.

(1) The RGS case file will generally include but is not limited to the following:

1. Identity thief's return (or RTVUE or BRTVU of identity thief's return)

2. Form 9984, Examining Officer’s Activity Record

3. Form 4251, Return Charge-Out, for the identity thief's return, if applicable

4. Form 2363, Master File Entity Change

5. Form 5348, AIMS/ERCS Update

6. Form 14394, Identity Theft Collection Alert

7. Audit reports, workpapers, 30/90 day letters, and other pertinent audit documents if the identity thief's return was previously audited

8. Form 14039, Identity Theft Affidavit

9. Form 14027-B, Identity Theft Case Referral

10. Form 14566, BMF Identity Theft Referral

11. Form 14039-B, Business Identity Theft Affidavit

12. Police report, if applicable

13. Documentation secured from victim

14. Any other significant documentation secured or prepared (e.g., Form 4442 package, Form 14566 package, partial abatement/assessment documentation, etc.) while assisting the victim

15. Identity theft issue lead sheet

(1) If the secured delinquent return is accepted as filed, follow procedures in IRM 4.4.9.6.3, Delinquent Return Secured by Examination After SFR TC 150 Posted - Accepted as Filed Procedures, and IRM 4.4.9.6.3.1, Prepare Examination Report and Form 5344, Examination Closing Record, to incorporate the amounts on the secured delinquent return into an examination report and assess as a TC 300. Applicable RGS procedures can be found in the Identity Theft RGS Procedures – IMF (All) and BMF (No TC 300 Posted to MF) and Identity Theft RGS Procedures – BMF (TC 300 Posted to MF) job aids.

(1) After the account is corrected, the secured return or TC 976 duplicate return must be processed as a partial assessment. Prepare the examination report starting with zero per return to reflect tax, credits, etc. per return. Refer to IRM 4.4.9.6.4.1, Prepare Examination Report and Form 5344, Examination Closing Record, and IRM 4.4.9.6.4.2, EFax to Centralized Case Processing (CCP), for partial assessment processing instructions. Applicable RGS procedures for partial assessments can be found in the Identity Theft RGS Procedures – IMF (All) and BMF (No TC 300 Posted to MF) and Identity Theft RGS Procedures – BMF (TC 300 Posted to MF) job aids.

(2) If the audit of the victim’s return does not result in adjustments, refer to IRM 4.4.9.6.5.1, No Additional Adjustments Required/Prepare RAR (Revenue Agent Report) and Form 5344, Examination Closing Record, for examination report and closing procedures.

(3) If the audit of the victim’s return results in additional adjustments, refer to IRM 4.4.9.6.5.2, Additional Adjustments Required/Prepare RAR and Form 5344, Examination Closing Record, for examination report and closing procedures.

(4) Note: See Handling hardcopy original delinquent tax returns and amended returns for required procedures to send the delinquent return to Campus after it has been digitized and saved in the RGS electronic case file.

(5) When the identity theft aspect is resolved and the account has been corrected, the examiner must update the impacted tax year(s) to ARC 095.

(1) If a taxpayer’s account doesn’t show a return as being filed (no TC 150 posted), examiners should review TXMOD and IMFOL transcripts to determine if TPP codes are on the account and/or the return was posted to MFT 32. Follow the instructions in the table below if TPP codes are on the account and/or the return is posted to MFT 32.

(2) Returns for the current tax year and immediately preceding tax year can be systemically posted to MFT 30. RIVO will send returns for earlier years to Submission Processing to be processed and posted.

(3) Once the return is posted to MFT 30, verify the statute is correct on the module and proceed with the examination, if warranted.