25.23.2. Identity Protection and Victim Assistance - General Case Processing

(1) For a list of acronyms, see Exhibit 25.23.2-1 , Acronyms and Definitions.

(2) For terms and definitions see IRM 25.23.1.1.2 , Key Definitions, and Exhibit 25.23.1-1 , Glossary of Identity Protection Terms and Definitions.

(3) For program background, see IRM 25.23.1.1.1 , Background of the Identity Protection Program.

(1) Throughout IRM 25.23.2, Identity Protection and Victim Assistance - General Case Processing, there are links/references to other IRMs for handling program specific issues.

(2) Employees are responsible for familiarizing themselves with and utilizing all linked/referenced IRMs, as appropriate. This includes, but is not limited to sections, within the following:

• IRM 2, Information Technology

• IRM 3, Submission Processing

• IRM 4, Examining Process

• IRM 5, Collecting Process

• IRM 10.5 , Privacy and Information Protection

• IRM 11.3, Disclosure of Official Information

• IRM 13, Taxpayer Advocate Service

• IRM 20, Penalty and Interest

• IRM 21, Customer Account Services

• IRM 25, Special Topics

• IRM 25.23.1, Identity Protection and Victim Assistance - Policy Guidance

• IRM 25.23.3, IMF Non-Tax-Related IDT and Specialized Programs

• IRM 25.23.4, IDTVA Paper Process

• IRM 25.23.9, Business Master File (BMF) Identity Theft

• IRM 25.23.10, Compliance Identity Theft Case Processing

• IRM 25.23.11, Business Master File (BMF) Identity Theft Procedures for Accounts Management

• IRM 25.23.12, IMF Identity Theft Toll-Free Guidance

• IRM 25.23.13, Income Related Identity Theft

• IRM 25.24.1, Return Preparer Misconduct Victim Assistance - General Overview

• IRM 25.24.2, Return Preparer Misconduct Victim Assistance Specialized Accounts Management Processing

(1) All taxpayers deserve and expect courteous service. Taxpayers who have experienced identity theft are already victims, either emotionally or financially. Internal Revenue Service (IRS) employees need to be aware of the impact of being an identity theft victim and handle the contact with an additional level of sensitivity and understanding. You must also guard against unauthorized disclosures and verify you are talking to the taxpayer or their authorized representative.

(2) Victims may suffer more than the loss of funds and ruination of their credit rating. Among other costs, victims may be subjected to potential loss of opportunities, such as those associated with employment and housing.

(3) Educate the victims about the Federal Trade Commission’s website at https://www.identitytheft.gov. The FTC site provides information how to file a claim electronically or by mail. The FTC states that it IS a law enforcement agency and reporting through them removes the need to file a police report to verify the claim. This is the "one-stop-resource for victims of identity theft". For more information see IRM 25.23.12.2, Identity Theft Telephone General Guidance. In addition to informing the victim of the FTC information, advise them to:

• File Form 14039, Identity Theft Affidavit, with the IRS if the identity theft affects tax administration.

• If the taxpayer requested protection of their tax account and no tax-related identity theft has occurred, advise the taxpayer the best way to protect their TIN (SSN/ITIN) is by participating in the IP PIN program. Provide the caller with information on opting-in or applying to participate in the IP PIN Program. See IRM 25.23.12.3, Non-Tax Related Identity Theft - Self Identified, for additional information.

Reminder: If the taxpayer previously submitted a Form 14039 to the IRS for a tax-related issue, there’s no need to submit another Form 14039 unless it is submitted as the result of a separate and different incident that will change the treatment of the case (i.e., non-tax to tax related).

Reminder: Form 14039, Identity Theft Affidavit, can be mailed, faxed or sent electronically. The IRS is currently providing an on-line Form 14039 at https://apps.irs.gov/app/digital-mailroom/dmaf/f14039/ on https://www.irs.gov/. This is in addition to the fillable FTC Form 14039 available at https://www.identitytheft.gov/. Unsigned forms are acceptable.

• Review Publication 5027, Identity Theft Information for Taxpayers.

• Review the IRS website at Identity Theft Central.

• Check with their state tax agency to see if there are additional steps they could take at the state level.

(4) Taxpayers meeting Taxpayer Advocate Service (TAS) Criteria 1-4 (economic burden) will be referred to TAS, see IRM 21.1.3.18, Taxpayer Advocate Service (TAS) Guidelines.

(1) All cases involving identity theft will receive priority treatment. This includes functions not located within the IDTVA framework. Refer to IRM 25.23.1.2, Taxpayer Services - Accounts Management - Identity Protection Strategy and Oversight (IPSO), for additional information.

(2) The following forms will be treated as priority:

• Form 14039, Identity Theft Affidavit

• Form 14039(SP), Identity Theft Affidavit (Spanish)

• Form 14027-B, Identity Theft Case Referral

• Form 4506-F, Request for Fraudulent Return

• Form 15227(EN-SP), Application for an IP PIN

(1) To provide taxpayers who are victims of identity theft with a realistic expectation of the timeframe for resolution of their cases, advise them that generally cases are resolved within 120 days; however, due to extenuating circumstances caused by the pandemic, our identity theft inventories have increased dramatically and on average it is taking us 640 days to resolve identity theft cases. The IRS takes identity theft seriously and is committed to resolving identity theft cases as quickly as possible and are taking steps to reduce this backlog.

(2) The timeframe will generally be calculated from the received date of the taxpayer’s identity theft claim. Thorough IDRS/AMS research is required to identify the received date of the taxpayer’s valid claim (TPRQ/SPC1, IDT1/IDS1, TPPI, etc.) to begin calculating the timeframe for your case.

(3) Use the following table to calculate the identity theft timeframe:

(4) Be empathetic to the taxpayer's issue. Assure the taxpayer that the IRS is firmly committed to working with them to resolve their identity theft issues. Cases such as theirs require complete and thorough research to provide them with a status update and to make correct determination for case resolution.

(5) Apologize to the taxpayer for the length of time required to resolve their issue. Explain that identity theft is complex in nature and constantly changing. Suggested language is:

We apologize for the length of time it is taking to resolve your case. Identity theft is a challenging and ever-changing issue. Most cases are resolved in 120 days or less, but due to extenuating circumstances caused by the pandemic our identity theft inventories have increased dramatically and on average it is taking us 650 days to resolve identity theft cases. The IRS takes identity theft seriously and is committed to resolving identity theft cases as quickly as possible and are taking steps to reduce this timeframe.

(1) Dependent identity theft can impact any individual.

(2) Form 14039 or similar statement should be filed to report dependent identity theft. The dependent may self-report.

(3) The misuse of a dependent SSN, unrelated to tax administration, such as obtaining a credit card or driver’s license in the dependent’s name is considered non-tax related identity theft. See IRM 25.23.1.3, Identity Theft and the IRSfor the definition of non-tax related identity theft and IRM 25.23.3.2.3, Self-Identified - Non-Tax-Related Identity Theft - IDT4 Overview for processing Form 14039 for non-tax related identity theft.

(4) The use of a dependent SSN on a tax return that lists them as a dependent is considered tax related identity theft if the person claiming the SSN does so without the dependent’s knowledge or permission, unless the primary and/or secondary taxpayer on the return claiming them as a dependent is their parent or legal guardian. Individuals claimed as a dependent on a return filed by their parent or legal guardian are not victims of identity theft.

(5) For claims of tax related identity theft, if the person claiming the dependent SSN on a return is the parent or legal guardian, a determination of “No IDT” will be made. The parent/legal guardian can file a paper return claiming the dependent if they meet the requirements to claim the dependent. They can also file a Form 15227, Application for an IP PIN, to protect the dependents TIN from identity theft.

(6) A TC 971 AC 501 will be required to mark the account for a taxpayer identified claim to generate a CP01A. This is necessary because victims of dependent identity theft may not be able to opt-in for an IP PIN with secure access digital identity (SADI). A TC 971 AC 506 with MISC code field of: WI ITVAA OTHER or WI ITVAC OTHER, will be required for an IRS identified dependent identity theft. Send the appropriate closing letter.

(7) If the dependent who is determined to be a victim of identity theft is claimed on a fraudulent return that meets nullity return criteria, you will be required to resolve the fraudulent return account, if it has not already been resolved, in addition to processing the Form 14039. See IRM 25.23.4.8.2, Streamline Identity Theft (IDT) Case Identification and Processing. For dependent identity theft purposes, a return is considered valid if the income reported on the tax return is valid regardless of any dependent identity theft and any subsequent dependent related credits. .

(1) Taxpayers may initially come to IRS regarding a current year refund. Some taxpayers may not be aware that other tax modules have also been affected by identity theft.

(2) Upon receipt/assignment of an identity theft case, an initial cursory review must be performed to identify all taxpayers and all taxpayer issues. Identifying issues at the beginning of the case provides a higher level of customer service and reduces the potential for problems to go unresolved.

(3) Give special attention to cases that, by their nature, indicate a high potential for multiple year involvement. Although the following examples are not all inclusive, taxpayers who do not have a filing requirement are more susceptible to being targeted. This includes elderly, disabled and/or under-aged.

(1) All confirmed identity theft cases MUST be controlled. The case controls will remain in effect until all issues are resolved and the taxpayer is notified of actions taken. IDTVA employees will use the information provided in Exhibit 25.23.2-16, IDTVA IDRS Category Controls by Function, to control identity theft cases.

(1) Throughout this IRM, and its chapters, there will be required case and history notes for Integrated Data Retrieval System (IDRS), Correspondence Imaging Inventory (CII), and/or Accounts Management Services (AMS) as it relates to the status of an identity theft case.

(2) All actions taken on taxpayer accounts will be documented on CII, AMS and IDRS (CII actions systemically post a note on AMS). In addition, there may be functional specific systems that will require documentation of case actions and determinations.

(3) Case documentation will contain sufficient information to allow other employees to easily determine what actions were taken and what further actions are required to resolve the case. Accurate documentation promotes quality, prevents duplication of efforts by other employees, and enables phone assistors to provide accurate updates to phone inquiries.

(4) Case documentation must include sufficient information to support the determination and describe actions taken to resolve the case. When applicable, include the following information:

• Case determination and information used to justify the determination. When documenting IRPTR, research may be necessary to provide specific payer document information.

  Example: Based on IRPTR data TC 150 determined to be bad. TC 150 will be nullified.

  Example: TRDBV and IRPTR researched. Case determined to be bad/good. Account will be adjusted to the taxpayer’s TC 976 return.

• Document any forms sent to another area (e.g., Form 9409, Form 14394, Form 2859, etc.).

  Note: See IRM 25.23.4.12.1, Collection Activity – Form 14394, and IRM 25.23.4.12.2, Collection Activity – Form 13794 Additional Actions Required - Lien. Also refer to IRM 25.23.13.3.1, Form 9409 Procedures - IRS/SSA Wage Worksheet for additional information.

• Document any case referrals to another function (e.g., cases referred to Exam, DITA, Appeals, etc.).

• Document the reason for not sending a closing letter.

(5) If the AMS or CII system is down, then narratives and/or case notes will not be required when the case is worked. The narratives and/or case notes will be input when the system is available. Do not close the case until all actions have been completed.

(1) Research must be performed and documented prior to reaching a final determination of identity theft. Research using Command Codes (CC) ENMOD, IMFOL, RTVUE, NAMES, INOLE, DUPOL, FFINQ, REINF, and IRPTR.

(2) Review all returns for the year(s) involved (including returns filed at other sites AND electronic filed returns).

(3) Compare all claims and return information for:

• Name

• Social Security Number

• Address

• Occupation

• Exemptions

• Signatures (except for e-filed returns when a signature is unavailable)

• Similar tax data

• Forms W-2, etc.

• Marital status changes

• Tax return preparer

• Direct Deposit accounts

(4) Search returns, schedules, and forms for a different TIN. Research spouse and dependent information whenever available.

(5) Research the TIN (valid and invalid) to determine if there was a mixed entity or scrambled case in prior years, and to locate any possible cross-reference TIN.

1. A mixed entity is an inadvertent use of another taxpayer’s TIN. This often occurs between family members. Research of Forms W-2 or previous returns can usually locate a different valid TIN for each taxpayer.

2. A true scrambled SSN case occurs when the Social Security Administration mistakenly assigns the same SSN to two different people. NUMIDENT will show different entries for name, date of birth, place of birth, and/or parents’ names for the SSN owner.

Note: See IRM 21.6.2, Adjusting TIN-Related Problems, if your research indicates that the case may be a mixed entity or a scrambled SSN instead of identity theft.

(6) Search entity modules for indications of identity theft such as identity theft claims attached to the return or a previously posted TC 971 with Action Code (AC) 5XX.

(7) Utilize IAT Tools- refer to functional IRMs for mandatory IAT tools and to Exhibit 21.2.2-2, Accounts Management Mandated IAT Tools, for additional information.

(1) Whether a case begins because IRS has identified a tax-related identity theft or because a taxpayer has identified himself or herself as an identity theft victim, additional information may be required. If we can’t resolve the account using internal information and/or information already provided by the taxpayer, request additional information. Taxpayer information to substantiate identity theft may include:

1. Authentication of Identity - a copy of a current, valid form of identification (examples include a driver’s license, state identification card, social security card, or passport).

   Reminder: Any current US federal or state government issued identification presented MUST be signed by the taxpayer (or Legal Guardian if a minor).

   Exception: Minor’s Social Security cards should NOT be signed.

   Note: IRS no longer accepts Puerto Rican birth certificates issued before July 1, 2010, due to new laws by the Government of Puerto Rico. Taxpayers with birth certificates issued before this date must get new documentation from the Puerto Rico Vital Statistics Record Office.

2. Evidence of Identity Theft - Form 14039, Identity Theft Affidavit.

   Note: Only request a Form 14039 when the taxpayer has not previously submitted the form or when the submitted form is illegible.

3. Payor documents, such as Forms W-2 or 1099,

4. and utility bills, deeds or other proof of residency.

(2) Advise the taxpayer to enlarge photocopies, if necessary, so all information and pictures are clearly visible. If taxpayers do not provide additional information when requested, proceed with case resolution assuming the taxpayer is not an identity theft victim.

(3) The business unit/function that is assigned the identity theft case or issued the notice/letter relating to the identity theft must follow their functional procedures for soliciting additional information.

(4) Before requesting additional information, review the taxpayer's account (ENMOD/IMFOLE) to determine if a TC 971 (AC 501, 504, 505, 506, or 522) identity theft indicator exists and the related tax years. Previously submitted taxpayer information or case information may allow you to make an internal determination without further taxpayer contact. For example:

1. TC 971 AC 501 - Taxpayer initiated tax-related identity theft incident

2. TC 971 AC 504 - Miscellaneous codes indicating taxpayer initiated non-tax-related identity theft incident: ACCT, ACCT-M, BOTH, BOTH-M, EMPL, EMPL-M, NKI or NKI-M

3. TC 971 AC 505 -PGLD inputs TC 971 AC 505 on an account even when an identity theft indicator code (AC 501, 504, or 506) is present on the account.

   Note: For more information about this indicator, refer to IRM 25.23.2.8.2, IRS Data Breaches - TC 971 AC 505.

4. TC 971 AC 506 - IRS identified tax-related identity theft incident

5. TC 971 AC 522 - with any of the following Administration Source Codes present: INCOME, MULTFL, INCMUL, NOFR, OTHER, NODCRQ, IRSID or UNWORK

   Note: This excludes accounts marked with a TC 971 AC 522 reflecting “PPDS” as the BOD, “OPIP” as the Program, and “OTHER” as the Tax Administration Code

(5) Review AMS history to assist in determining if the scanned documents were initially presented in person. For taxpayers who present their documents in the TAC, determine if the Form 14039 or police report is annotated in the upper right corner with an “S”. See paragraph 2 of IRM 21.3.4.28.1, Tax Return Related Identity Theft Issues. If the “S” is present, then the TAC employee reviewed and verified the documents presented and that they were valid. If the “S” is not present, then the TAC employee was unable to verify the taxpayer is the correct taxpayer.

(6) Additional information can be accepted from the taxpayer, third party or someone who has power of attorney for the taxpayer (e.g., Form 2848, Power of Attorney and Declaration of Representative).

(1) When a return posts to an account as a TC 150, the address is updated systemically to the address on that return. Consequently, when a return filed by a non-TIN owner posts to an account as a TC 150, the address on ENMOD is updated to the address on that return. Therefore, it is important to make timely entity corrections to prevent the issuance of correspondence or refunds to the wrong address. Check IDRS for pending address changes.

(2) Taxpayers may request a change of address using a Form 8822, IMF Change of Address Request, by correspondence, or by phone through oral statement. Refer to IRM 3.13.5.52, Form 8822, IMF Change of Address Request, and IRM 21.1.3.20, Oral Statement Authority, for additional information.

(3) After confirming the person you are working with is the SSN owner, per IRM 25.23.2.3.5, Identity Theft Research, you will need to verify that the address posted on ENMOD/IMFOLE/BMFOLE is the correct address. Correct the address when appropriate. Refer to IRM 21.2.4.3.5, Address Change/Correction. Correcting the address as early as possible may prevent disclosure of taxpayer information.

(4) Change the address on MF to the new address (line 7) of Form 8822, Change of Address, if the taxpayer provides proof of identity document or other key information.

(5) The taxpayer can request a change of address in writing as long as the request contains the same information as the Form 8822, Change of Address:

• The new address

• The taxpayer’s full name

• The taxpayer’s signature, or the signature of an authorized representative

• The old address

• Social security number, employer identification number, or individual taxpayer identification number

(6) If the current address shown on CC ENMOD/IMFOLE is a Service Center/Campus Address, research for a prior address (prior tax return data, IRP documentation, CII documentation or history) to verify the prior address from the taxpayer's Form 8822, correspondence, etc.

1. If prior address research shows an address that matches, change the taxpayer’s address.

2. If prior address research shows an address (other than on a fraudulent return) that does not match the prior address on taxpayer’s Form 8822 or correspondence, contact the taxpayer using 104C letter or other appropriate letter for a correct address.

(7) If there is no prior tax return data for the taxpayer and/or no IRP documentation, or if IRP document shows an "in care of " name and different address, and CII does not show any document or history to verify the prior address, and taxpayer sent a signed, government issued ID, check for a current address on the ID document.

1. If the taxpayer’s signed, government issued ID has an address that matches the current address entered on the taxpayer’s Form 8822 or in the taxpayer's correspondence, change the taxpayer's address.

2. If the signed, government issued ID does not have an address or has a different address than given on the Form 8822 or in the correspondence, contact the taxpayer for a correct prior/current address either by telephone or using the Letter 104C or other appropriate letter

(8) Attempt telephone contact with the taxpayer or representative whenever possible. During telephone contact, verify the taxpayer’s phone number on IDRS for all account related calls in which disclosure verification has occurred. Add or update phone numbers on IDRS and specify the type of number, (i.e., home, cell, etc). If contact information is provided on correspondence and it is determined to be from the valid TIN owner, add or update the phone number(s) on IDRS. Do not close the case until all actions have been completed.

(1) Upon receipt of a claim, mark the taxpayer's account using Command Code (CC) REQ77 initiated from ENMOD to input a TC 971 AC 522 UNWORK.

(2) The Secondary Date field on CC REQ77 is limited to the current calendar year (cannot be the current day or any future date) and 7 prior years. The secondary date field will not allow the input of any date outside that range. If the year in question is earlier than the oldest allowable year, See IRM 25.23.2.3.8.1, Command Code REQ77 Secondary Date and Old Case Year Issue for more information.

(3) After receipt of the taxpayer's claim, the employee assigned will need to research the case to verify the taxpayer's claim and determine the appropriate action(s) needed. If it is later determined that identity theft did not occur, reverse the TC 971 AC 522 (refer to Exhibit 25.23.2-11, TC 972 AC 522 - Reversal of the TC 971 AC 522). Follow your IRM procedures to notify the taxpayer of your determination.

(4) A systemic notification letter is sent once a valid case is resolved and the TC 971 AC 501 is input.

(1) The Taxpayer Advocate Service (TAS) is an independent organization within the Internal Revenue Service (IRS), led by the National Taxpayer Advocate. Its job is to protect taxpayers’ rights by striving to ensure that every taxpayer is treated fairly and knows and understands their rights under the Taxpayer Bill of Rights (TBOR). TAS offers free help to taxpayers, including when taxpayers face financial difficulties due to an IRS problem, when they are unable to resolve tax problems, they haven’t been able to resolve on their own, or when they need assistance to address an IRS system, process, or procedure that is not functioning as it should. TAS has at least one taxpayer advocate office located in every state, the District of Columbia, and Puerto Rico.

(2) Refer taxpayers to TAS when the contact meets TAS criteria and you can’t resolve the taxpayer’s issue the same day Refer to IRM 13.1.7.3, TAS Case Criteria. The definition of "same day" is within 24 hours. "Same day" cases include cases you can completely resolve in 24 hours, as well as cases in which you have taken steps within 24 hours to begin resolving the taxpayer's issue. See IRM 13.1.7.5, Same Day Resolution by Operations. In cases where the taxpayer states he has a hardship, use sufficient probing to determine that a manual refund is required before referring to TAS. For additional information refer to IRM 21.1.3.18, Taxpayer Advocate Service (TAS) Guidelines.

(3) Taxpayers may request assistance during or after enforcement action. The request must meet criteria as listed in IRM 13.1.7.3, TAS Case Criteria. The identifying function will prepare Form 911, Request for Taxpayer Advocate Service Assistance (And Application for Taxpayer Assistance Order).

(1) Compromised on-line accounts are disabled, preventing SSN owners from accessing the account. EPSS employees will flag the account with a TC 971 AC 522 EPSS DISABL.

(2) Taxpayers are instructed by EPSS to file Form 14039 to secure an IP PIN to protect their compromised SSNs.

1. If the Form 14039 is received, due to a disabled account, input a TC 971 AC 522 UNWORK, if none already exists.

2. Input TC 971 AC 506 WI AM OTHER to move the taxpayer into the CP01A population.
   If not tax-related issue: Issue a 4402C letter with paragraph A, F, I and L (insert the language below in paragraph F): "To further protect you, we will issue you an IP PIN by mail starting in Mid-December and it should be received by Mid-January. You will need an Identity Protection PIN to file your tax returns in the future.".

   Caution: If the TC 971 AC 506 is not input prior to cycle 47 of the processing year (meaning an IP PIN/CP01A will not generate for the upcoming filing season) do not include paragraph F because no IP PIN will be issued for the upcoming year.

   
   If tax-related issue: Notify the taxpayer (victim), via Letter 4674C, to inform the taxpayer the actions you took.

   Caution: Do NOT include any paragraphs that refer to obtaining an IP PIN online, as these accounts are blocked.

   . This victim notification letter will include: 1. Information about identity theft prevention. 2. Information about identity theft related resources. 3. Information about the identity theft indicator placed on his or her account. 4. Provide information about the IP PIN.

(1) IPSO developed identity theft indicators as a method to track identity theft cases from the time a taxpayer or the IRS initially suspects identity theft through case closure. Identity Theft Action Codes (AC) are used with TC 971 to mark the entity modules of accounts on which identity theft is a factor. Identity theft can be tax-related or non-tax-related. Identity theft cases can be found in virtually any BOD/Function inventory. The identity theft indicators are as follows:

(2)

(3) The Service utilizes a variety of methods to ensure all identity theft related inventory is tracked within specific inventories.

(4) The indicators used on identity theft cases provide the Service with data reflecting the case status (the list below is not all-inclusive). The specific indicators are discussed at length later in this IRM.

• New taxpayer claims of identity theft

• Newly identified suspicions of identity theft (no final determination of identity theft)

• Resolved identity theft case

(1) In situations where the taxpayer makes an allegation of identity theft or when the IRS initially suspects that identity theft may have occurred, IRS functions will apply an identity theft indicator. The identity theft tracking indicator alerts others that a claim of identity theft has been reported. Refer to IRM 25.23.2.4.4, Initial Allegation or Suspicion of Identity Theft - Identity Theft Indicators, for additional information regarding the appropriate tracking indicator.

(2) In most instances, for taxpayer initiated claims of identity theft, the case MUST be moved into identity theft inventory once the taxpayer has submitted a claim of identity theft and (if requested) provided additional information. This provides victims with a treatment stream for case resolution specific to identity theft. For additional information regarding identity theft documentation, refer to IRM 25.23.2.3, Identity Theft Claims - General Guidelines.

(3) If after the account has been marked with an IMF Identity Theft Indicator, the employee determines identity theft did not occur, the IMF ID theft tracking indicator will be reversed by the employee assigned. This removes the case from identity theft inventory. See Exhibit 25.23.2-11, IMF Only TC 972 AC 522 - Reversal of TC 971 AC 522, for additional information. All other non-identity theft issues will be resolved using normal procedures.

(1) Identity thieves sometimes use the PII of individuals to establish fictitious businesses. Many times, the fictitious business is used to support the filing of fraudulent IMF returns.

(2) Employees will verify the IMF taxpayer’s association with the EIN and determine if potential BMF ID theft exists prior to marking the IMF account with a tracking marker.

(3) Research to determine if there is a potential BMF ID theft issue MUST be completed prior to marking an account and referring or transferring the case/call to another area. Researching the account will allow the employee to determine if the case should be referred to the BMF ID theft inventory or moved/transferred into the regular BMF inventory following normal procedures.

• Research CC BMFOLE (the business entity module) to determine if the taxpayer’s SSN is associated with the EIN. BMFOLE contains a XREF SSN FIELD that will provide the associated SSN. The format for CC BMFOLE is BMFOLEXX-XXXXXXX

• Research BMFOLI to look at filing and payment history. Returns filed with no payments may indicate fraudulent filings.

• Research CC IRPTRI to review all Forms W-2 filed under a given EIN. Reviewing the individual accounts associated with the W-2s may assist in determining if the case needs to be moved into the BMF ID theft inventory. IMF accounts with ID theft indicators or RIVO involvement may support the BMF ID theft claim. CC format is IRPTRIXX-XXXXXXX4YYYY21 (4=valid EIN, 21=Forms W-2)

• Research the IMF account to see if the EIN has been used on any IMF filings (i.e., Schedules C or H). If it is determined the EIN has been used for purposes other than intended, this may support the BMF ID theft claim.

(4) Once the research is completed and it is determined there is potential ID theft, research CC IMFOLE to determine if there is an existing TC 971 AC 504 SPCL2. If there is currently no ID TC 971 AC 504 SPCL2 marker, the SSN entity must be marked using CC REQ77 with a TC 971 AC 504 SPCL2 as indicated in IRM 25.23.2.8, Miscellaneous Identity Theft Indicators. Include the EIN, if available, in the XREF TIN field on CC REQ77.

(5) If the inquiry is received by phone, obtain all of the facts of the case including the EIN, business name and any other important information. For example:

• What notice the taxpayer received.

• If there is a current or former relationship to the business.

• What has been affected by the BMF ID theft (lien, levy, etc.).

(6) Include information on the Form 14566 that could help the functional liaison route the case to the appropriate area, such as:

• CAWR assessment- TC 290 assessment in blocking series 55- CC TXMOD

• Exam assessment- TC 300 assessment- CC TXMOD

• 6020b assessment - TXMOD RCC "4" and literal "6020b" at the end of the TC 150 assessment-CC TXMOD

• SFR assessment- SFR literal at the end to the TC 150 assessment - CC TXMOD

• Field Exam- Cases have a Primary Business Code 201 through 215, 301 through 309, and 315- CC AMDISA

• Field Collection- SC status 26

• ACS- SC status 22

• AM (BMF)- Any case that does not meet other account criteria

(7) Document AMS/CII, if available, to reflect the referral sent, the suspicious EIN and how the taxpayer became aware of the problem.

(8) If the taxpayer filed a Form 14039 or other written documentation to advise the IRS of ID theft relating to a business/BMF issue, a referral must be sent to the BMF functional liaison. Attach the Form 14039 and Form 14039B, if available, to the secured email when referring the case to the liaison. The BMF IDT employee will send the appropriate acknowledgment letter. IMF employees must follow the same procedures for phone inquiries above to research the account, prepare a referral to a BMF IDT liaison, input a TC 971 AC 504 SPCL2, and update AMS/CII. Allow 30 days for a response from BMF IDT.

(1) An initial allegation or suspicion of identity theft can be recognized by either the taxpayer or the IRS. IPSO developed tracking indicators to mark taxpayer accounts when the identity theft incident is initially alleged or suspected.

(2) Three Tax Administration Source codes were developed to track cases as they are initially identified:

• TC 971 AC 522 PNDCLM - for taxpayer initiated allegations of identity theft.

• TC 971 AC 522 UNWORK - for submitted identity theft claims via Form 14039, police report or other accepted correspondence.

• TC 971 AC 522 IRSID - for IRS initiated suspicions of identity theft.

(3) Prior to marking an account with TC 971 AC 522 PNDCLM, UNWORK or IRSID, research ENMOD/IMFOLE to ensure the questionable tax year has not already been marked. If the coding already exists, do not input a second, matching code for the same tax year.

(4) When the identity theft victim is the secondary TIN on a joint account, the identity theft indicator is input on the secondary SSN. Identity theft indicators are not input on the primary TIN in these instances. If both primary and secondary taxpayers are victims, place the appropriate indicator on both TINs.

(5) Taxpayer entity modules can accommodate a limited number of transactions. Due to the entity limitations, we must also limit the number of TC 971 AC 522s applied to the account.

(6) The secondary date on command code REQ77 will reflect the tax year of the incident. Apply a TC 971 AC 522 only once per tax year affected by identity theft. If there is an existing TC 971 AC 522 PNDCLM, UNWORK or IRSID for the same tax year, do not apply a second, matching code to that tax year. If there is an existing TC 971 AC 522 PNDCLM, UNWORK or IRSID refer to the table below:

(7) The Secondary Date field on CC REQ77 is limited to the current calendar year (cannot be the current day or any future date) and 7 prior years. The secondary date field will not allow the input of any date outside that range. See IRM 25.23.2.3.8.1, Command Code REQ77 Secondary Date and Old Case Year Issue for more information.

(8) Do not apply the AC 522 PNDCLM, UNWORK or IRSID to the SSN of a taxpayer when an ITIN taxpayer reports the misuse of the SSN. See IRM 25.23.2.6.1, Closing Taxpayer Initiated Identity Theft Affecting Tax Administration - TC 971 AC 501.

(9) All identity theft affected accounts will require resolution and the application of a closing identity theft marker (TC 971 AC 501 or TC 971 AC 506), as applicable.

(1) In situations where the IRS suspects identity theft may have occurred, employees will mark the entity account, using Command Code (CC) REQ77 initiated from ENMOD to input a TC 971 AC 522 reflecting a Tax Administration Source Code IRSID, and the tax year of the identity theft incident if no TC 971 AC 522 PNDCLM, UNWORK or IRSID already exists. See Exhibit 25.23.2-10, IMF Only TC 971 AC 522 Tax-Related Identity Theft, Case Status (Initial Claim/Suspicion ), for additional information.

(2) Apply the TC 971 AC 522 IRSID when you initially suspect ID theft may have occurred. Post filing Compliance programs should not enter TC 971 AC 522 IRSID until after the taxpayer has had an opportunity to respond to the IRS notice/letter, unless there is clear evidence that leads you to suspect identity theft.

(3) The Secondary Date field on CC REQ77 is limited to the current calendar year (cannot be the current day or any future date) and 7 prior years. The secondary date field will not allow the input of any date outside that range. See IRM 25.23.2.3.8.1, Command Code REQ77 Secondary Date and Old Case Year Issue for more information.

(4) Do not input more than one TC 971 AC 522 IRSID per tax year on the entity module.

(5) IPSO considers an account with a TC 971 AC 522 IRSID and no subsequent TC 971 AC 506 (indicating a completely resolved account) an open identity theft case. Subsequently, if the case is deemed NOT to be identity theft, the assigned employee will document the decision in a CII Case Note and reverse the TC 971 AC 522 IRSID with a TC 972 AC 522 IRSERR.

(6) If, at the time of case closure you find the Entity module has not been flagged with a TC 971 AC 522 IRSID, do not input this code at closing. Close the identity theft issue with a TC 971 AC 506.

(1) Review IDRS to verify:

• No TC 976/977 transactions are on the module.

• There are no unnumbered unprocessed returns received from the valid taxpayer in the case documents.

• The valid taxpayer’s return was not moved to MFT 32 in error.

(2) No action is required to protect the CN module when there is no:

• TC 976/977 return

• Unprocessed return, or

• Valid return moved to MFT 32 (when there is no TC 150 present on MFT 30

(3) If less than 180 days remain before the expiration of the ASED for the invalid return being moved to an IRSN, the IRSN module must be protected. Prepare Form 2859, Request for Quick or Prompt Assessment. Annotate at the top of the form "ID Theft Statute Year".

1. The Form 2859 will be prepared for the correct amount to protect any tax increase on the IRSN module. Input the assessment amount as a TC 150 on Form 2859. Input the following in the Remarks section: "Agreed assessment. Do not bill the taxpayer. Send no notices to the taxpayer. The TC 150 will be nullified or moved to an IRSN".

2. Do not include any tax decrease or credit increase adjustments to the account.

3. In Part B, Requestor Information, input the name and campus preparing the document.

(4) Prepare Form 3210, Document Transmittal. Fax the Form 3210, Form 2859, and the statute return to the applicable Accounting office. Attach the Form 2859 to your CII case.

(5) Update the control base to the employee requesting the quick assessment and use activity code "QUICK2859".

(6) Keep a copy of the SSN owner’s return and Form 2859 with documentation for monitoring.

(7) Complete credit transactions and transfers of excess funds after the Form 2859 has been processed and the assessment has posted.

(8) If there is a TC 976/977 return, unprocessed return, or valid return moved to MFT 32 (when there is a posted TC 150 on MFT 30), follow procedures in IRM 25.23.2.5.2, Statute Protection - Multiple Returns, or IRM 25.23.2.5.3, Statute Protection - Multiple Returns and MFT 32.

(1) The procedures below apply to cases with multiple returns received and a TC 150 posted on the MFT 30 module for the CN. If the multiple return was moved to MFT 32 in error, refer to IRM 25.23.2.5.3, Statute Protection – Multiples Returns and MFT 32.

(2) Determine the IRS received date of the taxpayer’s return. If it was filed on or before the return due date, it is considered timely filed.

(3) Determine the ASED of the taxpayer’s return – add 3 years to the received date.

(4) If the ASED is within 180 days of expiring, it is considered a STATUTE return.

(5) Compare the account, including adjustments, to determine if all assessments match the valid return figures.

(6) If 90 days or less remain before expiration of the valid ASED, and the CN module requires a tax increase or credit decrease, prepare Form 2859, Request for Quick or Prompt Assessment. Annotate at the top of the form "ID Theft Statute Year".

1. The Form 2859 will be prepared for the correct amount to protect any tax increase and credit decreases to the account based on the taxpayer’s return. Input the assessment amount as a TC 290 on Form 2859. Input the following in the Remarks section: "Agreed Assessment. Do not bill the taxpayer. Send no notices to the taxpayer. The TC 150 will be nullified or moved to an IRSN".

2. Do not include any tax decrease or credit increase adjustments to the account.

3. In Part B, Requestor Information, input the name and campus preparing the document.

(7) Prepare Form 3210, Document Transmittal. Fax the Form 3210, Form 2859 and the statute return to the applicable Accounting office. Attach the Form 2859 to your CII case.

(8) Update the control base to the employee requesting the quick assessment and use activity code "QUICK2859".

(9) Keep a copy of the SSN owner’s return and Form 2859 with documentation for monitoring.

(10) Do not make any adjustments to credit transactions on the account.

(11) Complete credit transactions and transfers of excess funds after the Form 2859 has been processed and the assessment has posted. .

(1) The procedures below apply to cases with multiple returns received with the valid return moved to MFT 32 in error.

(2) If a TC 150 is not present on the MFT 30 module, do not request a quick assessment. Follow procedures in paragraph (3) of IRM 25.23.4.15, MFT 32 Cases – Moved in Error, to refer the case to RIVO statutes for resolution.

(3) If a TC 150 is present on the MFT 30 module, continue with the procedures below to protect the account.

(4) Determine the IRS received date of the valid taxpayer’s return. If it was filed on or before the return due date, it is considered timely filed.

(5) Determine the ASED of the valid taxpayer’s return - add 3 years to the received date.

(6) If the ASED is within 180 days of expiring, it is considered a STATUTE return.

(7) Compare the account, including adjustments, to determine if the tax and credits match the valid return figures.

(8) If 90 days or less remain before expiration of the valid ASED, and the CN module requires a tax increase or credit decrease, prepare Form 2859, Request for Quick or Prompt Assessment, annotate at the top of the form "ID Theft Statute Year".

Note: An example for completing Form 2859can be found on the IDTVA Hub.

1. The Form 2859 will be prepared for the correct amount to protect any tax increase and credit decreases to the account based on the valid taxpayer’s return. Input the assessment amount as a TC 290 on Form 2859. Input the following in the Remarks section: "Agreed Assessment. Do not bill the taxpayer. Send no notices to the taxpayer. The TC 150 will be nullified or moved to an IRSN".

2. Do not include any tax decrease or credit increase adjustments to the account.

3. In Part B, Requestor Information, input the name and campus preparing the document.

(9) Prepare Form 3210, Document Transmittal. Fax both forms and the statute return to the applicable Accounting office. Attach the Form 2859 to your CII case.

(10) Update the control base to the employee requesting the prompt assessment and use activity code "Quick2859".

(11) Keep a copy of the SSN owner’s return and Form 2859 with documentation for monitoring.

(12) Do not make any adjustments to credit transactions on the account.

(13) Complete credit transactions and transfers of excess funds after the Form 2859 has been processed and the assessment has posted.

(1) These procedures are for those responsible for filling out the barred report and outlining the statute unit’s role in the process. Refer to IRM 25.23.4.9.3 Addressing Barred Assessments on Identity Theft (IDT) Cases, for instructions to resolve a barred account. When working IDT cases and it is determined an ASED has expired and an assessment cannot be made, the case must be written up as a barred assessment, unless the barred amount is within tolerance. Refer to IRM 25.6.1.13.2.4, Identifying Barred Statute Cases, for examples of barred assessments and tolerance amounts.

(2) Cases that are barred with ID Theft involvement must be resolved by an ID Theft employee. After the actions have posted to the account, the case will be referred to the local statute function for the completion of Form 9355, Barred Statute Report.

(3) The Statute Function will:

1. Prepare original and two copies of Form 9355.

2. Assign the case a control number.

3. Establish an IDRS control base using category "BARD". The category BARD cases must be processed within 99 calendar days of the case establishment date as stated in IRM 3.30.123.5.8(4), Statutes.

4. Complete all remaining actions as required per IRM 25.6.1.13.2.6, Routing and Controlling Form 9355.

(1) To indicate resolution of a taxpayer initiated identity theft claim, mark the victim's account using Command Code (CC) REQ77 initiated from ENMOD, to input a TC 971 AC 501 reflecting an appropriate Tax Administration Source Code depending upon the facts and circumstances of the case along with the tax year of the identity theft incident. The AC 501 is applied to a taxpayer's account when all of the following occur:

1. The identity theft incident was taxpayer initiated, or the identity theft incident was IRS determined but additional taxpayer information was required to resolve all issues.

2. All corrective actions have been taken. This includes verifying and updating the taxpayer's address on ENMOD, as applicable.

   Caution: Marking the account with AC 501 prior to correcting the victim's address may result in the issuance of the victim notification letter to an incorrect address and may allow an identity thief's return to post while the legitimate taxpayer's return will unpost.

3. There must be a tax-related impact to affect tax administration. This includes years in retention.

   Note: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

4. Complete Case Analysis (CCA): Perform CCA to ensure all identity theft related issues have been addressed and resolved. This includes all outstanding TC 971 AC 522s. Refer to IRM 25.23.2.6, Closing Identity Theft Issues.

   Note: Close years identified by the Taxpayer using TC 971 AC 501. Close additional years identified through CCA with TC 971 AC 501 with MISC REFCCA for refund related determinations and ICMCCA for income related determinations impacting tax administration.

5. Verify Taxpayer Address: Verifying and updating the taxpayer's address MUST be done before inputting the TC 971 AC 501.

   Reminder: Use a post delay on other transactions when changing the taxpayer’s address to prevent notices from generating to the identity thief.

6. Follow functional case closing guidance, as appropriate.

(2) TC 971 AC 501 can be input by any business unit delegated the authority and programmed to use this code when closing identity theft issues.

(3) If more than one year is affected by identity theft and resolved, the employee will enter the corresponding TC 971 AC 501 for each year listed by the taxpayer and TC 971 AC 501 with MISC REFCCA (Refund Related) or ICMCCA (Income Related affecting tax administration) for additional impacted years identified by CCA.

(4) The Secondary Date field on CC REQ77 is limited to the current calendar year (cannot be the current day or any future date) and 7 prior years. The secondary date field will not allow the input of any date outside that range. See IRM 25.23.2.3.8.1, Command Code REQ77 Secondary Date and Old Case Year Issue for more information.

(1) In some instances, it may be necessary to manually reverse TC 971 AC 501. Reversal may be necessary because of any of the following reasons:

1. TPRQ - The taxpayer requests reversal.

2. IRSERR - There was a keying or internal error in the input of the TC 971 AC 501.

3. FALSE - RESERVED

4. IRSADM - The TC 971 AC 501 has an internally identified negative affect on the taxpayer. For example, a programming issue.

5. OTHER - There are other reasonable circumstances not listed above.

(2) Actions needed prior to manually reversing an identity theft marker at the taxpayer’s request:

1. If this is a telephonic request, be certain that you are speaking with the taxpayer. Inadequate authentication of the identity of a caller could result in an unauthorized disclosure of return or return information. Refer to IRM 21.1.3.2.3, Required Taxpayer Authentication, and IRM 21.1.3.2.4, Additional Taxpayer Authentication,

2. Ask probing questions to determine why the taxpayer is requesting indicator removal and document AMS, or the case history if you do not have access to AMS, with the taxpayer’s response. For example, "Can you provide the reason why you would like this protection removed from your account?".

3. Explain to the taxpayer the indicator will:
   Help prevent future identity theft incidents
   Ensure any returns filed are reviewed for identity theft indications
   Include the issuance of an IP PIN for as long as the indicator remains active

4. If the taxpayer insists on removal of the identity theft indicator after you have explained the benefits, review the account to determine if the identity theft issue is open in another function. If there is an open identity theft case, refer the case to that function using your normal referral procedures. Do not take actions on identity theft cases being worked by another function.

(1) To indicate resolution of an IRS determined identity theft case a TC 971 AC 506 is applied to a taxpayer's account when the incident affects tax administration. Such incidents can result from any of the following:

• Phishing

• Refund schemes

• Verified false returns

• Duplicate filing research

• Certain unpostable returns

(2) Prior to marking the taxpayer's account with a TC 971 AC 506 the function MUST ensure all corrective actions have been taken which includes:

1. Verifying and updating the taxpayer's address on ENMOD, as applicable.

   Caution: Marking the account with AC 506 prior to correcting the victim's address may result in negative consequences for the victim. Letters and notices regarding the IP PIN may be directed to an incorrect address.

   Reminder: Use a post delay on other transactions when changing the taxpayer’s address to prevent notices from generating to the identity thief.

2. Advising the taxpayer of actions taken.

3. Issuing the taxpayer's correct refund.

4. Adjusting the account to the taxpayer's figures.

(3) Marking an account with TC 971 AC 506 will not generate a notice to the taxpayer regarding the resolved identity theft issue. The function that inputs the TC 971 AC 506 will notify the taxpayer (victim), by letter, that someone may have attempted to use his or her SSN. This victim notification letter will include:

• Information about identity theft prevention

• Information about identity theft related resources

• Information about the identity theft indicator placed on his or her account.

Caution: If the TC 971 AC 506 is not input prior to cycle 47 of the processing year (meaning an IP PIN/CP01A will not generate for the upcoming filing season) do not include the sentences "To further protect you, we will issue you an IP PIN by mail in December. You will need an identity protection PIN to file your tax returns in the future" as no IP PIN will be issued.

Reminder: The IP PIN will generate annually for as long as the indicator remains active.

Reminder: If, at the time of case closure you find the Entity module has not been flagged with a TC 971 AC 522 PNDCLM/UNWORK/IRSID, do not input this code at closing. Close the identity theft issue with TC 971 AC 50X, as appropriate.

(4) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(5) In some instances, it may be necessary to manually reverse TC 971 AC 506. If reversal (TC 972 AC 506) is indicated, see Exhibit 25.23.2-9, IMF Only TC 972 AC 506 Tax-Related, Reversal of Identity Theft Case Closure, IRS Identified, for a description of reasons for the reversal.

(6) To indicate resolution of an IRS determined Identity Theft Case involving tax administration, mark the victim's account using Command Code (CC) REQ77 initiated from ENMOD to input a TC 971 AC 506 reflecting an appropriate Tax Administration Source Code depending upon the facts and circumstances of the case along with the tax year of the identity theft incident. The TC 971 AC 506 is applied to a taxpayer's account when all of the following occur:

1. All corrective actions have been taken. This includes verifying and updating the taxpayer's address on ENMOD.

Caution: If you do not have a valid address for the taxpayer, use the Service Center address to prevent an IP PIN from going to incorrect taxpayer. Refer to IRM 3.13.5.66, Campus Address Used Only When Taxpayer Address is Unavailable.

2. The taxpayer's identity theft issue affects tax administration.

3. Perform complete case analysis to ensure all identity theft related issues have been addressed and resolved. This includes all outstanding TC 971 AC 522s. See IRM 25.23.2.6, Closing Identity Theft Issues.

(7) The procedural guidance for your functional area must be followed as to when the TC 971 AC 506 should be input. Your procedural guidance, however, must adhere to the guidelines provided in this subsection.

(8) The Secondary Date field on CC REQ77 is limited to the current calendar year (cannot be the current day or any future date) and 7 prior years. The secondary date field will not allow the input of any date outside that range. See IRM 25.23.2.3.8.1, Command Code REQ77 Secondary Date and Old Case Year Issue for more information.

(9) Generally, there should be only one TC 971 AC 506 per tax year. However, some automated systems are not programmed to look for an existing TC 971 AC 506 for a specified tax year and in those instances, the automated system may have applied a second AC 506 to the account. While automated systems may apply a second Identity Theft indicator for a specific year, manual input is limited to one AC 506 per tax year.

(1) In some instances, it may be necessary to manually reverse TC 971 AC 506. Reversal may be necessary because of any of the following reasons:

1. TPRQ- The taxpayer requests reversal.

2. IRSERR- There was a keying or internal error in the input of the TC 971 AC 506 or IRS determined possible identity theft (IRSID) and later determined no identity theft occurred.

3. FALSE-Reserved

4. IRSADM- The TC 971 AC 506 has an internally identified negative affect on the taxpayer. For example, a programming issue.

5. OTHER-There are other reasonable circumstances not listed above.

Note: Be sure to select the correct code. If codes a-d above are not applicable, use OTHER.

(2) Actions needed prior to manually reversing an identity theft marker at the taxpayer’s request:

1. If this is a telephonic request, be certain that you are speaking with the taxpayer. Inadequate authentication of the identity of a caller could result in an unauthorized disclosure of return or account information. Refer to IRM 21.1.3.2.3, Required Taxpayer Authentication, and IRM 21.1.3.2.4, Additional Taxpayer Authentication.

2. Ask probing questions to determine why the taxpayer is requesting Action Code removal and document AMS or the case history if you do not have access to AMS with the taxpayer’s response. For example, "Can you provide the reason you would like this protection removed from your account?"

(3) Explain to the taxpayer that the AC 506 will:

• Help prevent future identity theft incidents

• Ensure any returns filed are reviewed for identity theft indications

• Include the issuance of an IP PIN for as long as the IP PIN indicator remains active

(4) If the taxpayer insists on removal of the identity theft indicator after you have explained the benefits, review the account to determine if the identity theft issue is open in another function. If there is an open identity theft case, refer the case to that function using your normal referral procedures. Do not take actions on identity theft cases being worked by another function. If there is no open IDRS control, review the Miscellaneous Field Code to determine what function applied the AC 506. Refer the case using your normal procedures to that function. The function that applied the AC 506 will determine if the 506 will be reversed.

(1) Take these actions when a taxpayer submits a Form 14039 alleging identity theft and he/she does not have a filing requirement. If the Identity Theft allegation is confirmed and includes a tax module in Masterfile status 02 or 03, input a TC 590 cc 020. This action will remove the account from the TDI inventory. Continue to correct the account as needed. Conduct research to determine if any modules in status 02 or 03 must be closed because the taxpayer has no filing requirement.

(2) Take these actions when a taxpayer submits a Form 14039 alleging identity theft and he/she does not have a filing requirement, and there is a TC 594 (indicating a joint return was filed with the spouse as primary). If the Identity Theft allegation is confirmed, input a TC 592 to reverse the TC 594, wait one cycle and input a TC 590 cc 020. This is necessary because IDRS CC FRM49 does not accept posting delay codes. This will prevent erroneous generation of TDI notices.

(3) If an identity theft allegation is confirmed and includes a tax module in Masterfile status 02 or 03, take these actions when a taxpayer submits correspondence that includes an unprocessed return.

(4) If a tax year(s) on the taxpayer’s claim, or other years found through CCA, are not open modules on IDRS:

1. Execute FRM49 per IRM 2.4.26.3(1b), Command Code FRM49. This will open the module on IDRS.

2. Input TC 590 CC 020. This will prevent any subsequent erroneous TDI’s from generating.

(1) There may be situations when it is necessary to reverse a pending identity theft claim (taxpayer allegation of identity theft).

(2) A pending identity theft claim is an account with an unreversed TC 971 AC 522 and no subsequent TC 971 AC 50X.

(3) The list below briefly describes the Miscellaneous Field Codes used when reversing unsupported identity theft claims (TC 971 AC 522):

• NOIDT: In the course of resolving an identity theft issue, the employee assigned determines no identity theft occurred.

• NORPLY: This code is used to close a suspended case when the taxpayer fails to provide the requested claim and\or additional information within the time specified by the employee assigned.

• TPRQ: The taxpayer requests the 971 be reversed and has provided a reasonable basis for that request.

• IRSERR: The 971 input was due to a typographical mistake or another internal mistake or IRS determined possible identity theft (IRSID) and later determined no identity theft occurred.

• IRSADM: The 971 is causing a negative impact on another internal process or system and must be reversed to discontinue the negative impact. For example, a programming glitch prevents returns from processing.

• FALSE: Reserved - TBD

• OTHER: The reason for the 971 reversal does not meet any of the above reason descriptions.

(1) If you determine an account has been marked with a TC 971 AC 522 PNDCLM, UNWORK or IRSID for an incorrect tax year:

(1) TC 971 AC 506 is applied to a taxpayer's account when Criminal Investigation (CI) identifies identity theft incidents that have tax administration effect. Such incidents can occur when a taxpayer's identity is stolen via phishing or refund schemes verified by CI.

(2) CI refers cases to Return Integrity and Compliance Service (RICS) Return Integrity & Verification Operations (RIVO) to input TC 971 AC 506 on an account regardless of the existence of any other identity theft indicator code (AC 501, 504, or 505) that may be present on the account. Refer to Exhibit 25.23.2-8, IMF Only TC 971 AC 506- IRS Determined tax-related Identity Theft Case Closure, and Exhibit 25.23.2-9, IMF Only TC 972 AC 506 tax-related, Reversal of Identity Theft Case Closure, IRS Identified, for more information about this identity theft indicator.

(1) RIVO handles identity theft account work processes and conducts research to verify the validity of tax return information. Specifically, RIVO inputs a TC 971 AC 506 identity theft indicator on a taxpayer’s account when a false tax return has been identified by the IRS, and the tax return was not filed by the valid taxpayer. See IRM 25.25.6.3, Taxpayer Protection Program (TPP) Basic Authentication and Research, and IRM 25.25.6.4, Taxpayer Protection Program (TPP) High Risk Authentication (HRA) Procedures, for additional procedures.

(2) The Taxpayer Protection Program (TPP) is responsible for handling potential Identity Theft cases that are scored by a set of identity theft models in the Dependent Database (DDb) or selected through a query in Electronic Fraud Detection System (EFDS). Refer to IRM 25.25.6.5, Responding to the Taxpayer and Case Resolution for the Taxpayer Protection Program (TPP) Telephone Assistors and Taxpayer Assistance Center (TAC) Assistors, for additional information.

(1) Submission Processing reviews returns that unpost because the taxpayer did not provide an IP PIN that matches the IP PIN listed on the account. If the review determines that the return was not filed by the SSN owner, SP will move the return to MFT 32 and input a TC 971 AC 506 identity theft indicator on the account.

(2) Additional guidance for procedures used by Submission Processing can be found in the following IRMs:

• IRM 3.28.4.4.6, Inputting Identity Theft Indicators.

• IRM 3.12.179.46, UPC 147 Reason Code 0 Identity Protection PIN (IP PIN).

• IRM 3.28.4.4, Unpostable Code (UPC) 147 Reason Code (RC) 0.

• Document 6209, Section 8B-3, Unpostable Codes - IMF.

(3) See Exhibit 25.23.2-8, IMF Only TC 971 AC 506 — IRS Determined Tax-Related Identity Theft Case Closure, for more information about this identity theft indicator.

(4) SP will edit paper tax returns containing a Form 14039 with a Special Processing Code (SPC) 8. The SPC 8 systemically generates a TC 971 AC 522 indicating receipt of an identity theft claim. CP 01S is systemically issued to the taxpayer confirming receipt of the Form 14039. Refer to Exhibit 3.21.3-1, Attachment Guide, for additional information.

(1) TC 971 AC 504 is intended for use on non-tax-related identity theft allegations only. For additional information see IRM 25.23.2.8.1.2, TC 971 AC 504 - Miscellaneous Field Code SPCL1, SPCL2, RPM1, RPM2, RPM3, RPM4, and EAFAIL and IRM 25.23.3.2.3, Self-Identified - Non-Tax-Related Identity Theft – IDT4 Overview.

(2) IDTVA will continue to use TC 971 AC 504 with Miscellaneous Field Codes ACCT, ACCT-M, EMPL, EMPL-M, ICMCCA, NKI or NKI-M for taxpayer allegations of identity theft that do not affect tax administration. For additional information, IRM 25.23.2.8.1.1, TC 971 AC 504 with Miscellaneous Field Codes ACCT, ACCT-M, BOTH, BOTH-M, EMPL, EMPL-M, NKI or NKI-M.

(3) Other BOD/Functions will use TC 971 AC 504 with Miscellaneous Field Codes SPCL1, SPCL2, RPM1, RPM2, RPM3, RPM4, and EAFAIL to mark taxpayer accounts when certain conditions apply. For additional information, see IRM 25.23.2.8.1.2, TC 971 AC 504 - Miscellaneous Field Code SPCL1, SPCL2, RPM1, RPM2, RPM3, RPM4, and EAFAIL.

(1) Input of TC 971 AC 505 is limited and reserved for use by Privacy, Governmental Liaison, and Disclosure (PGLD) Incident Management employees. However, this indicator will be visible and available for reference on the individual’s account. See Exhibit 25.23.2-6, IMF Only TC 971 AC 505 — IRS Data Breaches, and Exhibit 25.23.2-7, IMF Only TC 972 AC 505 — Reversal of TC 971 AC 505, for more information about this indicator.

(2) TC 971 AC 505 is applied to a taxpayer’s account when all of the following occur:

1. A taxpayer’s PII was lost, breached, disclosed, or stolen.

2. The breach risk assessment results in a high risk of harm to the potentially impacted taxpayer.

3. The IRS notifies the taxpayer of this data breach.

(3) The TC971 AC505 does not block, or prevent, online system access, will not stop registration for online services, including Get Transcript or IP PIN and will not stop paper requests for a transcript (Form 4506/T). Blocking accounts from on-line access is a separate action. If an account is blocked from on-line access, you will see an TC 971 AC 527 on the entity module. Accounts previously disabled from the Secure Access application due to an incident or breach prior to May 2016, such as the Get Transcript Incident, have been opened and the taxpayer can now access the application. Accounts that remain disabled in Secure Access can be identified by an unreversed TC 971 AC 527 WI BREACH DSABLD on the entity. If there is an unreversed AC 527 on the account, See IRM 25.23.2.8.6, Disabled Accounts TC 971 AC 527.

(4) The taxpayer will receive a data breach notification Letter 4281C, (IM Breach Notification Letter), from the IRS advising him/her that information controlled by the IRS may have been disclosed to unauthorized individuals. The notification letter contains information related to identity protection and an identity protection service arranged for the taxpayer by the IRS. Refer to IRM 25.23.12.4.8, Responses to IM Breach Notification Letter 4281C, for additional information.

(5) PGLD inputs TC 971 AC 505 on an account even when another identity theft indicator code (AC 501, 504, or 506) is present on the account. In some instances, it may be necessary for PGLD personnel to manually reverse the TC 971 AC 505 with a TC 972 AC 505.

(6) The AC 505 is used to track data breaches. For information on the Incident Management Program see IRM 10.5.4.5.1.1, Applying the IRS Data Breach Tracking Indicator to IRS Data Breaches.

(1) RESERVED

(1) The TC 971 AC 524 is an identity theft indicator used to lock the account of deceased taxpayers. It prevents a deceased taxpayer's TIN (SSN or ITIN) from being used as the primary, secondary or dependent TIN on a current or subsequent year federal income tax return. Account locks can be applied both manually and systemically using internal or external information. However, input of the TC 971 AC 524 is limited and reserved for use by IPSO and RICS Taxpayer Protection Program (RICS TPP).

(2) TC 971 AC 524 can be viewed on the taxpayer’s entity using command codes ENMOD or IMFOLE.

(3) The identification, development, and implementation of specific population categories for the TC 971 AC 524 will be phased in by IPSO with the goal of creating a comprehensive list of taxpayers who do not have a filing requirement. Account locks may be initiated either manually or systemically.
Manually: A manual lock is placed on a deceased taxpayer's account when a date of death (DOD) is present on the tax module and the account is identified by CI or Return Integrity & Verification Operations (RIVO) as fraudulent.
Systemically: A systemic lock is placed on a deceased taxpayer's account when we process a final return with a DOD.

(4) Systemic Locking of Deceased Taxpayer accounts occurs when all of the following are true:

• A date of death is present on the tax module; and

• A personal representative has filed a final return; and

• Computer Condition Code A, F or 9 is placed on the account as indicated in the table below:

(5) Manual Locking occurs when individual accounts are identified by a business function and provided to IPSO or RICS for input using a systemic tool.

(6) Returns filed on decedent accounts containing an unreversed TC 971 AC 524 DECD, will be prevented from processing.

Electronically Filed Returns

(7) UPC 147 Reason Code 4 will only be set if one of the two conditions below are present:

• An unreversed TC 971 AC 524 is present on the Entity Module. Any return attempting to post that has a tax period after the Secondary date of the TC 971 AC 524 will unpost and be auto archived. There are no exceptions.

• No TC 971 AC 524 is on the Entity Module but during return processing Special Processing Code (SPC) 9 was entered on the return (see ERS EC 028). Entering SPC 9 on a return will unpost the return as UPC 147 RC 4 and the return will be auto-archived. It will unpost ONLY the return that SPC 9 was input on. This leaves the module open for posting of a legitimate return. Do NOT refer the account to ECU to unlock (the account is not locked). If it is believed that the unposted return is the legitimate return it must be requested from Files using CC ESTAB and reprocessed.

(1) Employment Related Identity Theft occurs when someone, other than the valid SSN owner, uses the SSN to obtain or retain employment. Employment Related Identity Theft is considered “non-tax” related because it does not involve the filing of a fraudulent income tax return. However, the income generated by the person other than the valid SSN owner may have a tax account impact if it results in the assessment of additional tax if not identified and treated prior to the assessment.

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

1. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

2. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) The TC 971 AC 525 indicator code is systemically applied to the valid SSN owners account when IRS identifies an ITIN/SSN mismatch involving the taxpayer’s SSN. The placement of an indicator on the account of the valid SSN owner is not exclusive to taxpayers who have earned income or indicate that the recipient has earned income. The placement of an indicator reflects the potential use of the SSN for employment by another person. The indicator will be applied a maximum of one time each year regardless of how many times the SSN was used in the same tax year. More than one indictor may be applied in the same calendar year if the ITIN/SSN mismatch was identified on multiple tax years that are processed in the same year. See the table below for specific situations and the actions or explanations for each:

1. Authority for systemic and manual input of the TC 971 AC 525 is limited and reserved for use by Accounts Management Identity Protection (IP) staff.

2. The placement of the indicator on the taxpayers account prevents any income from the Form W-2 that does not belong to the valid SSN owner from being assessed against their account. There is no other impact to the taxpayer’s account.

3. TC 971 AC 525 can be viewed on the taxpayer’s entity module using command codes ENMOD or IMFOLE.

(4) Notifications are issued to taxpayers who had a TC 971 AC 525 indicator placed on their account after January 1, 2017. Notifications are issued via CP01E (CP701E for Spanish) Employment Related Identity Theft notice using the name(s) and address on the last posted return (i.e., address of record). The CP01E /CP701E is generated 2 cycles after the posting of the AC 525 indicator.

1. TC 971 AC 804 with a MISC of 001E will post to master file when the CP01E is generated.

2. The name(s) displayed on the notice reflect the name(s) on the taxpayer’s account.

   Note: If the notice contains 2 names, the impacted taxpayer will always be the first name listed on the notice.

   Note: If the notice is addressed to a child, then the child’s SSN may have been misused. Children may be impacted in the same way as adults and should follow the same protection guidelines.

(5) While the CP01E/701E is an informational notice only, taxpayers may react to the notice by telephone, correspondence or visiting a TAC. When responding to taxpayer inquiries, refer to the following information:

1. Ask the taxpayer about which notice they are calling. If the taxpayer cannot find the notice number, ask them to look on the upper right-hand corner and clearly recite the notice number. If necessary, repeat the notice number, “C, P, O, 1, E”. Pronounced “See Pea Oh 1 E” or See Pea Zero 1 E”.

   Exception: Employees answering APP 162 and/or working with Spanish speaking taxpayers should continue to identify the caller’s issue/notice in Spanish and are excepted from referencing the notice number as “C, P, O, 1, E”.

   Reminder: The CP01E and CP701E notices are issued systemically without regard to the recipients age, filing history or other criteria.

2. Full disclosure and authentication is required for account related calls only. See IRM 21.1.1.4 (4), Communication Skills, for more information.

3. When a taxpayer or third party contacts the IRS, and is only requesting general information regarding the CP01E, authentication and account access is not required. See IRM 21.1.1.4, Communication Skills for more information. Information that is contained within the CP01E or on IRS web pages is considered public information and can be provided without authentication.

   Note: There is no additional information regarding the source action or W-2 document available on the taxpayers account.

4. When a taxpayer or third-party contacts the IRS, because the first name on the notice is minor child, dependent, or other non-filer, advise the caller that Employment Related Identity theft is not related to the filing of a tax return. The notice was issued because the dependents SSN may have been used for employment. A minor child, dependent, or non-filers personal information is just as vulnerable to identity theft. Because of the increased risk of identity theft, we are providing information protecting the impacted persons financial or credit records (if applicable).

   Note: The notice contains general information that is provided to all impacted persons and is not specific to tax return filers. Some protective measures may not apply to all impacted persons. The impacted persons age or lack of financial or credit history may prevent the creation of accounts on some suggested web pages that require a review of income and credit information and the ability to obtain an IP PIN.

5. When a taxpayer or third-party contacts the IRS, regarding a deceased person, be empathetic with the caller and advise the caller that the notice was issued to provide information on checking the decedents financial or credit records to see if there may be any impact to an estate situation.

6. If account access is requested or necessary, the taxpayer or third party must be authenticated. See IRM 21.1.3.2.3, Required Taxpayer Authentication, and either IRM 21.1.3.2.4, Additional Taxpayer Authentication, for taxpayers or IRM 21.1.3.3, Third Party (POA/TIA/F706) Authentication, for third party contacts.

   Note: Third party contacts must be authorized by an existing and valid Form 2848, Power of Attorney and Declaration of Representative, or Form 8821, Tax Information Authorization prior to discussing account information.

7. Under no circumstances will assistors offer to, or attempt to research, the source of the AC 525 indicator including but not limited to, the tax return and/or Form W-2. There is no link to the source document and identification of the source of the indicator is not possible. Taxpayers will be provided general information only.

8. In all cases, refer the taxpayers to the following resources on IRS.gov for additional information:
   • Understanding Your CP01E Notice,
   • Guide to Employment-Related Identity Theft
   • and Taxpayer Guide to Identity Theft

9. In addition, advise taxpayers to take the following steps to protect their financial and tax accounts as well as their personal information:
   

Action	Description
If they do not currently have one, they may request an Identity Protection PIN (IP PIN) to protect their tax account.	There are now 3 options for the taxpayer to get an IP PIN. See IRM 25.23.2.9.1, Participating in the IP PIN Program for information on how the taxpayer can obtain, request or apply for an IP PIN.
Monitor their credit report and all financial accounts	Obtain a copy of all financial and credit records and review them for unusual or unauthorized activity. Obtain a copy of their credit report by contacting any one of the three nationwide credit reporting companies online or through the company’s toll-free numbers listed in the CP01E Notice.
Place a fraud alert on credit accounts	As an extra precaution, contact one of the credit agencies listed on the CP01E and request that a fraud alert be placed on all credit accounts
File a complaint with the Federal Trade Commission	Contact the Federal Trade Commission at: www.IdentityTheft.gov, or call FTC's Identity Theft Hotline: 1-877-438-4338; TTY: 1-866-653-4261
Review Social Security Administration records to ensure that their earnings records are correct	Sign up for an electronic account at www.SSA.gov, to check for excessive income being reported

(6) Letter 0544C: Due to a programming error that occurred in 2017 and 2018, some spouses who were listed as the secondary taxpayer on ITIN returns received a CP01E or CP701E when there was no identified ITIN/SSN mismatch. Beginning in May of 2019, these taxpayers will receive a 0544C letter notifying them the original CP 01E notice they received in 2017 or 2018 was issued in error; they are not victims of employment related IDT. When responding to these inquiries, apologize to the taxpayer and let them know:

• The original letter was sent to them in error

• The identity theft indicator that was mistakenly applied to their account was removed.

• If they have any other identity theft indicators that were applied to their account that were unrelated to this incident, they are still in place and active.

• There is no impact to their tax account

• They should continue to file their tax returns, and pay their tax, normally.

(7) Field Assistance (TAC) Only: If the TAC visit has unanswerable questions or needs additional assistance, complete Form 4442 “Inquiry Referral” by completing boxes 1 – 4, 8 – 10 and 13 – 14. In section B, input “CP01E TAC Center Visit” and the taxpayer’s question. Either enter the taxpayer’s telephone number in box 24, or the taxpayer’s e-mail address in box 25, and enter the question or issue in Section B. Forward the completed Form 4442 via encrypted email to: *TS CAS:AM:IPSO Employment Identity Theft.

(1) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(4) The taxpayer may not have received notification of the disabled online account. Verification for on-line services is done by a 3rd party and we cannot assist in the verification process.

(1) The TC 971 AC 528 identity theft indicator is mainly used to enroll individuals into the IP PIN program, who verified their identity through Form 15227, Application for An IP PIN, or an in-person Taxpayer Assistance Center (TAC) appointment.

(2) The table below describes the various miscellaneous codes used with the TC 971 AC 528:

(1) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(1) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(1) Participating in the IP PIN Program is voluntary for taxpayers who are not victims of tax-related identity theft.

(2) If the taxpayer voluntarily joined the IP PIN program, are not victims of tax-related identity theft and are not interested in continuing to participate in the program then they may opt-out of the IP PIN program. To find out if they are eligible to opt-out, please advise them to log into their online account, www.irs.gov/your-account.

(1) To determine if a taxpayer’s account had an IP PIN generated, review CC IMFOLE for an IP PIN indicator. IMFOLE line 14 will display:

• IP PIN:1 if an IP PIN was generated to the taxpayer’s account.

• IP PIN:0 if no IP PIN was generated to the taxpayer’s account.

(2) IP PIN Indicator is set:

• In December for accounts that contain an unreversed tax-related IDT indicator without a previous IP requirement are automatically enrolled into the IP PIN Program and the IP PIN indicator is set to “1”. OR

• At the time a taxpayer opts into the IP PIN Program. The IP PIN indicator is set to “1” when the opt in transaction posts to their account; TC 016 with DLN 28263-777-77777-Y. (Y signifies the year digit.)

(1) IP PINs are generated annually in early December for the upcoming processing year. IP PINs are generated for every TIN in the IP PIN population; however, some accounts will have an IP PIN generated but will not have a notice mailed.

(2) CP01A Notice – This notice contains the taxpayer’s IP PIN. It is mailed starting in Mid-December and should be received by Mid-January.

(3) Suppressed Notices – Some accounts that have an IP PIN requirement do not have notices generated due to the following reasons:

• Taxpayer opted into the IP PIN Program in 2019 or later through the Get an IP PIN application or the Individual Online Account. CC ENMOD/IMFOLE will contain a TC 016 with the unique DLN of 28263-777-77777-Y (Y signifies the year digit.) with a cycle date of 201904 or greater.

• Taxpayer’s account contains an undeliverable indicator. Review CC INOLES for ‘UD’ which displays on the second row.

• Taxpayer has not filed a return within the past 3 years.

  Exception: A subsequent unreversed TC 971 AC 528 will bypass the non-filer suppression criteria.

• Taxpayer’s account contains an unreversed IDT indicator with MISC code containing ‘NOFR’ and there has been no subsequent return filed.

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(4) If the taxpayer did not receive a CP 01A Notice, see IRM 25.23.2.9.4, Lost, Misplaced or Non-Receipt of IP PIN Overview.

(5) Taxpayers who opted in online, must log into their Online Account to view their current IP PIN on the Profile page, see IRM 25.23.2.9.1.2, Opting into the IP PIN Program through the Individual Online Account.

(1) The IP PIN Entry Tool was developed to re-issue a taxpayer’s IP PIN. The IP PIN Entry Tool will verify that an IP PIN was generated for the taxpayer for the current processing year. If an IP PIN was generated, it will transmit the TIN to Headquarters for processing of Letter 4869C which re-issues the IP PIN to the taxpayer.

(2) Do not suggest filing a Form 15227, Application for an Identity Protection Personal Identification Number (IP PIN), or schedule TAC appointments for taxpayers who are requesting a re-issuance of their IP PIN because it was lost, misplaced, or the IP PIN could not be retrieved through the Individual Online Account.

(3) The IP PIN Entry Tool is taken offline for annual end of year maintenance period in November and brought back online in mid-January. Employees will not be able to input requests during this period. A SERP Alert will be issued when the Tool is active and available for use. If the taxpayer calls requesting that we re-issue their IP PIN during this maintenance period, please explain the following:

• The re-issuance process is offline for yearly maintenance and will be back online in mid-January.

• They may file by paper, without an IP PIN at any time but it will delay the process of their return.

• A digital copy of the CP01A notice is viewable in the Notices section of the Individual Online Account. Taxpayers with an account who received a CP01A may be able to retrieve their IP PIN, when the IP PIN Entry Tool is offline. See IRM 21.2.1.62(10), Online Account.

(1) Taxpayers issued an IP PIN are required to use the IP PIN when filing their return, to avoid delays and rejection.

(2) Electronic Filing –

• Taxpayers filing electronically will be prompted by their software program to input their IP PIN and the IP PIN of anyone else on the return with a requirement. The input of the IP PIN varies with the different software programs.

  Caution: If a taxpayer states that they cannot locate where to input their IP PIN using their tax software, they should contact the software provider. IRS cannot help with individual software issues.

  Note: An e-file return will reject and not be processed if a required IP PIN is missing or incorrect.

• Entry of an IP PIN will be required for any Taxpayer Identification Number (TIN), including all Social Security Numbers (SSNs) and Individual Taxpayer Identification Number (ITINs) with an IP PIN requirement including dependents being claimed on Form 2441, Child and Dependent Care Expenses; and Schedule Earned Income Tax Credit (EITC)

• If a taxpayer contacts the service stating their electronic filing rejected due to prior use of their (TIN) even though they used their IP PIN: apologize for the inconvenience, tell the taxpayer to file a paper return using their IP PIN and do not make any statements about the IP PIN Program beyond your apology.

  Caution: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) Paper Filing

• The primary taxpayer filing on a paper Form 1040 with an IP PIN must enter the IP PIN in the boxes indicated just to the right of the "Your Occupation" space in the signature section of the form. If the secondary taxpayer, if they have an IP PIN must when filing on paper enter the IP PIN in the indicated box, just to the right of the Spouse’s Occupation space in the signature section of the form.

  Reminder: If the dependent has an IP PIN assigned, there is currently no requirement to enter this information on a paper return.

• A paper return with a missing or incorrect IP PIN is subjected to additional review for identity verification, which will delay return processing and issuance of any refund that may be due.

  Note: If the Taxpayer has questions about completing their return, see Instructions Table of Contents for a list of instructions for the Form and Schedules.

(1) Each day a taxpayer’s account in the IRS Data Retrieval Tool (DRT) is accessed, the IRS will issue a CP302 to notify the taxpayer.

(2) If the taxpayer calls about the receipt of a CP302, explain that they will receive a notice each day the DRT is accessed using their information. Probe the caller to ascertain if the taxpayer, or their parent, guardian, representative, etc. made the access.

(3) Full disclosure and authentication are required for account related calls only. See IRM 21.1.1.4 (4), Communication Skills, for more information.

(4) If the caller states that the access was not made by them, or by anyone on their behalf, take the following actions:

1. Advise the taxpayer of actions to take to protect their identity. See IRM 25.23.2.2.1, Taxpayer Interaction, for a list of actions.

2. TC 971 AC 522 with MISC Code of OS PHSH IRSID and

3. TC 971 AC 504 with MISC Code of NKI

(1) Employees will receive Form 14027-B, Identity Theft Case Referral, through their designated IDT Liaisons to resolve a tax related issue involving identity theft whether or not there is an open control for the case on IDRS or CII.

(2) Employees can identify cases related to Form 14027-B on AMS/CII and their Automated Age Listing (AAL) by a multiple control with a case controlled with Category Code GRVW and a Priority Code 1 on the IDT control.

(3) Use the step chart below when a Form 14027-B is received.