25.25.12. Fraud and Referral Evaluation (FRE) Procedures for Return Integrity Verification Operations (RIVO)

(1) Return Integrity Verification Operations (RIVO) strengthens the integrity of the tax system by:

• Protecting the public interest by improving IRS’s ability to detect and prevent improper refunds

• Serving the public interest by taking actions fairly and correctly to identify, evaluate and prevent the issuance of improper refunds

• Helping taxpayers understand the refundable tax credits for which they are eligible

(1) Refer to the following:

• IRM 1.2.1.5.10, Policy Statement 4-21, Selection of returns for examination

• IRC 6402(a), Authority to make credits or refunds

• IRC 6401, Amounts treated as overpayments

• IRC 6404, Abatements of tax

• IRC 6213, Requirements for a statutory notice, including math error authority

(1) The Return Integrity Verification Program Management (RIVPM) has responsibility for information in this IRM. Information is published in the IRM on a yearly basis.

(2) The Director of RIVPM is responsible for the policy related to this IRM.

(3) The Chief of RIVPM Policy & Analysis is responsible for ensuring this IRM is timely submitted to publishing each year.

(1) The program has reports to track the inventory, including receipts and closures.

(2) A quality control program is in place to review all processes to ensure accuracy and effectiveness.

(1) Acronyms used throughout the Fraud and Referral Evaluation (FRE) Procedures for Return Integrity Verification Operations (RIVO) IRM are listed alphabetically in the table below:

(1) The related resources listed below may be used for account research and issue resolution. These related resources may be accessed through the IRS Intranet-Servicewide Electronic Research Program (SERP) site.

• IRM 2, Information Technology

• IRM 3, Submission Processing

• IRM 4, Examining Process

• IRM 21, Customer Account Services

• IRM 25.23, Identity Protection and Victim Assistance

• IRM 25.25, Revenue Protection

(2) The following IRMs should be used in conjunction with IRM 25.25.12:

• IRM 1.1.13, Wage and Investment

• IRM 25.25.1, Return Integrity and Verification Operation Business Master File Procedures

• IRM 25.25.2, Revenue Protection Screening Procedures for Individual Master File Returns

• IRM 25.25.3, Revenue Protection Verification Procedures for Individual Master File Returns

• IRM 25.25.4, Integrity & Verification Identity Theft Return Procedures

• IRM 25.25.5, General Correspondence Procedures

• IRM 25.25.6, Taxpayer Protection Program

• IRM 25.25.7, Automated Questionable Credit Program

• IRM 25.25.8, Revenue Protection External Lead Procedures

• IRM 25.25.9, Revenue Protection Prisoner Lead Procedures

• IRM 25.25.10, Frivolous Return Program

• IRM 25.25.11, Withholding Only Work (WOW) (Notice CP 05A) Procedures

• IRM 25.25.13, Account Resolution for Return Integrity Verification Operations (RIVO)

(3) Integrated Data Retrieval System (IDRS) restricted access accounts are accounts where a user must request special permissions to access the account through IDRS. Follow IRM 21.2.1.3.2, Authorized IDRS Access.

(4) The Taxpayer Bill of Rights (TBOR) lists rights that already existed in the tax code, putting them in simple language and grouping them into 10 fundamental rights. Employees are responsible for being familiar with and acting in accord with taxpayer rights. See IRC 7803(a)(3), Execution of Duties in Accord with Taxpayer Rights. For more information about the TBOR, see https://www.irs.gov/taxpayer-bill-of-rights. Under these rights taxpayers have the right to receive prompt, courteous, and professional assistance in their dealings with the IRS, to be spoken to in a way they can easily understand, to receive clear and easily understandable communications from the IRS, and to speak to a supervisor about inadequate service.

(1) Pattern matching is used to analyze returns en masse, not one by one. Use Selections aNd Analytics Platform (SNAP) to create and run assigned queries and adjust as applicable based on internal and external information.

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) Research query results to identify a pattern (this list is not all inclusive).

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(4) Once a pattern has been identified:

• Load/Import all selected returns into CASE. Selected returns must be in Process Status (PS) codes 0, 3, 10, 12, 32, 47 or 60.

• Push the return to PS 30.

  Reminder: When pushing returns to Process Status 30 utilizing Case, do not push returns already assigned an Identity Theft (IDT) treatment stream (e.g., PS 49/50) as it could possibly change the status of the return.

• Use Refund Amount and Load Date in SNAP to ensure pre-refund status.

• Input the standardized EFDS return notes of the duplicate conditions that applied to your pattern.

  Note: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

  .

• Input a secondary EFDS note "RIVO FRE PATTERN". The note must be on all returns pushed to PS 30.

• Research may need to be performed to verify the return if it says "Tribal Income" before selecting the return for inclusion in a pattern. See IRM 25.25.2.6(4), Unsubstantiated Income and/or Withholding.

(5) Research patterns obtained through SNAP.

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡"≡ ≡ ≡ ≡ ≡"≡ ≡ ≡"≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(6) Research IP addresses based on the Average Refund:

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(7) Look for other patterns within original pattern and use SNAP to identify more returns:

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡

(1) Identify new inventory in Process Status (PS) 30 using the disposition date:

• Research for required Electronic Fraud Detection System (EFDS) note (RIVO FRE PATTERN, RIVO RSV IDT, etc.).

• Determine if the return meets PS 30 criteria (not previously in the Taxpayer Protection Program (TPP), except for accounts containing a TC 971 AC 123 MISC field TPPRP or TPP Recovery).

• Perform a BiTPP (Back in Taxpayer Protection) to check for accounts that have been placed back into the Taxpayer Protection (TPP) process. The accounts must be checked on IDRS for TC 971 AC 124 or AC 129 to see if the return went through the TPP process. If there is no indication of prior TPP, set the return to be sent through the TPP process on the following Thursday. If there is an indication of prior TPP then send the listing to management to have accounts removed from PS 30 and placed in the correct process status.

• Provide feedback to managers if criteria are not met.

(2) Run SNAP query "PS 30 Daily Inventory"

• Research for missing note.

• Perform a BiTPP to check for accounts that have been placed back into the TPP process.

• Check IDRS accounts for TC 971 AC 124 or AC 129 to see if the return went through the TPP process.

(3) For returns that meet the PS 30 criteria, initiate the correct freeze actions. Remove from PS 30 those returns not meeting the criteria.

• Prepare batch freeze template for returns dispositioned to PS 30 after midnight the previous day up to the refund freeze cut off deadline, to generate TC 971 AC 134 and forward to Modernized Development and Delivery (MDD) contact.

(4) Identify the correct TPP marker (e.g., TC 971 AC 124 or TC 971 AC 129), prior to the weekly Direct to Masterfile cutoff deadline by taking the following actions:

• EFDS return DLN is not posted - put on the Direct to Masterfile template for the TC 971 AC 124

• EFDS return DLN is posted

(5) Ensure the Direct to Masterfile template is placed on the server by 10:00 AM ET. Send an e-mail to the BPL POC to inform them the template was updated. The e-mail must include the full filename and number of records.

(1) The database is used for monitoring current year process status 30 inventory. Queries can be run on the following processes:

• Identifies current PS 30 inventory

• Identifies all PS 49 DLNs (current and historical)

• Tracks all DLNs placed into PS 30 at End of Day

• Identifies TC 971 AC 129 and AC 124 returns for the year

• Identifies returns after the correct suspense time expired

  Note: The suspense timeframes will be coordinated with RIVPM HQ.

• Tracks all TC 971 AC 123 DLNs

(2) Pull the TC 972 AC 129 from the TPP database on a weekly basis. Mass push all confirmed IDT cases to scheme as CT Cat 7. Refile anything that is confirmed Non-IDT with no TC 971 AC 052 CANT VERIFY. Case with the TC 971 AC 052 have the income verified per IRM 25.25.2.16 , Process Status (PS) 30 Identity Theft False Positive Screening Procedures.

(1) FRE receives Suspicious IRP Link Analysis referrals via email. The spreadsheet contains the Information Returns submission, associated individual returns filed, and Business Master File Identity Check (BMFIC) case information.

(2) Take the following actions:

• Run a Selections aNd Analytics Platform (SNAP) query and export applicable information related to each DLN submission (EIN, SSA run date, submission DLN, payee TIN, etc.).

  Note: This information can be found in fdc_w2_irmf_all_years in SNAP.

• Filter the query by assigned EIN using the payer TIN (pyr_tin) and export the query for further analysis.

• Use IRM 25.25.1.5.2, Case Processing for Business Masterfile (BMF) Entity Fabrication (EF), for research steps to review EINs.

• Run link analysis queries to find other potentially fraudulent submissions with bad submission IDs, SSNs, or EINs.

• Add any submissions that are determined to be Suspicious IRP(SUS IRP) to the "IRMF_PFRD_Template" spreadsheet. Include the required information: EIN, SSN, Run Date, and Submission DLN.

  Note: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• Use the spreadsheet exported from SNAP to find any affected SSNs.
  Sort the Action column by desired determination (SUS IRP or EF)
  Copy all SSNs (pye_tin) and paste into a SNAP query to find any associated returns.

• If a refund can be stopped for any affected SUS IRP or EF returns, regardless of the Process Status (i.e., PS 30 or PS 49), update the "Direct to Masterfile" template with the required information (Primary SSN, Name Control, Tax Year (YYYYMM) and DLN) for the input of the TC 971 AC 199. Do not include dashes in the SSN or DLN and remove any leading/trailing spaces. Place the template on the server DAILY by 10:00 AM ET for the Business Performance Lab (BPL) to add the markers to the Masterfile listing.

  Note: Templates added to the server after 10:00 AM ET will not be worked until the following day.

(3) If deemed Suspicious IRP:

• Move returns claiming suspicious IRP to PS 29 (Add to Scheme) in EFDS unless they are in PS 30 (Ace Adjustments) or PS 49 (ID Theft Hold).

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡

• Do NOT send the return to PS 29 (Add to Scheme) if:
  the Suspicious income document (ex: W-2) is not being claimed on the return
  the return filed is a balance due return
  potential refund loss is under tolerance (see IRM 25.25.2-4, Tolerance Chart)

• If the refund is lost, disposition to PS 65 (Post Refund Potential Fraud)

• If the associated returns have been moved to PS 31 (ACE Collections) and the IDOCs are determined valid and not suspicious, REFILE the return in EFDS.

  Note: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡

• Share any large dollar scheme with the HQ POC for possible referral. Include all link analysis research.

(4) If deemed Fabricated Entity:

• Move returns claiming potential fabricated income documents to PS 29 (Add to Scheme).

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡

(5) Pushing to Scheme:

• Create an EFDS CASE to hold your Suspicious IRP and EF returns and monitor through the process.

• If the return is in PS 49 (ID Theft Hold) when marked, it could get refiled by the Systemic Verification Process. Manually push these returns from PS 28 (Refile) to the correct scheme using IRM 25.25.2-1, State Mapping to Scheme Location.

• Input the applicable EFDS Note on each return pushed to scheme per IRM 25.25.1-3, Entity Fabrication (EF) Standard Notes and Actions for EFDS and Account Management Service (AMS).

(6) BMF Entity Closing Process:

• Update AMS and EFDS based on closing action. See IRM 25.25.1-3, EF Standard Notes and Actions for EFDS and AMS.

• Update EFDS Mode of Contact (MOC) based on closing action.

• Add the correlating EFDS Individual Return Note in the EFDS Permanent Instructions field. ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡

• Add all research and standardized notes to the EFDS employer notes.

• Update/close case in the BMFIC database.

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
  ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
  ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• Add detailed BMFIC Notes to document specific research performed and used to make the final determination.

  Note: HQ will periodically pull a BMFIC report to update locked accounts and IDOCs.

• If the entity is already in BMFIC, check IDRS CC ENMOD for an open EF control base(s). If the EF control base(s) is open, close the control base.

(1) Run "SUSIRP" query in SNAP and export to Excel using the file name "SUSIRP MMDDYYYY". Remove duplicates or previously worked DLNs.

(2) Sort the remaining query results into 2 tabs:

• WOW - Withholding Only Work with no refundable credits

• AQC - Automated Questionable Credits

(3) Update the confirmed SUS IRP cases on the SUSIRP MMDDYYYY Excel spreadsheet with the valid wages/withholding amounts per Command Code IRPTR and/or EFDS Notes.

(4) Send the following cases back to BPL:

• Return does not contain an EFDS or IDRS note confirming a bad EIN

• Return was pushed to scheme before a determination was completed

(5) Hold cases with no return posted on IDRS (TC150) until the return posts. Once posted, follow the steps above.

(6) Push all cases to STARS as CAT 1, DISP MQ.

(7) Email the Excel listings to the proper POCs based on the Excel tabs (FRE WOW POC, FRE AQC POC). The email subject line must read: "SUS IRP".

(1) For accounts where the paper check is returned to the IRS as undeliverable (TC 740) and appears on the Business Objects (BOE) Report, FRE is to take the following actions when the S- freeze is still on the account after 60 days:

• Push returns to STARS as CATG 7

• Input EFDS Note: RIVO FRE PATTERN Multi/Limited Direct Deposit S Freeze

• Monitor for the returns to hit STARS and use the STARS Mass Update Template to update the Disposition to "DD"

• Identify returns in STARS CATG 7, DISP "DD" and run through the Return Integrity Compliance Services (RICS) IDT Tool to treat the return as IDT

Note: Any return rejected by the RICS IDT Tool is worked manually per IRM 25.25.4, Integrity & Verification Identity Theft Return Procedures.

• Update STARS DISP to "CL"

(1) Security Breach Leads - The IRS receives notification of specific security breach incidents from various sources related to a data breach. This information is received from Electronic Products & Services Support (EPSS), Cyberfusion and various software providers. The FRE analysts provide ongoing analysis of the information received and protect IRS revenue of potential identity theft returns through the referral process.
Security Breach Lead Analysis:

• Monitor returns filed for each lead for the current year

• Monitor SSNs, potential suspicious Internet Protocol Addresses, and potential suspicious e-mail addresses received from Cyberfusion for the current year

• Monitor prior year leads for potential IDT

(1) Leads are external information and communications about questionable tax refunds identified by a variety of stakeholders, including national banks, state banks, savings and loan associations, mutual savings banks, credit unions, financial institutions, brokerage firms, government and law enforcement agencies, state agencies, tax preparation entities and various other sources. Bank Leads may involve treasury checks, direct deposits/ACH, refund anticipation loans or checks, and pre-paid debit cards.

(2) Leads from financial institutions are voluntarily submitted through the External Lead Mailbox Process. Reference IRM 25.25.8.2, External Lead Mailbox Process for more information. The bank leads from this mailbox are imported into the "RICS Lead Management System" (LMS). These leads are all post refund returns. The FRE Bank Leads Program uses the lead data within the Lead Management System (LMS) to search for revenue protection and fraud trend identification opportunities.

(3) The FRE Bank Leads Program uses the lead information to identify revenue protection opportunities on other questionable returns currently in the processing stream. The FRE Bank Leads Program also uses these leads to identify new fraudulent filing patterns and trends. New trends are monitored for other activity. Any identified returns are assigned to the correct processing streams. New filter rule suggestions are periodically forwarded to the proper teams in RICS/RIVO for consideration.

(4) Lead Research:

• Review all returns for possible IDT using the bank leads obtained from the saved SSRS Report spreadsheet. Continue reviewing the remaining lead data for fraudulent filing patterns.

• Review Lead data, including some or all the following: SSN, Bank Account, IP address, e-mail address, name, and physical address.

• Research SNAP, IDRS, EFDS and other systems to conduct lead research and identify fraudulent return patterns.

• Address Leads differently based on the scenario. Refer to the Bank Leads Desk guide for current query processes.

• Run SNAP queries daily based on identified lead fraud patterns.

(5) Lead Actions:

• Disposition all possible identity theft (IDT) returns to Process Status 30 (ACE/Adjustments) in EFDS. Input the following notes in EFDS:
  Note 1: "RIVO FRE PATTERN"
  Note 2: Summit (‘extlds Bank Leads-[SNAP QUERY NAME]”)

(1) Electronic Filing Identification Numbers (EFINs) and Preparer Tax Identification Numbers (PTINs) are vulnerable to identity theft, breaches, and hijacking. Some cases involve EFINs, or PTINs established with identity victims' names and social security numbers (SSNs). Other cases involve EFINs, or PTINs originally established by legitimate return preparers or practitioners and then misused by thieves in filing identity theft (IDT) returns. Yet other cases involve a compromised EFIN, under which the IRS receives both a bona fide return from the legitimate owner of the EFIN and an IDT return from a thief. Electronic Product and Services Support (EPSS) and Return Integrity Verification Operations (RIVO) have been working together to identify suspicious EFINs, research them, and inactivate them, when applicable.

(2) Abusive return preparers have been a problem for the IRS and for taxpayers for many years. These preparers create and submit returns that contain fraudulent/abusive items (for example, income, withholding, dependents, and refundable credits). Abusive return preparers create a problem for the IRS because these returns cost the government revenue and cost the taxpayers money when they are audited. It is often difficult to discern the abuse because some taxpayers collude with these preparers while others do not.

(1) Return Integrity Verification Operations (RIVO) has implemented a streamlined referral process to direct Abusive Preparer cases to the Lead Development Center (LDC) and to the Return Preparer Coordinators (RPCs) office using specified criteria. This includes Exam functions that focus on the fraudulent items listed in the referral.

(2) After thoroughly researching and developing the referrals, refer only the most egregious preparers. If the criteria is not egregious enough to warrant a referral, forward the lead to the Return Preparer Office (RPO) to be filed as a complaint only.

(3) RICS/RIVO/FRE employees are in a unique position to identify these abusive preparers. This identification supports their mission of fraud detection and revenue protection. In addition, they have access to return data that is not generally available elsewhere in the IRS. This frequently results in identifying pockets of questionable returns that are prepared by the same individual and allows for case building on preparer fraud not captured elsewhere.

(4) A FRE Point of Contact (POC) is assigned at each site. A POC review must be completed before any lead can be referred to the Industry Fraud Leads Mailbox. Forward all referrals to the FRE POC’s e-mail address with a CC to their back up.

(5) Program Case Research:

• Determine if the lead needs to be imported

• Import the lead into the database

• Using all available research tools, determine if the case is Abusive or Not

• Verify the Current Year (CY) return totals; if greater than 500 returns refer to the Lead Development Center (LDC) or if less than 500 returns refer to the Return Processing Center (RPC)

• Double check database to make sure the EFIN is still active (if EFIN is inactive, review the comments to see if a referral is warranted)

• Consider all EFINs associated with the firm being researched. Make a referral to the LDC/RPC for the firm, not an individual Preparer Tax Identification Number (PTIN)

• Capture everything the firm filed, including Paper and Electronic Filing (ELF)

• Check for open investigations in Criminal Investigations (CI) or Civil. Check everything in PS 29 for schemes

• Pull Current Year (CY) and Prior Year (PY) return data using the EIN and/or PTIN and use those DLNs as the condition on the Preparer Query

• Check for confirmed IDT. If there is any, send the case to EPSS for IDT instead of referring it as an abusive preparer

• Fill out all required fields on the Abusive Preparer Program Template and complete a recommendation spreadsheet (LDC ONLY)

(6) Refer the abusive preparer cases to the LDC (for abusive preparers filling more than 500 returns) and to the RPCs (for abusive preparers filling fewer than 500 returns) and to the RPO, if the referral is not egregious enough and needs to be filed as a complaint only.

(7) Lead Actions:

• Forward your recommendation to the primary ERO Leads Management and Program Analyst for review. All documentation to support your recommendation to the LDC/RPC/RPO must be included in an Excel spreadsheet or template provided.

• Forward the complete review to the program manager to forward the recommendation to the LDC, RPC, or the RPO for resolution.

• Update the FRE database with all required fields accordingly.

(1) As part of the Security Summit Initiative, lead reports are received from American Coalition of Taxpayer Rights (ACTR) members as well as other participating software partners. The returns referred as part of these lead reports are reviewed and analyzed for possible identify theft characteristics. If a return is thought to be questionable, it is processed accordingly by the IRS to ensure revenue protection. Higher level analysis is then performed to aid in identifying more returns and any filing patterns or trends that can be used in the future.

(2) Industry Lead files are received on the server through a secure data transfer process. A lead consists of two separate files:

• Control File – (txt format) – this file contains company contact information pertaining to the data file

• Data File – (xml file format) – this file contains the actual data records

(3) Lead Research

• Import the lead to the database

• Process the Industry lead file

• Review all returns in a workable process status (with stoppable refund stop dates) to identify possible identify theft returns (pattern matching)

• Disposition all returns identified as possible ID theft returns to Process Status 30 (ACE/Adjustments) through Case in the Electronic Fraud Detection System (EFDS) with the following notes:
  Note 1: "extlds Industry Leads OL"
  Note 2: "RIVO FRE PATTERN"

• Update LM - FRE with all required fields

• Update the Lead Database Status to "Completed"

• Move the lead files to the correct leads folder

(1) The State Leads Program is a program within RICS that receives referrals from various State taxing agencies relating to fraudulent and IDT returns being filed at the State level. RICS uses these leads to identify questionable returns being filed at the federal level and to identify new fraudulent filing patterns and trends.

(2) Lead Research

• Review and format the state lead file so that it can be imported into the Lead Management (LM) FRE database

• Import the lead to the database

• Review all returns that are not in a current IDT process status (with stoppable refund stop dates) to identify possible identify theft returns (pattern matching)

• Update the LM FRE database with all required fields

• Disposition all returns identified as possible ID theft returns to PS 30 (ACE/Adjustments) through CASE in the Electronic Fraud Detection System (EFDS) with the following notes:
  Note 1: "extlds State Leads OL"
  Note 2: "RIVO FRE PATTERN"

• Update the lead status to "Completed"

• Move the lead to the correct leads folder

(1) The Office of Child Support Enforcement (OCSE) assists with the Treasury Offset Program (TOP) Offset Reversal process by supplying a file of Social Security numbers associated with accounts where TOP offsets were generated from suspect returns (possibly not filed by the true taxpayer).

(2) Research using batch tools and databases to find the following information:

• The tax period associated with the TOP offset

• The IRS determination:
  Yes: All funds requested back - fraud or identity theft
  No: No funds requested back - the offset is valid

(3) Research

• Create the query

• Research the accounts

• Make the yes/no determination

• If determination is yes, input an offset reversal

• Send the determination back to OCSE

(1) The Information Security Analysis Center (ISAC) Industry Participants send leads and alerts to the IRS through the ISAC Portal. The alerts contain information related to revenue protection and potential EFIN, ERO, and preparer fraud. The referred lead reports are reviewed and analyzed by FRE for possible identify theft or fraud characteristics. If a return is thought to be questionable, it is processed accordingly by the IRS to ensure revenue protection. Higher level analysis is then performed to aid in identifying more returns and any filing patterns or trends that can be used in the future.

(2) ISAC Lead files are reviewed by FRE through the ISAC Portal. A lead consists of two separate files:

• Control File - (.txt file format) - this file contains company contact information pertaining to the data file

• Data File - (.xlsx file format) - this file contains the actual data records

(3) Lead Research and Actions

• Review and format the lead file so that it can be imported into the Lead Management (LM) FRE database

• Import the lead into the LM FRE database

• Analyst assigns the lead to themselves in the LM FRE database

• Analyze lead for potential revenue protection (pattern matching)

  Note: While reviewing the lead for revenue protection, also research for ERO issues (data breaches, compromised EFINs, preparer fraud, etc.). If discovered, follow proper ERO procedures, and continue following workflow processes.

• If applicable, disposition all returns identified to Process Status 30 (ACE/Adjustments) through CASE in the Electronic Fraud Detection System (EFDS) with the following notes
  Note 1: "extlds ISAC leads OL"
  Note 2: "RIVO FRE PATTERN"

• Update LM FRE database with all required fields

• Update the lead status to "Complete"

• Respond to corresponding ISAC lead e-mail with results

(1) The National Automated Clearing House Association (NACHA) manages the administration, development, and governance of the ACH network, which is the electronic system that facilitates the movement of money in the United States. Beginning in January 2013, an Opt-In Program was developed by the IRS, Department of Treasury Bureau of Fiscal Services (BFS) and the National Automated Clearing House Association (NACHA) and allows financial institutions to reject questionable refunds back to the IRS for review.

(2) The External Leads NACHA Group pulls a listing of NACHA rejects using Control D. The NACHA Group Point of Contact (POC) sends FRE a weekly list of NACHA rejects, broken down into tabs for R17, R18, R19 and R23 for FRE to work as follows:

(3) Step 1: Combine all three reject tabs into a single file

(4) Step 2: Check IDRS Command Code IMFOLT for the following:

• DLN

• Recovery Rebate Credit (RRC)

• Fuel Tax Credit (FTC)

• TPP Markers (TC 971 AC 124 or TC 971 AC 129)

• TC 971 AC 123 with MISC field "TPP RECOVERY", "FORCE TAC", "TPP RP" or "TAC AUTH ONLY"

• TC 971 AC 123 with MISC field "TPP RP"

• TC 971 AC 052 with MISC field "FULL YR PRN"

• TC 971 AC 199 with MISC field "AMWEX60033 GATT EFDS"

(5) Step 3: Based on the IDRS IMFOLT data, mark the NACHA rejects as follows:

(6) Step 4: Run a SNAP query on the remaining DLNs to pull Current Year and Prior Year filing data. Review and mark the rejects as follows:

(7) Step 5: Compare all remaining R17, R18, R19, and R23 NACHA rejects to IRP to identify returns that verify within the wage and withholding tolerances or underreported their wages. Mark these rejects as follows:

(8) Step 6: After marking all returns using the steps above, compile a list of returns marked for PS 30 (TPP). Forward the list to the FRE Pattern Matching Team Point of Contact (POC) for disposition and further research as needed.

(9) Step 7: Compile a list of all returns marked for Refile and complete the following:

• Run Refile list through SNAP query to identify any cases meeting Social Media Scheme criteria. If any are found, mark them as "Send to FRIV" and take no further action.

• Refile returns using CASE

• Use IDRS to close NACHA controls and place the remaining controls in B status

• Input a TC 971 AC 850 and a TC 290/.00 with priority code 1 and a post delay of 1

(10) Step 8: Place an updated NACHA inventory listing in the Shared Drive folder: S:\RICS\IVI\Shared\AUS\TAP\Misty\Reports\FRE IRP Report

(11) Step 9: Send the sorted file back to the External Leads NACHA Group POC for the Tax Examiners (TEs) to screen all returns needing manual review

(1) Pull the Cumulative Report for the AQC/WOW DUT submissions twice weekly

(2) Use the IDRS data to identify the workstream for each new submission as well as the specific AQC type or rule. Use data to identify/note any errors, such as no RIVO involvement, incorrect tax period, and XREF TINs.

(3) Send results to the RIVO P&A POC

(1) Pull the following SQL Server Reporting Services (SSRS) Reports posted weekly from the TPP - TPP RIVO Monitoring folder:

• MFT32_REV_RL

• MFT32_REV_IW

• MFT32_REV_CV

  Note: No FRE actions are needed for returns in the MFT32_REV CV report. Returns in this report are MFT32 Reversals that Return Review Program (RRP) will resequence for systemic verification (SV). Once verification is complete, the returns will move to either the MFT32 REV RL or MFT32 REV IW report,

(2) FRE performs the following actions:

(1) Access the Overage Report and Multi Case Report from the Control-D Web Access server.

(2) Using the Overage Report, download and save the 13 RIVO AAL Reports as txt files to a designated location.

(3) Using the Multi Case Report, filter by employee number and save as txt files to a designated location. The number of reports will vary each week.

(4) Once all Control D reports are pulled, use the AAL database to sort them into their specific spreadsheets.

(5) Copy the spreadsheets and txt files and move them to the three folders (Agelist, Weekly Multi Case txt files, and Weekly txt files) on the share drive for the Operation.

(6) Once all spreadsheets have been added to the share drive, send an email to the Operation to notify them that the listings are available.

(1) A control base with the activity CRTTY is only used when the taxpayer’s return is Unpostable 126 Reason Code 0 (UNP 126 RC 0) and it is trying to post to the wrong tax year.

(2) Pull CRTTY inventory weekly from the Automated Age Listing (AAL).

(3) Verify the return meets CRTTY criteria:

1. Verify that the account has an open UNP 126 RC "0".

2. Verify that the taxpayer has passed High Risk Authentication (HRA) or visited a Taxpayer Assistance Center (TAC) in person

3. Verify the DLN of the return in question and the tax year the return is intended for via Account Management Services (AMS) notes.

(4) If the return information does not verify, reject the CRTTY control back to the originator with an activity of "SEEAMS". Cite the following IRM references in AMS: IRM 25.25.6.5.1.1, The Taxpayer’s Return is Unpostable 126 Reason Code "0" and IRM 21.2.2.4.5, Account Management Services.

(5) If the return meets CRTTY conditions:

1. Resolve the UNP 126 RC 0 with a URC D.

2. Reverse any Transaction Code 971 Action Code 124 or 121s.

3. Determine whether the return is a Modernized eFile (MeF) or paper return.

4. For MeF returns, print and edit the copy of the return to the correct year. Update CRTTY control to RTN2PROC.

5. For paper returns, ESTAB the return. Update CRTTY control to ESTAB.

6. Once the paper return is received, edit it to the correct year. Update CRTTY control to RTN2PROC.

(1) FIRE receives incoming electronic files from external trading partners and passes the files or information to the Automated Magnetic Media Processing System (AMMPS), Chapter 3 Withholdings (CTW), Automated Tips (AMT), Automated Extensions (AWAX-EAWPMF) or Form 8955 Social Security Administration (SSA), which are located at ECC-MTB.

(2) Review the questionable information returns from the FIRE email for Frivolous Filer Criteria

• EX: Excessive withholding: Pay 2 and Pay 3 are within 80% of each other

(3) Determine if the questionable information return should be FRP Cleared or FRP Select

(4) If FRP Cleared:

• Send listing back to FIRE stating "FRP Cleared"

(5) If FRP Select

• Input TC810 with Responsibility Code 4 to hold refund

• Save the TIN list and manually monitor the list of questionable information returns using a SNAP query

• Once the TC150 posts, refer to PS77 and add EFDS Note "FIRE Referral for Review"

• Send a list of selected returns to the RIVPM PA POC quarterly

(1) Run the PS 77 Filter Query for Frivolous Filer Criteria

(2) Review query results and determine if the return should be FRP Cleared or FRP Selected

(3) If FRP Cleared:

• Refile returns as PS 28

• Add EFDS Note "FRP cleared no frivolous issues identified"

• Exclude returns with the following EFDS Notes and disposition to PS 31 (Refer to Ace) UNLESS they also have the EFDS Note "CONFIRMED - NOT SUSPICIOUS"
  ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
  ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
  ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
  ≡ ≡ ≡ ≡ ≡ ≡ ≡

(4) If FRP Selected:

• Move returns selected for Frivolous Return Program (FRP) treatment to PS 70 as a FRP Select

• Add one of the following EFDS Notes:
  "FRP Selected, Argument 1099 & RRP Filter"
  "FRP Selected, Argument OTHER & RRP Filter"
  "FRP Selected, Argument 2439 & RRP Filter"
  "FRP Selected, SCH A Scheme"
  "RIVO FRE PATTERN - Selected Frivolous Return ARG 1099"
  "FF Filter"
  "FRP Selected, FIRE Submission"
  "FRP Selected - Social Media Scheme"

(5) Update IDRS on all PS 70 Selects

• Create CCREQ via EITCRA to input TC 810 with a Responsibility Code 4 on potentially frivolous returns being referred

• Open an IDRS control to 1486900000 with category code "FRP3" and activity of "INCOM/PS70"

(6) Exception Selections:

• If the return is considered identity theft, input EFDS Note "RIVO RSV IDT" and push return to ACE/ADJ

• If the return contains unsubstantiated withholding, input EFDS Note "Unsubstantiated Withholding" and push return to ACE/EXAM

(1) Return Integrity and Compliance Services (RICS) uses filters for BMF Frivolous Filer identification. Each year the filters are reviewed and updated when newly identified schemes or existing scheme changes are determined.

(2) Starting in January 2022, new programming went into production to freeze potentially frivolous filings using a -Q freeze by posting a systemic TC 810 Responsibility Code 4 on IDRS. This new functionality restricts the release of the BMF TC 810 to RIVO employees.

(3) Review FRP BMF DDB Filter selections for Frivolous Filer Criteria following guidance listed in IRM 25.25.10.8, Screening Returns and Claims

(4) Based on analysis, take the following actions:

• FRP Cleared: Input TC 811 to reverse -Q freeze and release refund

• FRP Selected: Open an IDRS control to 1486900000, with category code "FRP3" and activity of "INCOM/DDB"

(1) Pull the Fraud Referral and Evaluation (FRE) Automation Spreadsheet weekly and complete the following actions:

• Open and close a control base on IDRS with the correct activity, category and received date

• Create an Issue and Action History (en masse) on the FRP Master Database under Program Code 91853

  Note: On PSL correspondence, include promoter information

(2) Send the following special instructions to FRP:

• Email completed workbook to FRP Clerical to address reject conditions and follow special instructions

• Once FRP Clerical sends back the completed actions, add the new accounts to the FRP Master Database

(3) Complete the final disposition for PSL routing

• Run "KDICALL" query and perform a GII INOLES run to build a PSL listing for the Data Processing Center (DPC) and email to FRP Clerical POC

(1) Change and Delete requests will be emailed to FRE POC by a FRP manager or lead on a weekly basis. Listing will say if request is a single issue delete or a full record delete.

(2) Once actions have been taken, email the completed listing back to the FRP POC.

(3) Refer to IRM 25.25.10.1.4, Program Management and Review, for feedback resolution.

(1) Fraud and Referral Evaluation (FRE) pulls a Selections and Analytics Platform (SNAP) Query to identify potentially fraudulent Fuel Tax Credit (FTC) returns with preparer involvement. Questionable returns identified by the Query are forwarded to the Frivolous Return Program (FRP) Coordinator to identify the most egregious filings and refer for Section 6700 investigations, if applicable.

(2) All frivolous filings will be considered for potential civil investigation when promotions, promoters, or preparers are associated with them.

(3) Ogden FRP Coordinator screening of returns, claims, and correspondence determines the need to develop case referrals for civil investigations including preparer penalties and possible injunction actions. See IRM 25.25.10.18, Civil Investigations of Abusive Promoters and/or Preparers, for detailed information.

(4) Take the following steps:

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

  Caution: ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡"≡ ≡ ≡

• ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡