25.23.11. Business Master File (BMF) Identity Theft Procedures for Accounts Management

(1) Business Master File (BMF) Identity Theft can involve the use of identifying information about a business to file fraudulent returns to support Individual Master File (IMF) identity theft or to obtain refunds from BMF accounts. An individual's stolen personal information can also be used to obtain an Employer Identification Number (EIN) which is used to file false BMF tax returns and income documents. BMF accounts includes the following entity types: sole proprietorship, corporation, partnership, estate, trust, exempt organization, or government entity.

(1) The Taxpayer Bill of Rights (TBOR) lists rights that already existed in the tax code, putting them in simple language and grouping them into 10 fundamental rights. Employees are responsible for being familiar with and acting in accord with taxpayer rights. See IRC 7803(a)(3), Execution of Duties in Accord with Taxpayer Rights. For additional information about the TBOR, see www.irs.gov/taxpayer-bill-of-rights.

(2) Policy Statement 10-1, Assisting Taxpayers who Report they are Victims of Identity Theft See IRM 1.2.1.17, Policy Statements for Security, Privacy and Assurance Activities.

(3) The statutory authority for the Fraudulent Return Request (FRR) is IRC 6103(e), Disclosure to Persons Having Material Interest, which provides a listing of persons who may generally request and receive returns and return information. IRC 6103(e)(1)-(6) and IRC 6103(e)(10) concern disclosure of returns. IRC 6103(e)(7) through (e)(9) as well as (e)(11) refer to disclosure of "return information."

(4) The Taxpayer Advocate Service (TAS) is an independent organization within the Internal Revenue Service (IRS), led by the National Taxpayer Advocate, that helps taxpayers and protects taxpayer rights. TAS offers free help to taxpayers when a tax problem is causing a financial difficulty, when they’ve tried and been unable to resolve their issue with the IRS, or when they believe an IRS system, process, or procedure just isn’t working as it should. TAS strives to ensure that every taxpayer is treated fairly and knows and understands their rights under the Taxpayer Bill of Rights. TAS has at least one taxpayer advocate office located in every state, the District of Columbia, and Puerto Rico.

(1) All AM employees who take phone calls or work paper cases, where the taxpayer states they are a victim of BMF ID theft or the employee identifies BMF ID theft, are responsible for following the procedures set forth in this IRM.

(2) Additional information is found in IRM 1.1.13.7.3, Accounts Management, and IRM 21.1.1, Accounts Management and Compliance Services Overview.

(1) Acronyms

• ACSS - Automated Collection System Support

• AM - Accounts Management

• AMS - Accounts Management Services

• AUR - Automated Underreporter

• BITR - BMF ID Theft Research Tool

• BMF - Business Master File

• BOD - Business Operation Division

• CC - Command Code

• CII - Correspondence Imaging Inventory

• CSCO - Compliance Services Collection Operations

• CSR - Customer Service Representative

• DOD - Date of Death

• EIN - Employer Identification Number

• FRR - Fraudulent Return Request

• IAT - Integrated Automation Technologies

• IDRS - Integrated Data Retrieval System

• IDT- Identity Theft

• IDTVA - Identity Theft Victim Assistance

• IMF - Individual Master File

• IPSO - Identity Protection Strategy and Oversight

• IRM - Internal Revenue Manual

• IRS - Internal Revenue Service

• LLC - Limited Liability Company

• NMF - Non Master File

• PII - Personally Identifiable Information

• RICS - Return Integrity and Compliance Services

• RIVO -Return Integrity & Verification Operation

• RPM - Return Preparer Misconduct

• SERP - Servicewide Electronic Research Program

• SFR - Substitute For Return

• SSN - Social Security Number

• TAS - Taxpayer Advocate Service

• TC - Transaction Code

(2) Definitions

• BMF Identity Theft- BMF IDT is defined by the filing of a Business Tax Return when someone creates, uses, or attempts to use a business’ identifying information without authority to obtain tax benefits.

• Fabricated EIN- This is an EIN established for the sole purpose of defrauding the government by the filing of individual Tax Returns or used for other illicit activities not related to the filing of federal tax returns or other forms. The associated Personally Identifiable Information (PII) may be stolen personal data.

• Fraud- Fraud is when a true owner of the EIN or authorized party attempts to file false tax documents to receive a refund, reduce a tax liability, or receive other tax benefits to which they are not entitled.

• Tax impact- The ID theft has caused a direct effect to the taxpayer’s account. This can include the filing of fraudulent tax returns or income documents.

• Non-Tax impact- The business’s information has been stolen but currently there is no direct effect on the taxpayer’s account.

(1) Conduct thorough research when resolving account issues. While not all inclusive, the following resource list may be helpful when researching account issues:

• IRM Part 21, Customer Account Services

• IRM 25.23.9, BMF Identity Theft Processing

• IRM 20.1, Penalty Handbook

• IRM 20.2, Interest

• IRM 25.6.1, Statute of Limitations Processes and Procedures

• IRM 1.2.1.2.36, Policy Statement 1-236, Fairness and Integrity in Enforcement Selection

• Pub 1, Your Rights as a Taxpayer

• IAT BITR Tool, Integrated Automation Technologies Business Identity Theft Research Tool

(1) This IRM provides procedural guidance for BMF Accounts Management (AM) personnel authorized to research and process BMF Identity Theft (IDT) phone and paper inquiries.

(2) BMF IDT inquiries are complex and require extensive research. IRM 25.23.9, BMF Identity Theft Processing, provides Servicewide guidance for working cases. BMF taxpayers are often not aware their identities have been compromised until a notice is received from the IRS. The taxpayer may contact IRS after receiving an unexpected notice regarding an inactive employer identification number (EIN), a recently-established EIN they have no knowledge about, or a balance due notice for a BMF form they never filed with the IRS.

(3) Generally, individual identity theft victims contact the IRS as they attempt to file the current year income tax return and discover that someone else has already filed a return using their taxpayer identification number. However, it may be several years before a business victim becomes aware of criminal activity and contacts the IRS.

(1) If there are balances owed resulting from BMF ID theft, research for BMF ID theft to determine the effects it has had on the IMF side of the X-REF SSN owner.

(2) This would involve reviewing the account to determine if there is a TC 130 on the IMF entity. The posting of a TC 130 stops any overpayments from offsetting or refunding from the account. A V- freeze (outstanding liability freeze) will be set and there may be refunds being held on the account.

(3) Research all associated accounts for outstanding balances. Balance due accounts can also reside on the Non-master File (NMF) accounts as well. Indications that there is a NMF account are:

1. TC 130 in blocking series (BS) 200-299.

2. M- freeze. The module balance will appear to be zero. This is caused by the posting of the TC 400 with a false credit which brought the balance to zero. The balance was then moved to NMF.

TC 400 with BS of	Indicates
00	A transfer from MF to NMF
05	Offer in compromise, MF to NMF
09	A transfer from MF to NMF but is a special project
99	An overflow account necessitating a move to NMF

(4) If the resolution of the ID theft issue will alleviate the balance on the BMF account, research the IMF Non-master File (NMF) account to determine if there any other possible balances are owed by the taxpayer. Use CC TXMOD, SUMRY and ENMOD with definer “N” after the TIN to research the NMF.

(5) If the determination is made that this is a fabricated EIN and the SSN owner has no association with the business, the TC 130 relating to the business must be reversed.

(6) If dealing with a legitimate business but BMF ID theft did occur, ensure there are no outstanding liabilities for the business prior to reversing the associated TC 130.

(7) For procedures to reverse any TC 130 relating to the ID theft, See IRM 25.23.11.6.10, Reversing TC 130.

(1) If the taxpayer states they are a victim of ID theft and research determines there is no tax related impact, provide the following guidance as applicable.

(2) If the taxpayer states they were alerted that their Personally Identifiable Information (PII) was breached, refer to IRM 25.23.1.7, Taxpayers who are Victims of a Data Breach, for additional information.

(3) If the business has experienced a breach of employee or client data, and the taxpayer is seeking assistance for their employees or clients, see IRM 25.23.1.6, Data Breach- Business Entities Whose Employees or Clients PII was Breached, for information to provide the taxpayer.

(4) If the taxpayer is seeking advice about the data breach of the business, ask the taxpayer about the type of information breached.

1. If a business or payroll company contacts the Service to report a data loss relating to Forms W-2 information, advise them to go to IRS.gov and search using key word, ”Identity Theft”. Click on “Identity Protection: Prevention, Detection and Victim Assistance”. Click on “Taxes. Security. Together.” In the section under “How Businesses Can Help,” click on “Form W-2/SSN Data Theft: Information for Businesses and Payroll Service Providers”. This link provides the information on various agencies and how to contact them to report the loss.

2. If a business or payroll company contacts the Service to report a theft in their office that could lead to a data breach but does not include W-2 information, advise them to contact their local stakeholder liaison. The stakeholder liaison listing can be found on IRS.gov, search keywords “Stakeholder Liaison” then click on “Stakeholder Liaison Local Contacts”. The liaisons are listed by state. The liaison will notify CI and other functions on their behalf. Advise the caller that they need to contact the liaisons as quickly as possible so the IRS can take steps to prevent the filing of fraudulent returns.

3. Advise the taxpayer they may want to contact the Federal Trade Commission or the Social Security Administration at:

Contact	Web Address	Contact Number
Federal Trade Commission (FTC)	www.ftc.gov/idtheft	877-438-4338
Social Security Administration (SSA)	www.ssa.gov search “Identity Theft”	800-772-1213

4. Advise the caller they may want to contact one of the major credit bureaus. They may be able to assist them in obtaining information needed to pursue issue relating to the loss of the businesses PII information.

Credit Bureau	Web Address	Contact Number
Equifax	equifax.com/business	800-525-6285
Experian	http://www.experian.com/business-services/business-services.html	888-397-3742
Transunion	http://www.transunion.com/business	800-680-7289

5. Advise the taxpayer they may want to file a report with their local or state police and contact their state Attorney General’s office. Provide the web site information for a list of state Attorney General, http://www.naag.org/

6. Provide the taxpayer the irs.gov website advising them to search for “business identity theft”, to obtain additional ID theft information.

(1) There will be times when a taxpayer contacts the Service advising they have no association with a business but have received a CP 575, Employer Identification Number (EIN) Assignment Notice confirming the assignment of an EIN. It is possible that an ID thief used someone’s PII to obtain an EIN for a business.

(2) If a Form 14039, Identity Theft Affidavit is received stating the taxpayer has no knowledge or association with the business, a referral must be sent to the BMF functional liaison. The BMF IDT SME’s will send the Letter 5316C, BMF Identity Theft Documentation Acknowledgment Letter (Form 14039B and required documentation), if deemed a valid BMF IDT. If the contact is by phone, do not advise them to submit a Form 14039 or Form 14039-B, Business Identity Theft Affidavit.

(3) Research the IMF side to determine if there is any past association with the EIN. This will include schedule C, Schedule H or possible wages utilizing the EIN in question. See IRM 25.23.9.4.2, Individual Taxpayers Reporting to be Victims of Business Related Identity Theft, for additional information if needed.

(4) If you are not trained in working ID theft, contact your team lead and refer to the appropriate BMF ID theft unit per IRM 25.23.11.6.4, BMF Identity Theft Paper Inquiry or IRM 25.23.11.6.5, BMF Identity Theft Phone Inquiry Made to a BMF AM CSR, using Form 14566, BMF Identity Theft Referral. For instruction on how to complete the form see Exhibit 25.23.11-1, Accounts Management Form 14566 Instructions.

(5) If trained to work BMF ID theft cases and it is determined ID theft exists, research utilizing the IAT BITR Tool and CC IMFOLE, when BITR is unavailable, to determine if there is an existing TC 971 AC 504 MISC SPCL2. This marker on the IMF side identifies the association of BMF ID theft to the SSN owner. If there is currently no ID TC 971 AC 504 SPCL2 marker, the SSN entity must be marked on CC ENMOD using CC REQ77. Overlay the SSN ENMOD and complete the fields as follows:

1. TC> 971

2. Secondary Date> The related tax year

3. TC 971/151-CD> 504

4. XREF-TIN>EIN

5. MISC>SPCL2

(6) See IRM 25.23.2.8.1.2, TC 971 AC 504- Miscellaneous Field Code SPCL1, SPCL2, RPM1, RPM2, RPM3, RPM4, and EAFAIL, for additional information.

(1) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

1. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

2. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

3. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

4. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

5. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

6. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

7. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

8. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

9. ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(4) There will be an open control assigned to 1481055555 with a category code of TPPI and an activity code showing potential IDT (POTENTIDT). RICS uses the following IDRS activity codes to indicate a response has been received from the taxpayer:

• FXMMDDYYYY - Fax correspondence received from the taxpayer (correspondence received date is used for MMDDYYYY)

• CRMMDDYYYY - Paper correspondence received from the taxpayer (correspondence received date is used for MMDDYYYY)

(5) RICS sends the Letter 6042C, Entity Verification for Business, to verify the business entity. If a TC 971 AC 711 posted, the return will be suspended for up to three years (156 cycles) from the TC 973 posted cycle. If the return has not been validated within those three years, it will be deleted from the suspense file.

(6) If a TC 971 AC 711 posted suspending the return and a second return is filed that does not hit the filters, it will post as a TC 150. If a second return is filed and it also hits the filters, a second TC 973 will post to the account. There can be more than one TC 973 on the module.

(7) The following table illustrates the codes and actions RICS will take based on the determination:

(8) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(9) If the taxpayer calls and the original return is being held for RICS review, or the return is pending RICS review, follow the If/Then chart below:

(10) If a paper case is received that meets the criteria mentioned above, follow the chart below:

(1) The taxpayer may submit a paper inquiry after receiving an unexpected notice regarding an inactive or active employer identification number (EIN), a recently-established EIN they have no knowledge about, or a balance due notice for a BMF form they never filed with IRS. Since the contact is unexpected, the taxpayer’s correspondence may indicate they are a victim of business identity theft (BMF IDT).

(2) After research has been performed to rule out potential mixed entity/period or other account situations, and there is potential identity theft, non-specialized IDT teams follow the chart below:

(3) If the case is to remain in AM IDT inventory, SMEs will take the following steps:

(4) If ID theft cannot be established through internal research and additional information is needed, send the taxpayer Form 14039-B, Business Identity Theft Affidavit using Letter 5317C, BMF Identity Theft Interim & Post Resolution Letter. See IRM 25.23.9.7, Form 14039-B, Business Identity Theft Affidavit, for additional information. Give the taxpayer 30 days to respond to the notice. Suspend the case for 45 days to allow the taxpayer time to respond.

1. If a response has not been received within that time frame, close the case and reverse the ID theft indicator with TC 972 AC 522 NORPLY. Reverse the TC 470 if one was placed on the account. Send Letter 5317C, BMF Identity Theft Interim & Post Resolution Letter, using the appropriate paragraphs.

2. If the taxpayer provides the needed information review it for completeness, legibility and determine whether all required information has been included. If the claim is complete, input a TC 971 AC 522 IDTDOC to indicate receipt of the Form 14039-B and send the Letter 5316C to acknowledge receipt of the claim and take all necessary account actions to resolve the ID theft issue. See IRM 25.23.11.6.7, Account Actions, for the steps to correct the account.

   Exception: The acknowledgement letter is not necessary if it is clear the case can be resolved within 30 days of receipt into BMF IDT inventory. Letter 5317C, BMF Identity Theft Request for Information or Closing Letter will serve as an acknowledgement. If work schedules do not allow for time to make this determination, or it is not clear then the 5316C should be sent to acknowledge receipt.

3. If there are missing documents, attempt to call the taxpayer if there is a contact number provided. Document the CII case notes with dates, times of the calls, the name of the contact and what information was requested from the taxpayer. If phone contact cannot be made within three business days or no number is provided, issue a Letter 5317C to the taxpayer requesting the needed information. In both cases, provide a 30-day time frame for submission of any missing information. If the follow-up response is not received within the 45 days, follow the procedures in (a) to close the case.

4. If, after receipt of the 14039-B, ID theft still cannot be established, send Letter 5317C using the appropriate paragraphs to provide taxpayer a complete explanation as to why the Non-IDT determination was made.

(5) If a Form 14566 is received and the case is not on CII, follow normal procedures for sending the case to be scanned with the activity code BMF IDT and appropriate category code: BID1-Employment Tax, BID2-Form 1120 or BID3-Other. Once the case is scanned into CII, send Letter 5316C if not already sent and input TC 971 AC 522 IDTCLM if not already on the module(s), then follow the procedures stated above.

(1) The taxpayer may contact a BMF phone application claiming to be a victim of business identity theft (BMF IDT) when they suspect the name and EIN of their business entity, estate, trust, or exempt organization was used without consent to file tax returns or income documents. Other common reasons for taxpayer contact include the following (this list is not all-inclusive):

• Receiving an unexpected notice regarding an inactive EIN

• Receiving a balance due notice for a BMF form they never filed with the IRS

• Receiving a rejection notice for an electronically filed return because the IRS already has a return on file for that same tax period and MFT

• The taxpayer/caller never applied for an EIN but is receiving notices for a business in their name. Send Form 14566, BMF Identity Theft Referral, to the appropriate BMF ID theft unit. See IRM 25.23.11.6.2, Individual Taxpayers Reporting to be Victims of Business-Related Identity Theft, for additional information.

• The business, estate, trust or exempt organization experienced a data breach with no tax-related impact to the business entity. For example, a business reports a breach of their computer system and after thorough research of the account, there is no evidence of a fraudulent tax return or income documents being filed. If the taxpayer/caller is seeking advice about the data breach of their business entity, ask the taxpayer/caller about the type of information that was breached. See IRM 25.23.11.6.1, Non-Tax Related Identity Theft, for additional information.

(2) Follow the normal telephone and authentication requirements under IRM 21.1.1.4, Communication Skills, and IRM 21.1.3.2.3(6), Required Taxpayer Authentication.

(3) When the caller indicates no knowledge of the EIN or business account, there are several reasons a third party may have requested an EIN on the taxpayer’s behalf for a legitimate business purpose. You must expand the normal probe questions to determine if the EIN is legitimate or if there is a high probability of identity theft. Ask the caller the following questions:

• Did a family member take over a previously-owned business and request an EIN in your name or continue to use an inactive EIN assigned to you several years ago?

• Did you join a partnership or participate in the creation of a company where you provided your taxpayer identification number (TIN)?

• Did you provide your TIN to a community association or accountant to prepare tax returns on your behalf or a third party?

• Did you create a trust or other fiscal entity through a bank or executor?

• Have you received any home care services while enrolled in a program administered by a Federal, state, or local government agency that provides funding for the home care services? If yes, a 3rd party Agent may be authorized to act on behalf of the home care recipient to report and pay Federal employment taxes which requires an EIN.

Note: This list is not all inclusive and additional probes can be found at IRM 25.23.9.4(3), BMF Identity Theft Research.

(4) Complete all initial research to rule out normal account issues and determine if the potential for ID theft exists. See IRM 25.23.11.4, Business Master File (BMF) ID Theft Research, for additional information.

(5) If the required research has been completed, and additional information is still needed to determine if ID theft exists, only request the taxpayer complete Form 14039-B, Business Identity Theft Affidavit, if the case is going to remain within AM for resolution. Form 14039-B can be found at IRS.gov. Advise the taxpayer they need to return the Form 14039-B within 30 days. If there is a balance due on the account and additional information is needed, input a 6 cycle STAUP to provide the taxpayer time to send in the information. Do not open a control. A control will be opened in CII, Correspondence Imaging Inventory, when the taxpayer submits the requested information. If the taxpayer requests assistance completing Form 14039-B, see IRM 25.23.11.6.5.1, CSR Telephone Guidance for Form 14039-B, for additional information.

(6) Once it has been determined identity theft exists, refer to IRM 25.23.11.6, BMF Identity Theft Inquiries, to assist with determining if the inquiry should be transferred or remain in AM.

(7) Update AMS with the information that supports the ID theft determination or request for additional information.

(8) If the inquiry is going to be referred to another function:

(9) If, after research, a potential for ID theft is determined and the case will remain in the BMF AM inventory:

(1) All the required research must be completed prior to referring the case to another function. This is to ensure that confirmed ID theft cases and cases with the high probability of ID theft can be placed in the correct inventory as quickly as possible.

(2) Due to the potential complexity of a BMF ID theft, it may be necessary to refer the case to another function for either resolution or assistance. All functions have established BMF ID theft Liaisons to assist in the working of ID theft cases. To find a list of the functional liaisons, see the BMF ID Theft Liaisons located on the BMF ID Theft Website.

(3) If working a paper case and the entire case is being referred to another function:

1. DO NOT close the control until the case has been accepted by the receiving function. This is to prevent the case from slipping through the cracks when moving the case from one function to another. Once the referral is accepted by the receiving function and all account actions are completed close the control.

(4) All referrals will move from one functional liaison to another functional liaison. See IRM 25.23.9.3, BMF Identity Theft Liaisons, for additional information.

(5) If the contact is received by phone, all of the required research is completed and the case is being referred, annotate the Form 14566 with “phone contact” so the liaison will be aware that no control will be open.

(6) When assistance is needed from another function the control will remain open until the response is received. The receiving function must respond to the request within 30 days of receipt. See IRM 25.23.9.8, BMF ID Theft Referrals, for additional information. If no response is received within 30 days of receipt by receiving function, follow-up should be elevated to the BMF ID Theft Liaison.

(1) Once ID theft has been established and the case reviewed by the manager or lead, it will be necessary to correct the account.

(2) If the invalid return has posted first and valid return posted as a “DUPF”:

1. Determine if ASED needs to be added prior to inputting any adjustment. On duplicate returns it may be necessary to update the ASED to reflect the correct received date of the valid return. The ASED will need to be updated if it is different from the date posted on the original return on the module. The ASED will need to be updated to the received date plus 3 years. Input the ASED with a TC 560 using CC REQ77 as appropriate. See IRM 25.6.1.6.14, Criteria for Establishing a Statute of Limitations Period, for additional information.

   Example: The return due date is 04-15-2020 and the ID Theft original return posted 04-14-2020. The ASED for this return would be 04-15-2023. The true taxpayer had filed an extension on 04-10-2020. The valid return was received on 08-14-2020, the ASED for the valid return would be updated to 08-14-2023.

2. Completely back out (nullify) the invalid return first. This is to have the adjustment notice reflect the adjustment to the taxpayer’s figures. Do not net the returns. Input the adjustment with a HC 4 to hold the notice and any credit that may be on the module.

3. Reverse any offsets in or out of the module if appropriate. Always input a secondary TC 570 on any credit transfers being moved into the ID theft module. This will hold the credit if necessary.

4. If any refund was lost as a result of the filing of the ID theft return additional procedures will need to be completed in order to balance the valid taxpayer’s account. If the refund has already been released to the invalid TP the backing out of the return will create a debit on the module. To balance the account, credit from the 1545 account will need to be moved into the account once the invalid return is backed out. Input command code IDT48 (to reverse a fraudulent refund to the taxpayer affected by IDT) or IDT58 (to reverse a partial refund to the taxpayer affected by IDT) and suspend the case until the TC 841 posts back to the account. See IRM 25.23.9.9.6, Lost Refund, for input procedures. The credit will be returned to the module as a TC 841- entire refund lost, TC 700 partial refund lost. Monitor the case until the TC 841/700 posts back to the account.

5. If the refund was lost, input a TC 470 with a post delay of 1 cycle. This will prevent the issuance of any collection notices until the credit is moved in from the 1545 account.

6. Math verify the valid return to ensure there are no errors. If there is a math error, follow normal adjustment math error procedures.

7. Once the TC 841/700 posts back to the account, adjust the account to reflect the valid taxpayer’s return. If the return is a refund or isn’t going to result in a balance due, use HC 0 to allow the adjustment notice to generate to the taxpayer. If the valid taxpayer’s return is going to result in a balance due:
   1. Determine if the return was timely filed. If the return was late you will need to manually calculate and assess any applicable failure to file (FTF) penalty. See IRM 20.1.2.2.1, When Timely mailing Equals Timely Filing or Paying (Received Date vs. Filing /Payment Date).
   2. Input adjustment using PC 2. This allows the computer to recognize the need to compute the FTP back to the return due date.
   3. Input the adjustment with the appropriate IRN 871 amount. The amount listed for the IRN 871 is the tax shown on the taxpayer’s valid return.
   4. For more details on the procedures, see IRM 25.23.11.6.8, Invalid Return Posted First and the Valid Return is a Balance Due.

8. Determine if the address is correct. If address was changed as a result of the ID theft return, correct it back to the taxpayer’s correct address.

9. Once the TC 841/700 posts, review the account to ensure all account issues have been corrected or addressed with the taxpayer.

10. Input TC 971 AC 522 CLSIDT.

11. Send Letter 5317C to explain to the taxpayer all actions taken.

(3) Only the invalid return is posted:

1. Back out the invalid return. Use HC 4 to hold the notice.

2. Reverse any offsets in or out of the module if appropriate. Always input a secondary TC 570 on any credit transfers to hold any credits being moved into the ID theft module.

3. If the refund was lost, Input a TC 470 with a post delay of 1 cycle. This will prevent the issuance of any collection notices until the credit is moved in from the 1545 account.

4. If any refund was lost as a result of the filing of the ID theft return additional procedures will need to be completed in order to balance the valid taxpayer’s account. Input command code IDT48 (to reverse a fraudulent refund to the taxpayer affected by IDT) or IDT58 (to reverse a partial refund to the taxpayer affected by IDT) and suspend the case until the TC 841/700 posts back to the account. See IRM 25.23.9.9.6, Lost Refund, for procedures. Monitor the case until the TC 841/700 posts back to the account.

5. If there are payments on the account, research the payments to ensure they are not misapplied. If they are, move them to the correct account. If you are unable to determine where a payment should be applied, move the payments to the Unidentified Remittance File or Excess Collection File per IRM 21.5.7.3.5, Researching Unidentified Remittances and Excess Collection File.

6. Determine if the address is correct. If address was changed as a result of the ID theft return, correct it back to the taxpayer’s correct address.

7. Review the account to ensure all account issues have been corrected or addressed with the taxpayer.

8. Input TC 971 AC 522 CLSIDT.

9. If EIN is active but there are no filing requirements or the taxpayer has no filing requirements for that specific form, close the appropriate filing requirements.

10. Send Letter 5317C to explain to the taxpayer all actions taken.

(4) ID theft return is an amended return:

1. Reverse the adjustment input for the amended return. Use a HC 3 to hold the notice.

2. Reverse any offsets in or out of the module if appropriate. Always input a secondary TC 570 on any credit transfers to hold any credits being moved into the ID theft module.

3. If the refund was lost, input a TC 470 with a post delay of 1 cycle. This will prevent the issuance of any collection notices until the credit is moved in from the 1545 account.

4. If any refund was lost as a result of the filing of the ID theft return additional procedures will need to be completed in order to balance the valid taxpayer’s account. Input command code IDT48 (to reverse a fraudulent refund to the taxpayer affected by IDT) or IDT58 (to reverse a partial refund to the taxpayer affected by IDT) and suspend the case until the TC 841 posts back to the account. See IRM 25.23.9.9.6, Lost Refund, for procedures. Monitor the case until the TC 841 posts back to the account.

5. Determine if the address is correct. If address was changed as a result of the ID theft return, correct it back to the taxpayer’s correct address.

6. Review the account to ensure all account issues have been corrected or addressed with the taxpayer.

7. Input TC 971 AC 522 CLSIDT.

8. Send Letter 5317C to explain to the taxpayer all actions taken.

(5) In all cases where it has been determined the EIN is fabricated and the account needs to be locked, see IRM 25.23.11.6.6.1, Fabricated EIN Referrals, for procedures. Using CC ENREQ, input “Identity theft” on the second name line (sort name) to identify this account as fabricated.

(1) There will be situations where an ID theft return posted first and the valid taxpayer’s return is a balance due and the tax was paid late or still unpaid. In these situations, failure to pay (FTP) penalties must be charged.

(2) ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

(3) If the valid taxpayer’s return was filed late, it will still be necessary to manually compute the FTF penalty.

(4) Math verify the return.

(5) It is important the correct information is entered on the adjustment to ensure the correct charging of the FTP penalty.

(6) For additional information, see IRM 25.23.9.9.4, Invalid Return Posted First and the Valid Return is a Balance Due.

(1) If an ID theft return (original or amended) has been processed and as a result a refund was issued to the Identity thief, credit back the ID theft refund amount into the taxpayer’s account in order to balance the account. This is done by moving credit from the ID theft 1545 account.

(2) Prior to moving the credit into the account, reverse all available offsets that occurred.

(3) To move the credit from the 1545 account, input command code IDT48 (to reverse a fraudulent refund to the taxpayer affected by IDT) or IDT58 (to reverse a partial refund to the taxpayer affected by IDT) as applicable.

(4) If part of the refund was offset and the credit is being returned to the module, only the portion of the refund that is unrecoverable will be moved from the 1545 account.

(5) To input the reversal using command codes IDT48 or IDT58:

• See IRM 2.4.61-1, IDT48, RPM48 or CSO48 Input Format

• See IRM 2.4.61-2, IDT58, RPM58, CSO58 Input Format

(6) Suspend case and monitor for the posting of the TC 841/700. This is usually 2-4 weeks.

(7) The preparation and posting of the TC 841 should be completed prior to backing out the return if possible.

(1) Only those trained in working ID Theft cases can reverse a TC 130 and will follow guidance below.

(2) If identity theft is confirmed, thoroughly research all related accounts for legitimate outstanding balances prior to reversing any TC 130 on the account. Ensure there are no balances on the IMF, BMF or NMF account. See IRM 25.23.11.4.1, Accounts Containing TC 130 for research steps.

(3) Prior to inputting the TC 131, forward case to manager or lead for approval.

(4) The manager or lead will review the case information and determine if the reversal is appropriate. The manager or lead will leave a CII message on the case with the facts that back up the decision to allow or disallow the reversal of the TC 130.

(5) If no liabilities remain on IDRS or NMF, input the TC 131 to ENMOD using CC REQ77.

(1) If a BMF identity theft (IDT) indicator (TC 971 AC 522) was erroneously entered on an account, subsequent research determines no ID theft has occurred or the taxpayer doesn’t respond to the request for additional information, reverse the ID theft indicator. Reverse using a TC 972 AC 522. Use the appropriate MISC code to reflect the reason for the reversal.

• NOIDT- After researching the account it is determine no ID theft exists. Document on AMS/CII why ID Theft is not indicated

• NORPLY- Taxpayer does not respond to the request for additional information

• IRSERR- Indicator input incorrectly

• FALSE- It is determined the taxpayer is falsely claiming ID theft

• OTHER- Any reason not listed above. Document AMS/CII with reason for reversal

(2) For additional information see exhibit in IRM 25.23.9-5, Reversing BMF Identity Theft Indicators-TC 972 AC 522.