Watch CBS News

IRS Policies Protect 1.2 Million Identity Thieves

Roughly 1.2 million taxpayers appear to be ongoing victims of identify theft, but the Internal Revenue Service doesn't have a good way to warn them. In fact, agency rules make it possible for undocumented immigrants to fraudulently use Social Security numbers of U.S. citizens and still file tax returns (with another identifying number) to claim refunds, according to a report put out by the Treasury Inspector General for Tax Administration.

TIGTA, which oversees the IRS, discovered the identity theft problem when an apparent identity thief complained that his wages were being taken because of a debt owed by his victim. An IRS employee asked for a review because the agency didn't have a good way to release the wages due to the thief.

The IRS worker did eventually release the thief's tax levy. But the report said that there was no way for the agency to warn the victim -- or to know whether the victim's tax problems were ultimately caused by the identity theft.

"The IRS must take steps to ensure that innocent taxpayers are notified when there is evidence that their identity has been compromised," said J. Russel George, the Treasury Inspector for Tax Administration.

A little background is needed to understand.

The IRS has been using matching programs to identify tax cheating for more than a decade. When you get a W-2 form from your employer (or a 1099 from your bank or broker), an identical form is transmitted to the government. The IRS compiles all of this income information by Social Security number.

When you file your tax return, the IRS matches the income you reported on your 1040 to the income information it has received from other sources to ensure that you reported (and paid tax on) everything.

But when somebody steals your Social Security number to get a job, that person's employer will report the thief's income under your Social Security number, which will throw the identity thief's income into your file. That triggers a so-called "computerized audit" and a notice demanding that you pay more tax on this "unreported income."

If you're not too intimidated to respond, you might call or write the IRS and say that you don't have income from that source. With the proper avalanche of paperwork, the IRS will erase the phantom income from your tax file and add a note that you're an identity theft victim, which will presumably make your tax headache a little less onerous the next year.

Meanwhile, the identity thief is supposed to file a tax return too. (Even if the source of your income is illegal, you're expected to pay income tax on the proceeds.) Besides, the thief would want to file a return if his employer has been withholding taxes because he could potentially get a refund of any overpayment. (Almost half of Americans don't pay income taxes. Assuming the identity thief didn't earn a fortune, he'd get every dollar of withholding back in the form of a check from the U.S. Treasury.)

But an identity thief might be thwarted from filing a return with your Social Security number because of the matching program. He's not going to know your wages or withholding (thank heavens, because then he'd probably nab your refund too). So the IRS gives the thief a way to file and claim just his income and withholding by allowing individuals to apply for an individual taxpayer identification number. This number doesn't validate your citizenship status or give you any special protections in the work place. It just allows you to file a tax return without a valid Social Security number.

There are about 3 million individuals filing with ITINs, according to the Taxpayer Inspector General's report. Roughly 1.2 million of those appear to be using Social Security numbers used by other taxpayers.

"The IRS does not actively try to identify or stop the individuals from committing identity theft," the TIGTA report says. Nor does the agency notify the employer of the problem because the agency believes this would violate tax privacy laws.

But because the IRS and Social Security Administration assume the information on the W-2 is accurate, "the earnings resulting from the identity theft will be attributed to the lawful taxpayers for determining both Social Security benefits and tax liabilities."

The IRS, meanwhile, says it doesn't actively pursue collection of taxes owed on a stolen identity because the taxes owed are generally not sufficient enough to bother.

In other words, the victim will have to explain himself to two federal agencies, while the thief can walk away with a tax refund with relative impunity.

TIGTA has suggested a host of technological fixes that would at least give the IRS the ability to notify victims that they have an identity theft problem. The IRS says it's in the process of trying to comply.

But here's a bigger question: Why do our tax laws allow an undocumented worker (or felon) who has stolen someone else's Social Security number to get a tax refund at all? How about requiring anyone asking for a refund with a ITIN to show that their Social Security number is valid. If it's not, the tax payments could stay with the U.S. Treasury to, perhaps, repay the cost of immigration enforcement.

By the way, if you think providing tax refunds to identity thieves is stupid, don't blame the IRS. Congress writes the tax law. The IRS merely enforces the law that's written.

More on MoneyWatch
5 Tax Mistakes You Don't Want to Make
Avoid These IRS Red Flags
Tax Credits for Sports Cars

View CBS News In
CBS News App Open
Chrome Safari Continue
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.