Tax Fraud
Tax fraud is the deliberate falsification of tax information to reduce a liability or claim money that is not owed. Most of it — underreported income, inflated deductions, hidden accounts — is a matter for tax authorities and has nothing to do with identity. One branch is different: tax-related identity theft, where someone files a return in another person’s name to collect their refund. That is an identity verification problem, and it is the part worth understanding here.
| Broad definition | Willful falsification of tax information to evade liability or obtain money |
| Common forms | Underreporting income, inflating deductions, concealing assets or accounts, payroll tax fraud |
| Distinct from tax avoidance | Avoidance uses lawful means to reduce liability; fraud requires willfulness |
| The identity branch | Stolen identity refund fraud — filing in someone else’s name to claim their refund |
| What the fraudster needs | A name, date of birth and taxpayer identification number — all commonly breached |
| How the victim finds out | Their own return is rejected as a duplicate filing |
| Principal U.S. control | The IRS Identity Protection PIN, a six-digit number renewed annually |
| Reported via | Form 14039, the Identity Theft Affidavit |
Why refund fraud is an identity problem
The mechanics are unglamorous and that is the point. A tax authority receives a return, matches it to a taxpayer record, and issues a refund. The matching is done on identifiers — name, date of birth, taxpayer identification number — and those identifiers are not secret. They appear in essentially every consumer data breach and are sold as part of the package known as fullz.
Two features make the fraud attractive. It is early — the fraudster files as soon as filing opens, before the real taxpayer does, so the fraudulent return is the first one on file. And it is fast: the refund is paid before the employer’s own reporting has been matched against it.
The victim usually learns nothing until their genuine return is rejected as a duplicate. By then the money has gone, and the remedy is an affidavit, an investigation and a long wait.
The IP PIN, and what it demonstrates
The main U.S. countermeasure is the Identity Protection PIN: a six-digit number, known only to the taxpayer and the IRS, that must appear on the return. Without it, an electronically filed return in that taxpayer’s name is rejected. It renews annually, and it is now open to anyone with a Social Security number or ITIN who can verify their identity.
That last clause is the interesting part. To obtain the control that protects your identity, you must first prove your identity — which is the same circularity that appears in account recovery, in age assurance, and in every other place a system has to establish who someone is without a prior relationship to lean on.
It also shows the shape of the fix. The PIN works because it is a shared secret the tax authority issued, rather than a fact about the taxpayer that a breach can expose. Identifiers that anyone can look up cannot authenticate anyone, which is the same reason knowledge-based authentication stopped working.
Why this matters beyond tax
Stolen identity refund fraud belongs to the same family as application fraud and benefit fraud: a real person’s identifiers are used to claim something from an institution that never met them. The institution is not defrauded of its own money in the ordinary sense — it correctly pays what the record says is owed, to the wrong person.
What breaks the pattern is verifying the claimant rather than matching the data. A check that asks whether the identifiers are correct will pass, because they are. A check that asks whether the person presenting them is the person they belong to — an authenticated document, a biometric comparison — is asking a question the fraudster cannot answer from a breach file. That is the argument for identity document verification in any high-value claims process, and it is why synthetic and stolen identity controls are relevant well outside financial services.
Tax fraud, avoidance and identity theft compared
| What it is | Who is harmed | |
|---|---|---|
| Tax avoidance | Reducing liability through lawful means | Nobody — it is legal, however contested |
| Tax evasion or fraud | Willfully falsifying information to reduce liability | The public revenue |
| Stolen identity refund fraud | Filing in another person’s name to claim their refund | The taxpayer and the revenue |
| Employment identity theft | Using another person’s identifiers to obtain work | The taxpayer, who is assessed on income they never earned |
What identity controls can’t do
They do not touch most tax fraud. Underreported income and inflated deductions are committed by correctly identified people. Identity verification is irrelevant to them.
A PIN can be phished. A shared secret is stronger than a public identifier and it is still a secret someone can be persuaded to disclose.
Filing volume constrains the check. Tax authorities process enormous volumes in short windows, which limits how much verification can sit in the path without breaking the season.
Detection is usually retrospective. The duplicate filing is what reveals the fraud, and it appears after the refund has been paid.
Frequently asked questions
What is tax-related identity theft?
Using another person’s identifying information — typically name, date of birth and taxpayer identification number — to file a tax return and claim their refund. The victim usually discovers it only when their own return is rejected as a duplicate filing.
What is an IP PIN and who can get one?
The Identity Protection PIN is a six-digit number known only to the taxpayer and the IRS, required on the return for it to be accepted. It renews each year. Enrollment is open to anyone with a Social Security number or ITIN who can successfully verify their identity.
What is the difference between tax avoidance and tax fraud?
Tax avoidance uses lawful means to reduce a liability. Tax fraud requires willfulness — deliberately falsifying information to evade tax or claim money not owed. The distinction is intent, and it is what separates an aggressive filing position from an offense.
How does identity verification help against refund fraud?
It changes the question being asked. Matching identifiers confirms that the data is correct, and breached data is correct. Verifying an authenticated identity document against a live biometric asks whether the claimant is the person those identifiers belong to, which is not something a breach file can answer.
Related reading
- Identity theft — the wider crime this is one expression of
- Application fraud — the same pattern — real identifiers, wrong claimant — in a lending context
- Knowledge-based authentication — why identifiers that can be looked up no longer authenticate anyone
- Fullz — the packaged identity data a fraudulent return is filed from
