Background Employment-Related Identity Fraud Individual Taxpayer Identification Number (ITIN) An ITIN is a tax processing number issued by IRS to individuals who are required to have a U.S. taxpayer identification number but who do not have and are not eligible to obtain a Social Security number from the Social Security Administration. IRS issues ITINs to help individuals comply with the U.S. tax laws, and to provide a means to efficiently process and account for tax returns and payments for those not eligible for Social Security numbers. Taxpayers may first realize they are victims of employment-related identity fraud when IRS notifies them of discrepancies in the reporting of income earned using their names and SSNs. After filing deadlines have passed, IRS’s Nonfiler and Automated Underreporter (AUR) programs use W-2 information to identify and follow up with taxpayers who appear to owe taxes but either have not filed returns (Nonfiler) or have filed returns but underreported earnings (AUR). Other taxpayers may become aware that their SSNs were used by other people when IRS sends them an Employment-Related Identity Theft (CP01E) notice. IRS sends these notices to taxpayers whose SSNs appear on W-2s that have been attached to tax returns (Forms 1040, U.S. Individual Income Tax Return) that were filed with Individual Taxpayer Identification Numbers (ITIN) (see sidebar). In these cases, IRS marks the taxpayer accounts with an employment-related identity theft indicator. Victims may also notice wages they did not earn appearing on their Social Security earnings record or may be alerted by SSA that their Supplemental Security Income benefits are being reduced or eliminated because of wages earned by someone else using their SSN. Information Exchanges Involved in Employment- Related Identity Fraud The following individuals and agencies are involved in verifying individuals’ eligibility for employment, in processing wage information, or in monitoring identity fraud cases. Employer: Employers are required to complete the Form I-9, Employment Eligibility Verification for new hires. As part of completing the form, employers certify that they have examined documentation demonstrating that new hires are who they say they are, are eligible for employment, and that the documentation appears to be genuine. The employer is required to submit a W-2 to each employee as well as SSA by January 31 each year. Employee: As part of obtaining employment, the employee provides the employer with documentation to authenticate his or her identity. It is at this point that the employee could provide someone else’s SSN or other information. DHS: DHS manages E-Verify, a free, internet-based system that employers can use to verify employees’ employment eligibility. SSA supports DHS in this effort. Federal agencies are required to use E- Verify for federal employees and contractors. Some states also require employers to use E-Verify to verify the eligibility of some or all employees or contracts. According to DHS, by the end of fiscal year 2019, more than 890,000 employers were enrolled in E-Verify. SSA: SSA receives W-2s from employers and uses this information to update earnings records and to make determinations about benefits. After receiving and processing W-2s, SSA sends the W-2 information to IRS as part of the Combined Annual Wage Reporting (CAWR) process. SSA also maintains the Social Security Number Verification Service, a free SSN verification program that registered employers can use to verify that employee names and SSNs match SSA’s records before they submit W-2s to SSA. IRS: IRS uses W-2 information to verify tax return information, such as wages, withholdings, and Employer Identification Numbers (EIN), and to enforce tax law. IRS has legal authority to penalize employers $250 for each inaccurate W-2 they submit up to a maximum of $3 million in total penalties per year. In 2013, the SSA OIG reported that IRS does not routinely penalize employers who consistently submit erroneous or inaccurate wage information. Federal Trade Commission: It collects and reports to the public aggregated data from self-reported victims of identity fraud. Victims can visit www.IdentityTheft.gov to report identity theft and access resources. A Million SSNs May Be at Risk of Employment-Related Identity Fraud and Tax Noncompliance, but the Extent of Such Fraud Is Unknown Our analysis shows that millions of SSNs in NDNH data exhibited risk characteristics associated with employment-related identity fraud in tax year 2016. More than a million of those were also at risk of not meeting all IRS tax return requirements, such as reporting all associated W-2s. However, IRS did not identify all of those noncompliant returns. Further, employment-related identity fraud can diminish tax revenues. IRS’s method for tracking employment-related identity fraud likely understates the extent of the problem. More Than 2.9 Million SSNs in NDNH Data Had Risk Characteristics in Tax Year 2016 We identified more than 2.9 million SSNs that had risk characteristics associated with SSN misuse, and had evidence of employment activity based on our analysis of NDNH verified quarterly wage records for 122.8 million individuals from August to October 2016. The risk characteristics included: Individuals who had wages reported for three or more employers in the same quarter; Individuals who were deceased; Individuals under age 14; and Individuals over age 84 (see table 1). We previously reported that the existence of three or more wage records in the same time frame for the same individual indicates possible SSN misuse, which could include employment-related identity fraud. We also previously reported, along with the Department of Justice and SSA OIG, that deceased persons, children, and elderly populations are at risk of identity theft (IDT). Fraudsters may target these groups because they believe there is a lower chance the SSNs are being used for legitimate employment. Individuals with three or more employers within the same quarter. Our analysis of NDNH data identified millions of SSNs with three or more wage records from August to October 2016. Specifically, of the 122.8 million SSNs included in the data, we found 2.8 million with three or more wage records in the same quarter. Further, we found almost 10,000 of those SSNs had wages reported by 10 or more employers in the same quarter. It is not uncommon for individuals to have second jobs or to change employers. However, when wages are reported by three or more employers for the same calendar quarter, it can indicate potential misuse of an SSN (see table 2). As an illustrative example of potential SSN misuse, one SSN had wages reported by 15 employers from 14 different states for a 3-month period in 2016 (see figure 1). According to the wage data, on average, each of these employers was paying the employee approximately $26,900 a year. Deceased individuals. We identified several thousand SSNs for deceased individuals included in the NDNH data. Specifically, the NDNH data August-October 2016 showed 13,600 SSNs for individuals SSA identified as deceased prior to May 2016. Of these, 8,400 are reported to have died before 2014. In some cases, we found individuals who had been deceased for a decade. Children. We identified tens of thousands of SSNs for children under the age of 14. Specifically, NDNH data included 33,856 SSNs of individuals who, according to SSA data, were under the age of 14 with earned income reported. One reason children can be at risk of long- term victimization of employment-related identity fraud is because it usually takes children a while before they start working or applying for financial credit. This gives a fraudster ample opportunity to exploit their stolen identities. Still, there are legitimate circumstances for children to be earning wages, such as in the entertainment and advertising industries. Elderly. We identified tens of thousands of wage records from elderly individuals. Specifically, the 2016 NDNH data included 65,823 SSNs with earned income reported that SSA data identified as being over 84. The Federal Trade Commission reported that in 2016, approximately one-fifth of IDT complaints they received involved people age 60 years or older. Further, the elderly have low participation rates in the workforce. The Bureau of Labor Statistics reported that, in 2016, the workforce participation rate for those ages 75 and above was 8.4 percent, compared to a rate of 62.8 percent for the overall workforce. Over a Million SSNs with Risk Characteristics Were Also Associated with Tax Compliance Issues for 2016, Not All of Which Were Pursued by IRS Some SSNs with risk characteristics were sometimes also associated with IRS returns that did not include required W-2 forms. Specifically, more than 1.3 million individuals—of the 2.9 million SSNs we determined to have risk characteristics associated with SSN misuse—had at least one wage record they did not report to IRS. Of these 1.3 million individuals, more than half failed to include at least one W-2 on their tax return, and slightly less than half (43 percent) did not include any W-2s in a tax return (see table 3). IRS has enforcement tools that are intended to detect reporting deficiencies, but these tools did not always detect the reporting issues we identified. IRS can use Automated Underreporter (AUR) and the Nonfiler, as well as seven IDT-related indicators to mark a taxpayer’s account or W-2 if it has determined that the SSN was compromised (see sidebar). We compared data from these enforcement tools and IDT indicators to the 1.3 million individuals identified above and found that IRS did not mark all accounts or W-2s. Action Code 501: closed identity theft cases initiated by a taxpayer. Action Code 506: closed identity theft cases initiated by IRS. Action Code 524: deceased taxpayer. It prevents the use of a deceased taxpayer's identity on a federal income tax return. Action Code 525: mismatch between the identity listed on the W-2 and on the tax return. These are cases where returns filed with an Individual Taxpayer Identification Number include a W-2 with an SSN belonging to another person. Individuals with three or more W-2s for the same period. More than a million individuals with three or more wage records did not declare at least one W-2. Additionally, we found that, in general, the more W-2s an individual had, the less likely it was that all of them would be reported to IRS (see figure 2). For instance, individuals with three W-2s declared all of them 68 percent of time, while individuals with seven declared all of them 29 percent of the time. Using its enforcement tools, IRS identified some of these individuals with three or more W-2s. Of the 1.25 million individuals in our analysis with three or more wage records who did not include all W-2s in tax year 2016, about 600,000 had wages totaling more than $23,200, meaning that they were required to file a tax return. Of these, about 340,000 individuals had at least one of the seven IDT-related indicators or were pursued through AUR or Nonfiler. In addition, IRS pursued—with AUR or Nonfiler—about half of the nearly 100 individuals who had 50 or more W- 2s reported by employers for 2016. In addition, approximately 9,000 individuals with wages totaling more than $23,200 and that did not include all W-2s in tax year 2016 also lived in five or more states (see figure 3 for an illustrative example). Deceased individuals. IRS did not apply IDT-related indicators to some of the accounts of deceased individuals we identified as having employer-reported wages not included on a tax return. Out of the 11,573 deceased individuals who reported earned income, we identified nearly 2,627 who earned at least $23,200, a threshold requiring the filing of a tax return. Of these, about 2,441 had at least one of the seven IDT-related indicators or were pursued under IRS’s AUR or Nonfiler enforcement programs. However, there were still 186 individuals that IRS did not identify. Elderly. Out of the 19,460 elderly individuals who reported earned income, we identified nearly 3,800 who earned enough to be required to file a tax return. Of these, about 1,700 had at least one out of the seven IDT-related indicators on their account or were pursued under IRS’s AUR or Nonfiler enforcement programs. However, there were still about 2,100 individuals that IRS did not identify. Children. For tax year 2016, individuals under age 14 were only required to file taxes if they earned more than $7,850. However, nearly 1,900 met this filing threshold and failed to include at least one W-2 on their tax returns. Of these, nearly 1,000 had at least one of the seven IDT-related indicators applied to their account by IRS or were pursued under IRS’s AUR or Nonfiler enforcement programs. However, there were still about 900 individuals that IRS did not identify. In considering employment-related identity fraud, IRS focuses on only one of the seven IDT-related indicators. Specifically, IRS considers mismatches between the identity listed on the W-2 and the identity on the tax return as a type of employment-related identify fraud. IRS does not consider other characteristics, such as individuals with multiple wage records, in its checks for employment-related identity fraud. Doing so would require the development of new codes or the modifications of existing ones. According to the Fraud Risk Framework, two leading practices for managing fraud risks include (1) identifying specific tools, methods, and sources for gathering information; and (2) designing and implementing control activities such as data-analytics activities to prevent and detect fraud. IRS addressed these leading practices, in part, through the AUR program, Nonfiler program, and seven IDT-related indicators, but there were still individuals in the population we examined that IRS did not identify. By assessing and documenting the feasibility of incorporating additional checks—such as multiple wage records or wage records for children under 14—into its checks of employment-related identity fraud, IRS may be able to develop a method for identifying additional taxpayers at risk of this type of fraud. Employment-Related Identity Fraud Can Reduce Tax Revenue IRS officials stated that employment-related identity fraud has limited tax consequences, as employees will nonetheless pay required taxes— including federal, state, and payroll taxes—through payroll withholding even if the fraudster fails to file a tax return. However, we found that federal income tax withholding was lower for SSNs that did not declare all the W-2s than for SSNs with all W-2s reported (see table 4). Additionally, we found individuals who did not withhold any federal income taxes across all of their related W-2s in 2016. Specifically, 37,868 individuals had at least one W-2 not declared on a tax return and withheld no federal income tax over the course of the year. Together, these individuals earned approximately $340 million in 2016. Further, 18 W-2s that were not reported on a tax return showed wages earned of more than $100,000 yet had $0 of federal income tax withheld (see figure 4 for example). IRS’s Code for Tracking Employment-Related Identity Fraud Likely Understates the Extent of the Problem Of the indicators IRS uses to track IDT, the only action code that directly relates to employment is Action Code 525, “Employment-related Identity Theft.” IRS applies the code to a taxpayer’s account when IRS processes a return filed by an individual with an Individual Taxpayer Identification Number (ITIN), and the return includes a W-2 with an SSN that does not belong to the person identified on the ITIN return. IRS refers to this situation as an ITIN/SSN mismatch. In 2018, IRS marked 818,097 accounts with Action Code 525. IRS officials acknowledged that forms of employment-related identity fraud, other than that captured by Action Code 525, are likely, but they said they do not systematically track these situations for several reasons. First, unless a taxpayer contacts IRS to say he or she did not earn the wages and disclaims them, the agency does not know whether a suspected case is employment-related identity fraud or someone who may not have included legitimate wages on his or her tax return. Second, IRS may be unable to distinguish between employment-related identity fraud and fabricated W-2s for jobs that were not worked (i.e., fake employees of a fake business). Third, while our analysis shows that employment-related identity fraud may be a more widespread problem than the ITIN/SSN mismatch that IRS currently tracks, IRS officials told us that other types of employment-related identity fraud would be identified and addressed through processes the agency applies broadly to all taxpayers, such as the AUR or Nonfiler programs. For example, according to IRS officials, if IRS receives a fraudulent W-2 from an employer using a legitimate taxpayer’s SSN, AUR or the Nonfiler program will detect it as IRS matches W-2s with tax returns. However, our analysis of NDNH and IRS data described earlier in this report shows that there are potential cases that these IRS enforcement programs did not identify. Standards for Internal Control in the Federal Government states that management should use quality information that is appropriate and complete to achieve the entity’s objectives, and that it should communicate quality information externally. However, our analysis of SSNs at risk of employment-related identify fraud indicates that the count of cases that IRS identifies under Action Code 525 likely understates the universe of employment-related identity fraud. By modifying the title of its employment-related IDT action code to more accurately reflect the data covered by the code, IRS can ensure that the agency is appropriately conveying the risk this specific type of employment-related identity fraud poses both to victims and tax administration without suggesting its statistics cover other types of employment-related identity fraud. SSA Is Taking Steps to Better Detect Inaccurate W-2s and Notify Potential Fraud Victims, but Faces Challenges Addressing Risks Associated with Some Victims SSA Detects Inaccurate W-2s and Monitors the Effectiveness of W-2 Accuracy Checks As illustrated in figure 5, SSA analyzes W-2s to detect inaccuracies. For W-2s determined to be accurate, SSA adds wages to the individual’s record on the Master Earnings File, a database that SSA uses to determine an individual’s eligibility for Social Security benefits and the amount of benefits paid. For W-2s determined to be inaccurate, SSA posts the wage information to the Earnings Suspense File. Inaccurate W- 2s may be attributable to various reasons, including employment-related identity fraud or administrative errors. SSA receives hundreds of millions of W-2s each year. SSA analyzes incoming W-2s to detect inaccuracies and adds inaccurate W-2s to the Earnings Suspense File. Based on SSA data from tax year 2016, SSA added millions of W-2s to the Earning Suspense File. On a daily basis, SSA electronically forwards IRS W-2s that it has analyzed, including both accurate and inaccurate W-2s. SSA monitors the effectiveness of its checks for inaccurate W-2s by testing its software prior to the filing season. Prior to each filing season, SSA creates test data that have characteristics of inaccurate W-2s. SSA then processes these data through the annual wage reporting software to ensure automated checks identify potentially inaccurate W-2s according to SSA’s criteria. SSA also has an electronic reporting system in place that SSA employees can use to identify and document problems for management throughout the year. SSA officials told us they have not identified any problems that have prevented checks from working as intended. This public report omits information that SSA has deemed sensitive related to (1) SSA’s efforts to improve W-2 accuracy checks, and (2) SSA’s challenges in addressing risks associated with employment-related identity fraud. SSA Is Taking Steps to More Effectively Communicate Relevant Information to Both Victims and Employers SSA is taking steps to more effectively communicate to both victims and employers information on potentially inaccurate W-2s, including potential employment-related identity fraud W-2s. When SSA detects a potentially inaccurate W-2, SSA may send a letter to the employer or employee listed on the W-2 that notifies them of the potential inaccuracy. SSA first sends letters to employers. Responses can help SSA resolve inaccuracies by identifying correct wage earners. Responses can also support SSA’s efforts to provide taxpayers with correct benefits. SSA sends different letters to employees and employers depending on the type of potential inaccuracy detected: Mismatched name and SSN. In March 2019, SSA resumed sending Educational Correspondence (EDCOR) letters to employers who submitted W-2s electronically, notifying them of the number of W-2s they electronically submitted with mismatched names and SSNs. The letters request that employers use SSA’s Business Services Online portal to view specific names and SSNs that did not match and provide necessary Form W-2C corrections. According to SSA, EDCOR letters are meant to educate employers about mismatches and help SSA post wages to correct earnings records. SSA officials told us that SSA had mailed about 577,000 EDCOR letters for electronically submitted W-2s as of June 2019 since resuming the process. Officials said the agency also began sending EDCOR letters for W-2s submitted on paper beginning in October 2019. SSA previously sent EDCOR notices from 1994 through 2007, but SSA stopped sending these notices in response to litigation surrounding a proposed DHS regulation that would have required employers to follow a prescribed course of action upon learning of an employee name or SSN mismatch. DHS rescinded its proposed rule in October 2009. SSA officials told us the agency decided to resume sending EDCOR notices in 2019 because employers are using Business Services Online to file more W-2s electronically. Therefore, employers may be more familiar with the system used to submit W-2C corrections. SSA has taken action to improve the effectiveness of EDCOR letters since the letters were discontinued in 2007. In 2008, the SSA OIG reported that EDCOR letters were not effective in either communicating wage-reporting problems to employers or identifying correct wage earners. For example, the OIG found that 74 percent of employers who reported W-2s with mismatched names and SSNs did not receive letters. Most employers that did not receive letters submitted 10 or fewer mismatched W-2s whereas SSA only sent letters to employers that submitted more than 10 mismatched W-2s. SSA officials told us that EDCOR letters sent beginning in 2019 are sent to every employer who submits a W-2 with a mismatched name and SSN. Disclaimed wages. When an individual disclaims wages, SSA staff have the option of sending a letter to the employer who paid the wages to attempt to identify the wage earner. In 2008, the SSA OIG found that SSA seldom sent letters to employers, and recommended that SSA consider generating a standard, annual letter to each employer that submitted a W-2, which was later disclaimed. SSA officials told us that, as of May 2019, SSA staff in all SSA region offices routinely send letters to employers notifying them of disclaimed wages. SSA officials reported the agency sent 20,945 letters in fiscal year 2018. IRS Has Not Assessed Opportunities to Expand Detection and Deterrence Activities IRS’s Use of Nonfiler to Detect and Deter Employment-Related Identity Fraud Is Limited IRS uses relevant information to detect inaccurate W-2s, including potentially fraudulent W-2s, and makes this information available to relevant enforcement programs, including Nonfiler, which IRS uses to follow up with individuals who appear to owe taxes but have not filed. IRS detects inaccurate W-2s using the results of SSA’s annual wage reporting checks and its own efforts to reconcile and correct some inaccuracies. As part of this process, IRS receives Earnings Suspense File W-2s that have mismatched names and SSNs from SSA and attempts to locate the wage earner’s correct name and SSN. IRS does so by identifying previously filed tax returns that list the same address as the mismatched W-2s. IRS then compares the names and SSNs listed on W- 2s to those on the tax returns to identify accurate name and SSN combinations. Accurate and inaccurate W-2s are then made accessible to IRS enforcement programs, including Nonfiler. Nonfiler and other programs that support IRS’s efforts to collect taxes owed from wage earners, including potential employment fraudsters, also may deter fraudulent activity by reducing the likelihood fraudsters succeed in not paying taxes owed. In reviewing IRS actions that may help deter employment-related identity fraud, we found that Nonfiler uses W-2 information to identify and follow up with individuals who appear to owe taxes but did not file required returns. However, we also found that IRS’s use of Nonfiler to collect taxes owed by potential employment fraudsters is limited. Nonfiler is capable of addressing cases involving certain types of employment-related identity fraudsters who appear to owe taxes—specifically fraudsters for whom IRS receives W-2s that have mismatched names and SSNs as well as SSNs associated with deceased persons or children. However, the agency has made limited use of Nonfiler to collect taxes owed on such cases and faces the following resource challenges in doing so: Reduced staffing capacity. IRS determines the number of noncompliance cases pursued by its enforcement programs based on available resources. IRS’s budget declined by about $2.1 billion (15.7 percent) from fiscal years 2011 through 2018 after adjusting for inflation, and corresponding staff reductions have been most significant within IRS enforcement programs, such as Nonfiler. In 2018, the Treasury Inspector General for Tax Administration (TIGTA) reported that resource constraints have left IRS with fewer resources to work cases involving individuals who do not respond to nonfiler notices. For example, TIGTA found that IRS created 430,000 new compliance cases in fiscal year 2017 involving individuals who did not respond to nonfiler notices compared to 1.6 million in fiscal year 2013. Competing priorities. IRS is focusing its resources on modernizing its information technology systems and implementing Public Law 115- 97—commonly referred to as the Tax Cuts and Jobs Act. This law was enacted in December 2017 and included significant changes to corporate and individual tax law. Costly follow-up contacts. According to IRS officials, collecting taxes owed by employment-related identity fraudsters typically requires IRS staff to make in-person contact with taxpayers by locating them at their places of work, which is resource intensive. According to IRS, in-person contact is typically required because employment fraudsters are unlikely to provide employers and IRS accurate address information on W-2s; therefore IRS often lacks information needed to reach employment fraudsters through mailed Nonfiler notices. IRS Has Not Assessed Opportunities to Expand Activities That May Deter Some Fraudsters Who Underwithhold To help reduce the number of nonfilers and underreporters, IRS uses the Withholding Compliance Program (WHC) to pre-emptively identify taxpayers who appear to be substantially underwithholding taxes based on prior year W-2 and other information. Through this program, IRS issues “lock-in letters” to employers of individuals who appear to be underwithholding. Lock-in letters require employers to adjust employees’ withholding amounts to rates specified by IRS rather than the employees. IRS adjusts withholding rates based on the number of withholding allowances IRS determines the taxpayer is entitled to claim. Employees are also sent lock-in letters informing them of changes to their withholding rates. WHC may be a more cost-effective opportunity than Nonfiler for IRS to collect appropriate taxes from those employment-related identity fraudsters who do not otherwise file returns and pay taxes owed. First, WHC lock-in letters would be more likely to reach their intended recipients, making them potentially more effective in obtaining their intended responses. IRS sends lock-in letters to employers, and IRS officials said the agency typically has accurate address information for employers. IRS also sends notices to employees affected by lock-in letters, but these letters do not request or require taxpayer action. Second, businesses that employ employment-related identity fraudsters may be more likely to comply with lock-in letters than fraudsters would to Nonfiler notices. According to a 2018 TIGTA report, compliance with lock- in letters could further be improved if IRS took action against employers who do not comply with the letters and adjust employees’ withholdings accordingly. TIGTA recommended that IRS penalize employers who do not respond. IRS has agreed to consider penalties, and officials told us the agency is evaluating opportunities to do so. Third, we have previously reported that IRS is less likely to collect taxes owed the longer it takes IRS to contact taxpayers. Therefore, it is likely more effective for IRS to use WHC to address potential tax liabilities before they accrue, rather than use Nonfiler to assess and attempt to contact fraudsters and collect taxes owed months after filing deadlines have passed. According to IRS officials, WHC issues lock-in letters to address underwithholding by some employees who use matching names and SSNs; however, the program does not issue lock-in letters for cases involving W-2s with mismatched names and SSNs because of privacy concerns. IRS officials said the agency has an obligation to protect all taxpayers, including potential employment-related identity fraudsters. IRS officials told us that IRS previously sent lock-in letters for cases involving mismatched names and SSNs but stopped in 2012 because the agency wanted to avoid potentially disclosing an employment-related identity fraudster’s identifying information, such as the names of their employers, to those individuals whose SSNs were used to commit employment fraud. However, IRS could also redact personally identifiable information in the lock-in letters as it already does this when mailing tax return transcripts. For example, in response to data privacy concerns, in September 2018 IRS began including just the first four characters of business names on tax return transcripts requested by taxpayers. This approach could also be used for sending lock-in letters to employees to reduce disclosures of personally identifiable information in instances where lock-in letters do not reach their intended recipients. IRS officials told us that WHC’s limited resources prevent the program from addressing all underwithholding cases currently identified by the program. Officials also said that, for that reason, expanding WHC to include cases with mismatched names and SSNs would not result in WHC selecting additional cases. However, by not including cases with mismatched names and SSNs, IRS may be missing an opportunity to identify and select a population of underwithholding cases that could lead to greater revenue collection. This is because some cases with mismatched names and SSNs may have greater underwithholding than those cases that are currently selected by WHC. If IRS were able to allocate more resources toward generating additional lock-in letters in the future, these potential benefits could also increase. In addition, WHC may be more affordable than other enforcement programs to administer on a case-by-case basis because unlike enforcement cases initiated through Nonfiler, WHC does not result in IRS pursuing taxpayers through progressively more costly methods of contact to collect additional revenue. IRS officials acknowledged this possibility and told us the agency has not assessed the potential costs and benefits of expanding WHC to include cases with mismatched names and SSNs. Internal control standards state that federal managers should use quality information to achieve their objectives, communicate relevant information throughout the agency, and both assess and address risks to their mission. Additionally, leading practices in managing fraud risks include considering the benefits and costs of controls for addressing fraud-related risks. Further, IRS’s Strategic Plan has goals to use data analytics to inform decision making and protect the integrity of the tax system. Because IRS has not evaluated and documented the costs and benefits of expanding WHC to address risks posed by employment-related identity fraudsters, the agency cannot determine whether or not expanding WHC to include mismatch cases would enable IRS to collect additional revenue and deter employment fraud. By conducting such an assessment, IRS could determine whether expanding WHC to include mismatch cases would likely enable IRS to collect additional revenue and deter employment fraud. IRS’s Approach to Managing Impacts on Victims Creates an Enforcement Gap To manage the impacts of employment-related identity fraud on victims, IRS limits the circumstances under which these victims may be selected by enforcement programs. In analyzing IRS data, we found about 3 million taxpayers who have either been identified as “employment-related identity theft” victims by IRS (Action Code 525) or who have identified themselves as victims to IRS (Action Code 501). Automated Underreporter (AUR) programming prevents these taxpayers from being selected due to wage discrepancies. Instead, AUR analyzes these taxpayers for reporting discrepancies for other income types, such as investment income. IRS officials told us excluding these taxpayers from AUR’s W-2 checks helps IRS avoid burdening some victims who may be otherwise selected based on wages earned by a fraudster using the taxpayers’ name and SSN. Selected victims would be required to follow up with IRS to avoid being assessed tax liabilities. Following up would be particularly burdensome for victims whose names and SSNs are used by fraudsters year after year. Taxpayers with IDT action codes on their accounts are eligible for analysis and selection by other enforcement programs based on discrepancies in W-2 reporting; however, these programs’ low selection rates suggest that it is unlikely IRS will follow up with these victims and notify them of these discrepancies. For example, although Nonfiler analyzes these taxpayers for evidence of income indicating a filing requirement, TIGTA found that IRS notified just 25,105 or 14 percent of all 179,878 nonfiler cases identified in fiscal year 2016 of these discrepancies. Likewise, although IDT victims may be selected for examination, IRS data show that the agency examined about 892,000 or 0.6 percent of all individual income tax returns in fiscal year 2018, the most recent year for which data are available. IRS officials acknowledge that some of the approximately three million taxpayers with Action Codes 501 or 525 may underreport their own incomes, and excluding these taxpayers from AUR’s W-2 discrepancy checks creates an enforcement gap, enabling some victims who actually underreported their own wages to avoid enforcement. IRS does not know how many of these taxpayers have underreported wage income. However, some IDT victims excluded from AUR’s wage discrepancy checks may be incentivized to underreport wages and pay less tax than they owe if they learn IRS is unlikely to hold them accountable for paying those taxes. Individuals could learn about this enforcement gap, for example, if they accidentally failed to report wages from an employer and were not later contacted by IRS. In addition other taxpayers may be incentivized to falsely claim they are IDT victims to take advantage of this enforcement gap. In its research into behavioral insights, IRS has found that taxpayers are more likely to be noncompliant when they perceive doing so can yield substantial benefits with minimal costs. We have also previously reported that the extent to which taxpayers misreport income closely aligns with IRS’s ability to detect such noncompliance. In some instances, IRS has information needed to distinguish wages earned by legitimate taxpayers from those potentially earned by employment-related identity fraudsters using that same taxpayer’s name and SSN. For example, IRS can reasonably conclude the legitimate taxpayer earned the wages if they are reported on a current- or prior-year return filed by the taxpayer, as this indicates the taxpayer attests to having worked for the employer who paid the wages. Because IRS excludes IDT victims from AUR’s W-2 discrepancy checks, IRS may not identify or collect taxes owed by some who unintentionally underreport their wages (e.g., by forgetting to include a W-2 from a second employer). In addition, IRS is missing an opportunity to incentivize taxpayers to accurately report their income and avoid intentional underreporting. As previously stated, federal internal control standards call for managers to both use quality information and respond to risks. According to IRS officials, modifying AUR to effectively identify the underreporting of wages actually earned by identity theft victims would require IRS to not only adjust AUR to include wage discrepancy checks for these taxpayers but also to change how AUR identifies wage discrepancies. IRS officials told us that when AUR evaluates a taxpayer’s wage information for discrepancies, the program evaluates taxpayers based on aggregated W- 2 information. AUR is not programmed to evaluate taxpayers by analyzing some of their W-2s but not others, such as potential employment fraud W- 2s. IRS officials told us modifying AUR to include W-2 discrepancy checks of these taxpayers while excluding potentially fraudulent W-2s would not be a cost-effective use of IRS resources at this time. Specifically, officials noted that AUR discrepancy checks are programmed in the legacy assembly language code, a low-level computer language initially used in the 1950s. Although they were unable to provide an estimate for the costs of modifying this code, IRS officials said the effort would be resource intensive. IRS is modernizing outdated information technology systems, and officials said it would be more cost effective for the agency to modify W-2 discrepancy checks once the assembly language is replaced. IRS plans to retire 75 percent of the agency’s legacy assembly language code and Common Business-Oriented Language code legacy by the end of fiscal year 2024. Officials told us the agency does not have a specific timeline in place for updating the assembly code that supports AUR, though doing so is a program goal. Modifying AUR to include wage discrepancy checks for IDT victims as part of IRS’s broader effort to update AUR’s programming code would enable IRS to avoid making costly and redundant changes to legacy coding that IRS plans to replace. It would also be consistent with a goal outlined in IRS’s Strategic Plan to advance the use of data and analytics to inform decision making and could potentially result in IRS collecting additional revenue by enabling IRS to analyze wage information for about three million additional taxpayers to identify any wage reporting discrepancies. Some of these taxpayers may have greater revenue collection potential than cases AUR would otherwise select. SSA and IRS Share Wage Reporting Data, but Opportunities Exist to Improve Collaboration SSA and IRS Collaborate on Combined Annual Wage Reporting with Defined Roles and Responsibilities SSA and IRS both have responsibility for parts of the Combined Annual Wage Reporting (CAWR) process to exchange W-2 information between the two agencies and to help ensure that taxpayers report and pay the proper amount of taxes on their wages. The CAWR Memorandum of Understanding (MOU), which was signed in 2007, is a key part of their collaborative effort, and SSA and IRS are legally bound to the mutually agreed upon purpose and functions. Specifically, the CAWR MOU covers the collaborative processes through which SSA and IRS share earnings information, including establishing clear roles and responsibilities for this effort, as called for by leading practices for inter- agency collaboration. IRS oversees tax administration, including ensuring compliance with tax laws. SSA acts as an agent to these activities by processing W-2s. As illustrated in figure 6, processes covered by the CAWR MOU include SSA sending accurate and inaccurate W-2s to IRS. Also, if wages are disclaimed through IRS, or IRS is able to correct a Social Security number-name mismatch using tax information, IRS sends this information to SSA. Federal law requires the Commissioner of Social Security and the Secretary of the Treasury to share W-2 information, and permits use of the CAWR MOU to effectuate this process. It also requires that the MOU remain in full force and in effect until modified or otherwise changed by mutual agreement of the heads of each agency. SSA and IRS Have Been Working to Update the 2007 CAWR MOU Since 2016 SSA and IRS have taken steps to update the 2007 CAWR MOU, but the effort has been underway for more than 3 years. As we reported in September 2012, continually updating agreements is an important part of the leading practice for written guidance and agreements. SSA and IRS officials told us that discussions about the update began in 2012 and the substantive work of updating the MOU began in August 2016. Since the MOU has not been updated in more than a decade, certain data-exchange materials and provisions in the MOU have become outdated, such as the references to microfilm. According to SSA and IRS officials, the MOU update has been driven by efforts at the staff level with executives briefed on the status. We have previously found that leadership involvement in collaborative efforts is needed to overcome the many barriers to working across agency boundaries. SSA officials noted that having highly involved executives would indicate problems with the MOU update process. IRS officials said that the staff level is the appropriate place to negotiate the MOU update with oversight from executives, as needed. However, at both agencies, officials at the staff level do not have the authority to agree to any updates or modifications of the MOU. SSA and IRS are responsible for ensuring the MOU update process is thorough, complete, and carried out in a timely manner. SSA and IRS officials stated that while the MOU is the cornerstone of SSA-IRS collaboration, completing the update is challenging because there are competing priorities. Additionally, the agencies are not legally required to update the MOU; instead, the MOU is in effect until modified or otherwise changed by mutual agreement of the Commissioner of Social Security and the Secretary of the Treasury (who delegated this authority to the Commissioner of Internal Revenue). In September 2019, SSA and IRS officials told us they plan to complete the update of the MOU in spring 2020, more than 3-and-a-half years after the effort to update the MOU began. Standards for project management call for developing a plan with specific actions and time frames. A plan could also identify the resources, processes, and individuals necessary to carry out the update. SSA and IRS officials acknowledged that they did not develop such a plan for the ongoing effort to update the MOU. By developing a plan for future updates that includes actions, time frames, and responsible individuals, including executive leadership, SSA and IRS would have greater assurance that the MOU would be updated when needed. SSA and IRS Have Not Developed Shared Goals and Performance Measures or Conducted Required Annual Reviews of the MOU Process While SSA and IRS have established joint functions in the CAWR MOU, the agencies do not have shared goals and performance measures to help track progress in implementing these functions and identify potential improvements. As we reported in September 2012, defining short- and long-term outcomes is an important part of the leading practice for outcomes and accountability for collaborative efforts. This includes defining and articulating common goals based on what the group shared in common and developing mechanisms, such as performance goals and measures, to evaluate the results. SSA officials said existing goals and measures in the MOU were sufficiently effective. However, we did not find evidence of goals and measures in the MOU and neither SSA nor IRS officials could provide documentation of specific examples of such. Establishing shared goals and performance measures for the CAWR MOU functions would help SSA and IRS monitor and evaluate its results, as well as identify potential weaknesses and potential improvements. While the MOU lacks goals and measures, it does contain provisions for the agencies to conduct annual studies of the CAWR process and to submit a report to each commissioner on the results. However, the agencies have not consistently implemented these provisions. Monitoring progress is an important part of the leading practice for outcomes and accountability for collaborative efforts. Continually monitoring agreements is an important part of the leading practice for written guidance and agreements. For SSA and IRS, this means monitoring progress toward fulfilling their legal obligation to implement the CAWR MOU. In the 2007 CAWR MOU, SSA and IRS agreed to the following monitoring provisions related to conducting an annual review of the CAWR process. Conduct annual joint studies of the CAWR process. Since the MOU was implemented in 2007, IRS and SSA have not conducted a joint study of the CAWR process. These reviews were intended to assist the required annual review of the MOU and help inform the agencies of potential improvements to the CAWR process. Specifically, the MOU requires that upon completion of the annual review, a joint SSA and IRS report should be sent to each commissioner consisting of the results of the review, a list of any changes that have occurred in the process, and any recommendation for changes. This is intended to serve as an important monitoring function for the MOU. IRS officials said the agencies have been unable to conduct annual joint studies or submit the required annual reports primarily because the MOU is extensive and affects many offices at both agencies. SSA and IRS officials said that they plan to change to a biannual interagency review of the MOU so they can do a better job of keeping the MOU updated and relevant. However, officials did not provide information about any steps they plan to take to ensure that the reviews would occur as required. According to SSA officials, SSA and IRS plan to meet every 3 or 6 months to review existing agreements, including the CAWR MOU. This may be a means of identifying necessary changes to the CAWR process since regular communication can facilitate effective collaboration; however, officials did not provide additional details on these potential new meetings. Conduct annual independent studies of the CAWR process. SSA had no records that it had conducted an independent study of the process in the past 3 years. IRS conducted two independent studies in 2018 on the CAWR process which primarily focused on IRS’s adherence to its policy guidance. Annual independent studies were intended to serve as another feedback mechanism to assist in the review of the MOU. According to SSA and IRS officials, they have not implemented these monitoring provisions because of resource constraints. As previously discussed, the agencies are updating the CAWR MOU and plan to finalize the updated MOU by spring 2020. Officials told us that, similar to the 2007 MOU, the updated MOU will include requirements for periodically reviewing the MOU to identify potential improvements to the CAWR process. However, the time frames may change. Developing and documenting a strategy for implementing the monitoring provisions in the updated MOU would provide greater assurance that SSA and IRS are periodically assessing the CAWR process and identifying opportunities for improvement, as required. SSA and IRS Have Developed Ways to Operate Across Agency Boundaries, but Lack Sufficient Common Terminology Related to the CAWR Process and Identity Fraud As we reported in September 2012, agreeing on common terminology and definitions is an important part of bridging organizational cultures. One way to operate across agency boundaries is to foster open lines of communication. SSA and IRS do this by holding interagency meetings, including quarterly executive-level and monthly technical-level meetings. In addition, officials from SSA and IRS said that the agencies have a strong working relationship and that officials at both agencies have frequent informal communication. The agencies also established a fraud working group, which held introductory meetings in 2018 and 2019. While the group does not have a formal mission statement, the general scope of responsibility for the group is to identify areas of common interest related to mitigating fraud and to collaborating on best practices and efforts to mitigate fraud risks. However, SSA and IRS have developed limited common terminology and definitions related to their CAWR collaboration effort. The agencies have agreed on 10 definitions in their MOU, but these definitions are very limited in scope; for example, two of these definitions simply spell out the agency names and none of the definitions are for the 20 data variables the agencies exchange daily. Both SSA and IRS officials stated that common terminology related to identity fraud would be helpful, and acknowledged that they use different terminology and have to call each other to ask what different terms mean. SSA officials cited the use of different terminology at SSA and IRS as a barrier to collaboration. Because of the absence of common terminology, IRS has been unaware of information it receives from SSA in some cases. For example, through the common format record exchange, SSA shares information with IRS about why SSA determined that a W-2 is inaccurate, but IRS was unaware of this information. SSA told us that it sends a table to IRS annually that includes code combinations for their data transfers and their meanings which explain why the W-2 was accurate or inaccurate. However, SSA officials were unsure of the extent to which IRS officials understood the codes. One reason that SSA determines a W-2 is inaccurate is if earnings with the same name, SSN, and EIN were disclaimed in previous years. SSA communicates this to IRS using codes within the W-2 record that are labeled “invalid due to SWED.” However, SSA and IRS have not defined “SWED” and IRS officials said that they were unaware of receiving information from SSA about previously disclaimed wages. Officials said they interpreted the information to relate to invalid wages due to name and SSN mismatches and spent time trying to resolve the mismatch issue. They said that such information could be useful for future enforcement efforts. Further, IRS officials said that they were also unaware of other code combinations that SSA officials told us they use to inform IRS about accurate and inaccurate wages. IRS attributed its unfamiliarity with the data elements coming from SSA to staff turnover since key IRS officials who were familiar with the data elements retired. However, IRS could have been aware of the meaning of the variables if the agencies had established and documented common definitions for these data elements. In addition, according to IRS officials, they have limited resources for following up on information that SSA is sharing because they have been focused on competing priorities, including implementing the Tax Cuts and Jobs Act of 2017. SSA and IRS officials noted that the next version of the MOU will define additional terminology that was not defined in previous MOU documents. For example, officials said that “EIN” and “TIN” are key IRS terminology that may be defined in the new MOU. Until SSA and IRS clearly define the data elements they exchange as part of the CAWR process, SSA and IRS are at risk of not communicating effectively about CAWR and, thus, missing opportunities to use data more effectively to identify fraudulent or otherwise inaccurate W-2s. This could be done, for example, by developing a shared data dictionary that clearly defines all of the data elements the agencies are exchanging. Conclusions Employment-related identity fraud can have negative impacts on victims and poses risks to both SSA and IRS. Victims may face IRS enforcement actions or a reduction in benefits for some federal programs based on wages earned by fraudsters. The full scope of this fraud is unknown. In 2018, IRS marked more than 800,000 taxpayer accounts with Action Code 525 “employment-related identity theft.” However, IRS’s use of the term “employment-related identity theft” likely understates the true scope and impact of this type of fraud and may be misleading to both agency decision makers and Congress. Additionally, by assessing the feasibility of incorporating additional compliance checks into its checks of employment-related identity fraud, IRS may be able to develop a method for identifying additional taxpayers at risk of this type of fraud. SSA and IRS rely on accurate W-2 information to carry out their missions and have taken steps to detect the submission of fraudulent W-2s. Evaluating the costs and benefits of expanding IRS’s Withholding Compliance Program (WHC) to include cases with mismatched names and SSNs may provide IRS an opportunity to increase revenue collection. Additionally, while IRS has taken steps to manage the impacts of identity fraud on victims, the agency’s decision to exclude approximately 3 million individuals with IDT action codes from Automated Underreporter’s (AUR) wage discrepancy checks has resulted in a gap in enforcement coverage. IRS plans to update most of the agency’s legacy programming code by the end of fiscal year 2024. Updating AUR’s programming to include these individuals would enable IRS to close this enforcement gap and potentially increase revenue. Further, SSA and IRS’s 2007 CAWR MOU plays an important role in IRS and SSA’s efforts to accurately report wage information and resolve mismatches. While the agencies expect to finalize their first update of the MOU by spring 2020, efforts to update the MOU have been ongoing for more than 3 years. Developing a plan for implementing future updates would provide greater assurance that the MOU would be updated when needed. Additionally, developing performance goals and measures for the MOU as well as a strategy for assuring the studies called for by the MOU are completed within the specified time frames would help ensure that SSA and IRS are periodically assessing the CAWR process, and identifying opportunities for improvement. Moreover, by clearly defining the data elements IRS and SSA exchange as part of the CAWR process, the agencies would be better positioned to effectively use the data to identify fraudulent or otherwise inaccurate W-2s. Recommendations for Executive Action We are making a total of 12 recommendations, including eight to IRS and four to SSA. The Commissioner of Internal Revenue should modify the title of IRS’s employment-related identity theft action code 525 to reflect the type of employment-related identity fraud encompassed by this action code. (Recommendation 1) The Commissioner of Internal Revenue should assess and document the feasibility of incorporating additional checks into its automated checks of employment-related identity fraud for populations at risk of employment- related identity fraud, such as children, elderly, deceased persons, and individuals associated with multiple wage records. (Recommendation 2) The Commissioner of Internal Revenue should assess and document the costs and benefits of using WHC to address compliance risks posed by potential employment-related identity fraudsters who owe taxes and take appropriate action, as needed. (Recommendation 3) The Commissioner of Internal Revenue should modify AUR to include wage discrepancy checks for victims of employment-related identity fraud once IRS has updated AUR’s legacy programming code. (Recommendation 4) The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and document a plan for updating future CAWR MOUs. The plan should identify actions, time frames, and responsible parties, including executive leadership. (Recommendation 5) The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and implement goals and performance measures for the CAWR MOU. (Recommendation 6) The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, develop and document a strategy for assuring that the reviews required by the updated MOU are completed within the specified time frames. (Recommendation 7) The Commissioner of Internal Revenue should, in collaboration with the Commissioner of Social Security, clearly define data elements they exchange with SSA. (Recommendation 8) The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and document a plan for updating future CAWR MOUs. The plan should identify actions, time frames, and responsible parties, including executive leadership. (Recommendation 9) The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and implement goals and performance measures for the CAWR MOU. (Recommendation 10) The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, develop and document a strategy for assuring that the reviews required by the updated MOU are completed within the specified time frames. (Recommendation 11) The Commissioner of Social Security should, in collaboration with the Commissioner of Internal Revenue, clearly define the data elements they exchange with IRS. (Recommendation 12) Agency Comments We provided a draft of the sensitive version of this report to IRS, SSA, the Federal Trade Commission, the Department of Health and Human Services, and the Department of Homeland Security for comment. In comments reproduced in appendix II, IRS neither agreed nor disagreed with the recommendations. In comments reproduced in appendix III, SSA agreed with the recommendations and noted that SSA and IRS officials are meeting on a recurring basis to complete an updated memorandum of understanding. IRS, SSA, the Department of Homeland Security, and the Federal Trade Commission provided technical comments which were incorporated as appropriate. The Department of Health and Human Services had no comments on the report. We are sending copies of this report to the appropriate congressional committees, the Commissioner of Internal Revenue, Commissioner of Social Security, Chairman of the Federal Trade Commission, Secretary of Health and Human Services, Acting Secretary of Homeland Security, Secretary of the Treasury, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov If you or your staff have any questions about this report, please contact Jessica Lucas-Judy at (202) 512-9110 or LucasJudyJ@gao.gov, or Rebecca Shea at (202) 512-6722 or SheaR@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology This report examines (1) the potential scope of employment-related identity fraud, including what the Internal Revenue Service (IRS) knows about this type of fraud and what we could determine by analyzing the Department of Health and Human Services’ National Directory of New Hires (NDNH) and IRS data; (2) Social Security Administration (SSA) actions to detect and deter this fraud as well as notify victims; (3) IRS actions to detect and deter this fraud as well as notify victims; and (4) the extent to which SSA and IRS are collaborating to address the issue. To describe and analyze the potential scope of employment-related identity fraud, we took the following steps: 1. Identified groups at risk of identity theft. We first reviewed Treasury Inspector General for Tax Administration, SSA Office of the Inspector General, and our prior reports on Social Security number (SSN) misuse to determine common characteristics of individuals who are at risk of SSN misuse. These characteristics include being deceased, elderly, a child, or having three or more wage records during the 3-month period of our review. Based on these reports, we defined “elderly” as over age 84 and “children” as under age 14 for the purposes of this review. 2. Identified SSNs at risk of SSN misuse. We used SSA’s full death file for dates of death for deceased individuals, and its Numerical Index File (Numident) for dates of birth for living individuals.We next compared full death file and Numident data to a quarterly extract of NDNH data listing the names and SSNs of individuals who earned wages between August and October 2016. We selected data from this quarter because, at the time of our review, these were the oldest data for which relevant IRS tax data were also available. We used this comparison to identify individuals employed between August and October 2016 who also met at least one of these at-risk characteristics. NDNH is a database of individuals employed in the United States. Data are collected and reported by state workforce agencies and federal agencies, and the database is administered by the Department of Health and Human Services’ Office of Child Support Enforcement. NDNH data are comprised of three types: verified, unverified, and unverifiable. The verified data—used in this analysis— have been checked against SSA records to confirm that the name and SSN match SSA records. Unverified data include data that do not match on name or SSN, and unverifiable data include data that did not include enough information to attempt a match (e.g., when states submit partial or missing name information). According to the Department of Health and Human Services, there were 584,013,484 verified wage records, 18,629,720 unverified, and 91,134,352 unverifiable as of December 31, 2018. Verified data were used in this analysis to make the estimate more conservative since cases of potential synthetic identity theft—where the name and SSN do not match—are excluded from verified data. NDNH is designed to assist state child support agencies in locating parents and taking appropriate, interstate actions concerning child support orders. Some authorized agencies also use NDNH data to help prevent overpayments and detect fraud. For example, IRS has access to NDNH to administer the Earned Income Tax Credit. However, IRS and SSA are not authorized to use NDNH information to detect potential employment-related identity fraud. We were authorized to use NDNH through the GAO Access and Oversight Act of 2017, Pub. L. No. 115-3, 131 Stat. 7. Form W-2, Wage and Tax Statement (W-2) was not reported on a 2016 tax return. When possible, we also limited the analysis to cases where the taxpayer had a known filing requirement. We also identified cases that were consistent with misuse of SSNs for employment-related identity fraud, rather than taxpayer noncompliance. However, we were unable to determine the total extent of taxpayer noncompliance for taxpayers included in this analysis. Our analysis is not intended to be a comprehensive effort to identify all potential cases of employment-related identity fraud. We focused our analysis on cases where matching names and SSNs were used to obtain employment. These cases pose a risk to SSA, IRS, and victims, yet little is known about these cases. 4. Analyzed tax characteristics of potential employment-related identity theft victims and other taxpayers. Last, we used CDW to analyze selected tax characteristics of both individuals we identified as having at least one employer-submitted Form W-2 that was not reported on a 2016 tax return as well as those where employer- submitted Forms W-2 were reported. For example, we analyzed data on wage withholding rates, the prevalence of selected IRS identity theft indicators on taxpayers’ accounts, and IRS enforcement actions taken against these individuals. We assessed IRS procedures against the information gathering and data analytics leading practices in the Framework for Managing Fraud Risks in Federal Programs. We did not conduct a comprehensive fraud risk assessment of the IRS enforcement programs. Our assessment was limited to the control activities surrounding employment-related identity fraud. We assessed the reliability of the full death file, Numident, NDNH quarterly wage data, and selected elements of CDW by reviewing relevant documentation, interviewing knowledgeable agency officials, and performing electronic testing to determine the validity of specific data elements in the data. We determined that the data elements used in our analysis were sufficiently reliable for the purpose of our work to describe and analyze the potential scope of employment-related identity fraud. To assess IRS and SSA actions to detect and prevent employment- related identity fraud as well as notify victims, we reviewed relevant documentation including IRS’s Internal Revenue Manual and SSA’s Policy Operations Manual System. We also interviewed knowledgeable officials from both agencies on SSA and IRS processes for detecting and preventing employment-related identity fraud and notifying victims. We compared IRS’s and SSA’s efforts to relevant federal internal control standards. We also assessed the agencies’ efforts against IRS and SSA’s respective strategic plans as well as select leading practices to combat fraud, as identified in the Framework for Managing Fraud Risks in Federal Programs. To evaluate the extent to which IRS and SSA are effectively collaborating to address employment-related identity fraud, we reviewed relevant agency documents, such as IRS and SSA’s Combined Annual Wage Reporting Memorandum of Understanding, other IRS-SSA legal agreements, meeting minutes from IRS-SSA joint meetings, and policy manuals. Because of its role with assisting victims and collecting statistics on identity theft, we interviewed agency officials from the Federal Trade Commission in addition to knowledgeable officials from IRS and SSA. Because of its role helping employers verify the identities of employees, we interviewed officials at the Department of Homeland Security. We focused our assessment on SSA and IRS because those agencies are most directly involved in the wage reporting process used to detect and resolve employment-related identity fraud. We assessed IRS and SSA’s collaboration efforts against leading practices for collaboration we have identified in our prior work and against standards for project management. We identified key elements of each leading practice and assessed the extent to which SSA and IRS collaboration on employment- related identity theft aligned with leading practices or key elements. The performance audit upon which this report is based was conducted from November 2017 to January 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We worked with SSA from October 2019 to May 2020 to prepare this public version of the original sensitive report for public release. This public version was also prepared in accordance with these standards. Appendix II: Comments from the Internal Revenue Service Appendix III: Comments from the Social Security Administration Appendix IV: GAO Contact and Staff Acknowledgments GAO Contacts Staff Acknowledgments In addition to the individual named above, the following staff made key contributions to this report: Neil A. Pinney (Assistant Director), Philip D. Reiff (Assistant Director), Melissa L. King (Analyst-in-Charge), Priyanka Sethi Bansal, Heather A. Collins, Ann L. Czapiewski, Celina F. Davidson, Pamela R. Davidson, Julia C. DiPonio, Shannon J. Finnegan, Steven Flint, Robert L. Gebhart, James A. Howard, Grace H. Kwon, Krista Loose, Maria C. McMullen, Kevin C. Metcalfe, J. Daniel Paulk, Lindsay W. Swenson, Sonya Vartivarian, Ariel Vega, and Miranda J. Wickham.