IRS Impersonation Scam

An IRS impersonation scam is a fraud in which someone poses as the Internal Revenue Service, or as a debt collector working for it, and uses the claimed authority to obtain money or personal information. The Federal Trade Commission files it under "IRS Impersonation Scams" as one of the government impersonation scams, and describes the standard version: the caller says you owe taxes you must pay immediately, and may threaten arrest, deportation or the loss of your driver's license.

The reason this scheme deserves its own page rather than a paragraph is that almost every rule people carry for detecting it is wrong. The IRS does sometimes call. It does use automated messages. Its private collection agencies do telephone taxpayers. Letters arrive on official letterhead that the IRS did not send. What the IRS provides instead of a channel rule is something better and much less well known: a verification procedure built into genuine collection cases, which an impersonator cannot reproduce because it depends on a document that was mailed before the call.

How the IRS actually initiates contact, what its annual warning list contains, and where to report tax fraud generally are covered on our page on tax scams. This page is about the impersonation itself.

The verification path, which is the most useful thing on this page. The IRS is required to assign certain overdue, inactive tax debts to private collection agencies, and it publishes exactly how that begins. Before any private collector makes contact, two letters arrive: "The IRS will first send Notice CP40 to let you know that your overdue tax account was assigned to a private collection agency. The private collection agency then sends their initial contact letter." Then the operative sentence: "Both letters contain a taxpayer authentication number. It's used to confirm your identity. It's also for you to verify that the caller is legitimate."

The step that follows is what makes it hard to fake. The IRS describes the call itself: "You will be asked to exchange portions of the taxpayer authentication number with the private collection agency to validate each other's identity." Both sides prove themselves against a number that was mailed to the taxpayer's address of record before either spoke. A caller who cannot supply their half has failed a test that has nothing to do with how convincing they sound. The IRS also names the three agencies it uses and publishes their addresses and telephone numbers, so whether the caller's employer exists is itself checkable.

The payee is a second check, and it is short enough to remember. Describing what happens when a Revenue Officer visits, the IRS says that if you owe tax "you can pay the officer in cash or check, certified funds or money order payable to 'United States Treasury.'" That is the name a genuine payment goes to. It is not a person, not a collection agency, not a payment app handle, and not a gift card code. The FTC's version of the same point is that a private debt collector working for the IRS "will never ask you to pay over the phone", and that neither the IRS nor its collectors will demand a wire transfer, gift cards, cryptocurrency or a payment app.

The credentials are askable, and most people do not know they may ask. The IRS states that Revenue Officers, Revenue Agents and Fuel Inspectors each carry an IRS-issued credential, called a pocket commission, and an HSPD-12 card. Both bear the employee's serial number and photograph, and the IRS says in terms: "You can ask to see both." Criminal Investigation Special Agents are a separate category, present law enforcement credentials, are the only armed IRS employees, and, according to the IRS's own description of their work, do not demand payment. If the person at the door will not produce identification, the IRS's advice is to call the number on the card provided by the officer or agent, and, if you feel unsafe, to call 911.

The pretexts, and what each is engineered to do. The unpaid-balance version supplies a reason to pay; the threat of arrest, deportation or license revocation supplies the urgency. A crossover version claims a Social Security number will be suspended, which the FTC answers by stating that the real Social Security Administration will not suspend one, and which is aimed at people who will call the "agency" back with identifying details in hand. Caller ID showing a Washington area code is dressing, since caller ID can display anything. And a refund version runs the other way, offering money in order to collect the bank details it would supposedly be paid into.

Where a report goes, and it is not where people assume. IRS impersonation is reported to the Treasury Inspector General for Tax Administration, which is a separate body from the IRS and from the Federal Trade Commission. The FTC's own guidance directs consumers there for IRS scammers specifically. Reports about tax fraud generally, phishing messages imitating the IRS, and tax identity theft go by the three separate IRS routes set out on our page on tax scams.

The call has a shape, and each element defeats a specific check.

1. An authority claim, usually with a badge or employee number and a spoofed caller ID.
2. A balance owed, stated with enough confidence to sound like a record rather than a guess. Some callers know a Social Security number or the last digits of one, which came from somewhere other than the IRS.
3. A threat, typically arrest, deportation or a revoked driver's license. The IRS's own list of warning signs includes being threatened, and separately includes a demand for payment now.
4. A deadline in hours, because the scheme fails if the target hangs up and looks anything up.
5. A payment method that cannot be recalled, and an instruction not to discuss it with anyone, sometimes framed as the case being sealed.

A hypothetical example, and the check costs nothing. A caller says he is with a private collection agency working for the IRS, that $4,200 is overdue, and that a warrant issues at close of business unless it is paid today by prepaid card. He gives a case number and a callback number.

Two questions settle it without any argument about whether the IRS calls people. Did a Notice CP40 arrive, followed by a letter from the agency itself, and do those letters carry a taxpayer authentication number? And can the caller exchange his portion of that number, as the IRS says a genuine collector will? If no letters came, the case does not exist. If they did, the number on the paper in your hand settles the caller's identity, and the payment goes by the routes the IRS publishes, payable to United States Treasury, not to a prepaid card. The $4,200 never has to be argued about, because the identity question is answered before the amount is discussed.

An IRS impersonation scam has no upside, so what follows is what verifies a genuine contact and what does not.

What genuinely verifies

• The two letters. A private collection assignment starts with Notice CP40 from the IRS and then a letter from the agency, and both carry the same taxpayer authentication number.
• The exchange of portions of that number, which is the step an impersonator cannot complete because it depends on a document mailed to your address.
• The payee. A genuine payment is made to United States Treasury, or through the payment routes the IRS publishes on its own site.
• The credentials. Revenue Officers, Revenue Agents and Fuel Inspectors carry a pocket commission and an HSPD-12 card, both showing a serial number and photo, and you may ask to see both.
• Your own account. Signing in at an address you typed yourself shows whether a balance exists, which answers the question the caller is trying to answer for you.

What does not verify anything

• The channel. The IRS says it may call about account matters and may use automated messages, so "they phoned, therefore it is fake" is wrong, and so is the reverse.
• Caller ID, including a Washington area code, which can be set to display anything.
• A letter on IRS letterhead. Counterfeit ones circulate, which is why the notice or letter number is looked up rather than trusted.
• Personal details the caller knows about you, which came from a breach, a public record or a purchase, not from the IRS.
• A callback number the caller supplied, which reaches the same operation.