Business Master File (BMF) Identity Theft can involve the use of identifying information about a business to file fraudulent returns to support Individual Master File (IMF) identity theft or to obtain refunds from BMF accounts. An individual's stolen personal information can also be used to obtain an Employer Identification Number (EIN) which is used to file false BMF tax returns and income documents. BMF accounts includes the following entity types: sole proprietorship, corporation, partnership, estate, trust, exempt organization, or government entity.

The Taxpayer Bill of Rights (TBOR) lists rights that already existed in the tax code, putting them in simple language and grouping them into 10 fundamental rights. Employees are responsible for being familiar with and acting in accord with taxpayer rights. See IRC 7803(a)(3), Execution of Duties in Accord with Taxpayer Rights. For additional information about the TBOR, see www.irs.gov/taxpayer-bill-of-rights.

Policy Statement 10-1, Assisting Taxpayers who Report they are Victims of Identity Theft See IRM 1.2.1.17, Policy Statements for Security, Privacy and Assurance Activities.

The statutory authority for the Fraudulent Return Request (FRR) is IRC 6103(e), Disclosure to Persons Having Material Interest, which provides a listing of persons who may generally request and receive returns and return information. IRC 6103(e)(1)-(6) and IRC 6103(e)(10) concern disclosure of returns. IRC 6103(e)(7) through (e)(9) as well as (e)(11) refer to disclosure of "return information."

The Taxpayer Advocate Service (TAS) is an independent organization within the Internal Revenue Service (IRS), led by the National Taxpayer Advocate, that helps taxpayers and protects taxpayer rights. TAS offers free help to taxpayers when a tax problem is causing a financial difficulty, when they’ve tried and been unable to resolve their issue with the IRS, or when they believe an IRS system, process, or procedure just isn’t working as it should. TAS strives to ensure that every taxpayer is treated fairly and knows and understands their rights under the Taxpayer Bill of Rights. TAS has at least one taxpayer advocate office located in every state, the District of Columbia, and Puerto Rico.

All AM employees who take phone calls or work paper cases, where the taxpayer states they are a victim of BMF ID theft or the employee identifies BMF ID theft, are responsible for following the procedures set forth in this IRM.

Additional information is found in IRM 1.1.13.6.3, Accounts Management, and IRM 21.1.1, Accounts Management and Compliance Services Overview.

Managers and leads ensure compliance with the guidance and procedures in this IRM.

Employees not specialized in the BMF IDT program will be responsible for identifying BMF IDT and referring/routing inquiries and cases for BMF IDT resolution.

Program Reports: For reports concerning quality, inventory, aged listing, refer to IRM 1.4.16, Accounts Management Guide for Managers. To ensure work is resolved timely and inventory reports reflect the correct data, each AM campus MUST download the Case Control Activity (CCA) 4243, IDRS Overage Report, and CCA 4244, IDRS Multiple Case Control Report, from Control-D WebAccess (CTDWA).

Program Effectiveness: Program effectiveness is measured and controlled through:

Goals, measures and operating guidelines are provided in the yearly Program Letter. Quality data and guidelines for measurement is referenced in IRM 21.10.1, Embedded Quality (EQ) Program for Accounts Management, Campus Compliance, Field Assistance, Tax Exempt/Government Entities, Return Integrity and Compliance Services (RICS) and Electronic Products and Services Support.

Key BMF IDT terminology used throughout this guidance is defined below.

Business Identity Theft: Business identity theft (BMF IDT) is defined by the filing of a business tax return when someone creates, uses, or attempts to use a business’s or individual's identifying information without authority to obtain tax benefits.

Fraud: Fraud is when a true owner of the EIN or authorized party attempts to file false tax documents to receive a refund, reduce a tax liability, or receive other tax benefits to which they are not entitled.

Fabricated EIN: A fabricated EIN is an EIN established for a business that does not exist. The sole purpose of the fabricated EIN is to defraud the government through the filing of fraudulent tax returns (BMF or IMF) or income documents. They can also be used for other illicit activities not related to the filing of federal tax returns or other forms. The associated Personally Identifiable Information (PII) may be stolen personal data. This is considered identity theft.

Tax-Related Impact: The ID theft has caused a direct effect to the taxpayer’s account. This can include the filing of tax returns or income documents.

Non-Tax Related Impact: The business’s information has been stolen, but currently there is no direct effect on the taxpayer’s account.

Account Clean Up: RICS makes a determination the EIN is fabricated and will send Form 14566 to clean up the account only if there is a debit or credit balance. Adjustments are only required if it is necessary to resolve any balances due, credits, or payments on the account.

Refer to the table below for a list of acronyms used throughout this guidance.

Conduct thorough research when resolving account issues. While not all inclusive, the following resource list may be helpful when researching account issues:

This IRM provides procedural guidance for BMF Accounts Management (AM) personnel authorized to research and process BMF Identity Theft (IDT) phone and paper inquiries.

BMF IDT inquiries are complex and require extensive research. IRM 25.23.9, BMF Identity Theft Processing, provides Servicewide guidance for working cases. BMF taxpayers are often not aware their identities have been compromised until a notice is received from the IRS. The taxpayer may contact IRS after receiving an unexpected notice regarding an inactive employer identification number (EIN), a recently-established EIN they have no knowledge about, or a balance due notice for a BMF form they never filed with the IRS.

Generally, individual identity theft victims contact the IRS as they attempt to file the current year income tax return and discover that someone else has already filed a return using their taxpayer identification number. However, it may be several years before a business victim becomes aware of criminal activity and contacts the IRS.

If there are balances owed resulting from BMF ID theft, research for BMF ID theft to determine the effects it has had on the IMF side of the X-REF SSN owner.

This would involve reviewing the account to determine if there is a TC 130 on the IMF entity. The posting of a TC 130 stops any overpayments from offsetting or refunding from the account. A V- freeze (outstanding liability freeze) will be set and there may be refunds being held on the account.

Research all associated accounts for outstanding balances. Balance due accounts can also reside on the Non-master File (NMF) accounts as well. Indications that there is a NMF account are:

If the resolution of the ID theft issue will alleviate the balance on the BMF account, research the IMF Non-master File (NMF) account to determine if there any other possible balances are owed by the taxpayer. Use CC TXMOD, SUMRY and ENMOD with definer “N” after the TIN to research the NMF.

If the determination is made that this is a fabricated EIN and the SSN owner has no association with the business, the TC 130 relating to the business must be reversed.

If dealing with a legitimate business but BMF ID theft did occur, ensure there are no outstanding liabilities for the business prior to reversing the associated TC 130.

For procedures to reverse any TC 130 relating to the ID theft, see IRM 25.23.11.6.12, Reversing TC 130 - AM BMF IDT Employees Only.IRM 25.23.11.6.12IRM 25.23.11.6.12

If the taxpayer states they are a victim of ID theft and research determines there is no tax related impact, provide the following guidance as applicable.

If the taxpayer states they were alerted that their Personally Identifiable Information (PII) was breached, refer to IRM 25.23.1.7, Taxpayers who are Victims of a Data Breach, for additional information.

If the business has experienced a breach of employee or client data, and the taxpayer is seeking assistance for their employees or clients, see IRM 25.23.1.6, Data Breach- Business Entities Whose Employees or Clients PII was Breached, for information to provide the taxpayer.

If the taxpayer is seeking advice about the data breach of the business, ask the taxpayer about the type of information breached.

There will be times when a taxpayer contacts the Service advising they have no association with a business but have received a CP 575, Employer Identification Number (EIN) Assignment Notice confirming the assignment of an EIN. It is possible that an ID thief used someone’s PII to obtain an EIN for a business.

If a Form 14039, Identity Theft Affidavit is received stating the taxpayer has no knowledge or association with the business, a referral must be sent to the BMF functional liaison. The BMF IDT SME’s will send the Letter 5316C, BMF Identity Theft Documentation Acknowledgment Letter (Form 14039B and required documentation), if deemed a valid BMF IDT. If the contact is by phone, do not advise them to submit a Form 14039 or Form 14039-B, Business Identity Theft Affidavit.

Research the IMF side to determine if there is any past association with the EIN. This will include schedule C, Schedule H or possible wages utilizing the EIN in question. See IRM 25.23.9.4.2, Individual Taxpayers Reporting to be Victims of Business Related Identity Theft, for additional information if needed.

If you are not trained in working ID theft, contact your team lead and refer to the appropriate BMF ID theft unit per IRM 25.23.11.6.4, BMF Identity Theft Paper Inquiry or IRM 25.23.11.6.5, BMF Identity Theft Phone Inquiry Made to a BMF AM CSR, using Form 14566, BMF Identity Theft Referral. For instruction on how to complete the form see Exhibit 25.23.11-1, Accounts Management Form 14566 Instructions.

If trained to work BMF ID theft cases and it is determined ID theft exists, research utilizing the IAT BITR Tool and CC IMFOLE, when BITR is unavailable, to determine if there is an existing TC 971 AC 504 MISC SPCL2. This marker on the IMF side identifies the association of BMF ID theft to the SSN owner. If there is currently no ID TC 971 AC 504 SPCL2 marker, the SSN entity must be marked on CC ENMOD using CC REQ77. Overlay the SSN ENMOD and complete the fields as follows:

See IRM 25.23.2.8.1.2, TC 971 AC 504- Miscellaneous Field Code SPCL1, SPCL2, RPM1, RPM2, RPM3, RPM4, and EAFAIL, for additional information.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

RICS sends the Letter 6042C, Entity Verification for Business, to verify the business entity. If a TC 971 AC 711 posted, the return will be suspended for up to three years (156 cycles) from the TC 973 posted cycle. If the return has not been validated within those three years, it will be deleted from the suspense file.

There will be an open control assigned to 1481055555 with a category code of BIDT and an activity code showing potential IDT (POTENTIDT).

RICS uses the following IDRS activity codes with category code 6042 to indicate a response was received from the taxpayer:

If a TC 971 AC 711 posted suspending the return and a second return is filed that does not hit the filters, it will post as a TC 150. If a second return is filed and it also hits the filters, a second TC 973 will post to the account. There can be more than one TC 973 on the module.

The following table illustrates the codes and actions RICS will take based on the determination:

Refer to the appropriate IRM section for procedures specific to BMF returns selected for RICS review:

The taxpayer may submit a paper inquiry after receiving an unexpected notice regarding an inactive or active employer identification number (EIN), a recently-established EIN they have no knowledge about, or a balance due notice for a BMF form they never filed with IRS. Since the contact is unexpected, the taxpayer’s correspondence may indicate they are a victim of business identity theft (BMF IDT).

In January 2025, TC 971 AC 524 was expanded to lock the entity of an EIN impacted by identity theft.

The entity lock only prevents updates to the name, address, and responsible party from posting to the account.

Input of MISC code ENTLOK is limited to IPSO and RICS and does not generate TC 020 on the entity. Depending upon which area locked the entity, one of the following literals will appear in the MISC field:

Once the entity lock is input, the taxpayer will be notified that the account was locked and requests for updates to the entity must be made in writing. RICS will issue Letter 6217C to the taxpayer; AM BMF IDT will issue Letter 5317C.

If a paper case is received requesting an update to the name or address, and the account contains the indicators listed above, non-specialized IDT teams should prepare Form 14566, BMF Identity Theft Referral, and send by secure email to the AM BMF IDT liaison at *TS AM BMF IDT. In the subject line of the secure email, include the subject line: ENTLOK Entity Change Request. Include the CII ID in the subject line, if available. Suspend the case until a response is received from AM BMF IDT.

After research has been performed to rule out potential mixed entity/period or other account situations, and there is potential identity theft, non-specialized IDT teams follow the chart below:

If the case is to remain in AM IDT inventory, SMEs will take the following steps:

If ID theft cannot be established through internal research and additional information is needed, send the taxpayer Form 14039-B, Business Identity Theft Affidavit using Letter 5317C, BMF Identity Theft Interim & Post Resolution Letter. See IRM 25.23.9.7, Form 14039-B, Business Identity Theft Affidavit, for additional information. Give the taxpayer 30 days to respond to the notice. Suspend the case for 45 days to allow the taxpayer time to respond.

If a Form 14566 is received and the case is not on CII, follow normal procedures for sending the case to be scanned with the activity code BMF IDT and appropriate category code:

Once the case is scanned into CII, send Letter 5316C if not already sent and input TC 971 AC 522 IDTCLM if not already on the module(s), then follow the procedures stated above.

The taxpayer may contact a BMF phone application claiming to be a victim of business identity theft (BMF IDT) when they suspect the name and EIN of their business entity, estate, trust, or exempt organization was used without consent to file tax returns or income documents. Other common reasons for taxpayer contact include the following (this list is not all-inclusive):

Follow the normal telephone and authentication requirements under IRM 21.1.1.4, Communication Skills, and IRM 21.1.3.2.3, Required Taxpayer Authentication.

When the caller indicates no knowledge of the EIN or business account, there are several reasons a third party may have requested an EIN on the taxpayer’s behalf for a legitimate business purpose. You must expand the normal probe questions to determine if the EIN is legitimate or if there is a high probability of identity theft. Ask the caller the following questions:

Complete all initial research to rule out normal account issues and determine if the potential for ID theft exists. See IRM 25.23.11.4, Business Master File (BMF) ID Theft Research, for additional information.

In January 2025, TC 971 AC 524 was expanded to lock the entity of an EIN impacted by identity theft.

The entity lock only prevents updates to the name, address, and responsible party from posting to the account.

Input of MISC code ENTLOK is limited to IPSO and RICS and does not generate TC 020 on the entity. Depending upon which area locked the entity, one of the following literals will appear in the MISC field:

Once the entity lock is input, the taxpayer will be notified that the account was locked and requests for updates to the entity must be made in writing. RICS will issue Letter 6217C to the taxpayer; AM BMF IDT will issue Letter 5317C.

If a phone call is received from the taxpayer or their authorized representative to request an update to the name or address, and the account contains the indicators above, non-specialized IDT teams should advise the caller the change cannot be done over the phone. They must submit Form 8822-B, Change of Address or Responsible Party - Business, to update the entity information. Refer to IRM 21.1.3.20, Oral Statement Authority, and IRM 21.1.3.20.1, IMF and BMF Oral Statement Address Changes, for additional information.

If the required research has been completed, and additional information is still needed to determine if ID theft exists, only request the taxpayer complete Form 14039-B, Business Identity Theft Affidavit, if the case is going to remain within AM for resolution. Form 14039-B can be found at IRS.gov. Advise the taxpayer they need to return the Form 14039-B within 30 days. If there is a balance due on the account and additional information is needed, input a 6 cycle STAUP to provide the taxpayer time to send in the information. Do not open a control. A control will be opened in CII, Correspondence Imaging Inventory, when the taxpayer submits the requested information. If the taxpayer requests assistance completing Form 14039-B, see IRM 25.23.11.6.5.1, CSR Telephone Guidance for Form 14039-B, for additional information.

Once it has been determined identity theft exists, refer to IRM 25.23.11.6, BMF Identity Theft Inquiries, to assist with determining if the inquiry should be transferred or remain in AM.

Update AMS with the information that supports the ID theft determination or request for additional information.

If the inquiry is going to be referred to another function:

If, after research, a potential for ID theft is determined and the case will remain in the BMF AM inventory:

All the required research must be completed prior to referring the case to another function. This is to ensure that confirmed ID theft cases and cases with the high probability of ID theft can be placed in the correct inventory as quickly as possible.

Due to the potential complexity of a BMF ID theft, it may be necessary to refer the case to another function for either resolution or assistance. All functions have established BMF ID theft Liaisons to assist in the working of ID theft cases. To find a list of the functional liaisons, see the BMF ID Theft Liaisons located on the BMF ID Theft Website.

If working a paper case and the entire case is being referred to another function:

All referrals will move from one functional liaison to another functional liaison. See IRM 25.23.9.3, BMF Identity Theft Liaisons, for additional information.

If the contact is received by phone, all of the required research is completed and the case is being referred, annotate the Form 14566 with “phone contact” so the liaison will be aware that no control will be open.

When assistance is needed from another function the control will remain open until the response is received. The receiving function must respond to the request within 30 days of receipt. See IRM 25.23.9.8, BMF ID Theft Referrals, for additional information. If no response is received within 30 days of receipt by receiving function, follow-up should be elevated to the BMF ID Theft Liaison.

Once ID theft has been established and the case reviewed by the manager or lead, it will be necessary to correct the account.

If the invalid return has posted first and valid return posted as a “DUPF”:

Only the invalid return is posted:

ID theft return is an amended return:

In all cases where it has been determined the EIN is fabricated and the account needs to be locked, see IRM 25.23.11.6.6.1, Fabricated EIN Referrals, for procedures. Using CC ENREQ, input “Identity theft” on the second name line (sort name) to identify this account as fabricated.

There will be situations where an ID theft return posted first and the valid taxpayer’s return is a balance due and the tax was paid late or still unpaid. In these situations, failure to pay (FTP) penalties must be charged.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

If the valid taxpayer’s return was filed late, it will still be necessary to manually compute the FTF penalty.

Math verify the return.

It is important the correct information is entered on the adjustment to ensure the correct charging of the FTP penalty.

For additional information, see IRM 25.23.9.9.4, Invalid Return Posted First and the Valid Return is a Balance Due.

If an ID theft return (original or amended) has been processed and as a result a refund was issued to the Identity thief, the refund needs to be moved off the valid taxpayer’s account. This must be done to ensure the account reflects only the valid taxpayer's information.

CC IDT48 and CC IDT58 must be used to move refunds lost from the account. These CCs credit the EIN account and move the refund to the General Ledger 1545 account. See IRM 2.4.64 , Command Code IDT48/IDT58/RPM48/RPM58/CSO48/CSO58/ELP45 for more information.

Use CC IDT48 to move an entire refund (TC 84X). TC 841 posts to the account with document code 48.

Use CC IDT58 to move the unrecoverable portion of a partially recovered refund. TC 700 posts to the account with document code 58. Input a secondary TC 570 on your credit transfer to freeze the credit.

Use CMODE to direct the request to the correct service center. See IRM 2.4.61.1.6, Terms and Acronyms. To determine the correct service center, use the 8th and 9th position of the Refund Schedule Number (RSN). See Exhibit 3.17.79-4, Refund Schedule Number Format.

Prior to inputting CC IDT48 or CC IDT58, reverse all available offsets that occurred.

If part of the refund was offset and the credit is being returned to the module, only the portion of the refund that is unrecoverable will credited to the taxpayer’s account.

To input the reversal using command codes IDT48 or IDT58:

Suspend case and monitor for the posting of the TC 841/TC 700. This is usually 2-4 weeks.

The preparation and posting of the TC 841 should be completed prior to backing out the return if possible.

SBSE Recapture program identifies accounts where the taxpayer claimed Care Credits on an original return or an amended return that exceeded the amount to which they were entitled. SBSE corresponds using Letter 6577 when ERC is involved. If the taxpayer responds and indicates identity theft, SBSE inputs the adjustment to partially reverse or fully reverse the credit and sends BMF IDT a Form 14566 referral.

BMF IDT SMEs will review the response and determine whether identity theft occurred following normal procedures. The following examples are not all inclusive:

If no identity theft has occurred, (i.e., mixed period or mixed entity) reject the referral and provide explanation of no IDT. The referral should be sent back to the AM BMF IDT liaison, who will forward the reason for rejection to the SBSE Recapture liaison.

If identity theft did occur and a refund was issued and it has not been returned by the taxpayer then we must determine who received the refund. Research Treasury Check Information System (TCIS)/Payments Claims and Enhanced Reconciliation (Pacer) to view the paper check.

Follow the chart below:

When the taxpayer is not a victim of identity theft, the TC 971 AC 522 must be reversed, and AMS/CII must be documented with the reasoning behind the determination that no ID theft exists. See IRM 25.23.9.6.7, Reversing Business Master File (BMF) Identity Theft Indicators - Transaction Code (TC) 972 Action Code (AC) 522 NOIDT, for additional information.

When you have determined the taxpayer is not a victim of identity theft, take the following actions:

AM BMF employees trained in working ID Theft cases can reverse a TC 130 and will follow guidance below.

If identity theft is confirmed, thoroughly research all related accounts for legitimate outstanding balances prior to reversing any TC 130 on the account. Ensure there are no balances on the IMF, BMF or NMF account. See IRM 25.23.11.4.1, Accounts Containing TC 130 for research steps.

Automated Non-Master File (ANMF) places TC 130 for debit account balances greater than $50 on related Non-Master File (NMF) taxpayer modules which have DLNs with blocking series 200-209. Input of a subsequent TC 131 will reverse all prior TC 130.

If a TC 130 should be reversed, do not input TC 131 until confirmation has been received from the Non-Master File team there is no outstanding ANMF debit balance. Email the NMF team at *TS KCSPC Non-Master File Team prior to forwarding the case to the manager or lead for approval to reverse the TC 130.

Prior to inputting the TC 131, forward the case to your manager or lead for approval, and include the confirmation email received from the NMF team stating there are no outstanding ANMF debit balances.

The manager or lead will review the case information and determine if the reversal is appropriate. The manager or lead will leave a CII note on the case with the facts that back up the decision to allow or disallow the reversal of the TC 130.

If no liabilities remain on IDRS or NMF, after you have received manager or lead approval, input the TC 131 to ENMOD using CC REQ77.

If a BMF identity theft (IDT) indicator (TC 971 AC 522) was erroneously entered on an account, subsequent research determines no ID theft has occurred or the taxpayer doesn’t respond to the request for additional information, reverse the ID theft indicator. Reverse using a TC 972 AC 522. Use the appropriate MISC code to reflect the reason for the reversal.

For additional information see exhibit in IRM 25.23.9-5, Reversing BMF Identity Theft Indicators-TC 972 AC 522.