AccessibilitySkip to Top NavigationSkip to Main ContentHome  |  Contact IRS  |  About IRS  |  Site Map  |  Español  |  Help  

25.1.2  Recognizing and Developing Fraud

25.1.2.1  (01-01-2003)
Overview

  1. This section discusses the fact that a fraud case begins with the compliance employee's recognition of affirmative indications and acts of fraud by the taxpayer. Further development of these " indicators" (a sign or symptom, for example, an unexplained increase in net worth) assists the employee in establishing the firm indications (affirmative acts) necessary for a successful fraud case.

  2. When initial indications (signs or symptoms) of fraud are uncovered, the compliance employee should initiate a discussion with his/her group manager and the FRS. Service Center Examination employees should refer to their designated Fraud Coordinator who will act as liaison to the FRS. A plan of action should be developed jointly as early as possible to document firm indications (affirmative acts) of fraud. An integral part of the plan is establishing that sufficient affirmative acts exist to confirm fraud. The plan should be a joint effort of the compliance employee, manager and the FRS.

  3. The compliance employee, with assistance of the FRS, must know when to suspend action on the case and prepare a criminal referral. If the compliance employee stops too soon all the information necessary to document firm indications (affirmative acts) of fraud may not be developed sufficiently for CI.

  4. The minimum plan of development should include following up on all leads indicated as fraud indicators (signs or symptoms), securing copies of all relevant data relating to indicators of fraud (signs or symptoms) and noting from whom and when obtained. Documents obtained from the taxpayer or other third parties should not be annotated with any comments by the compliance employee. It is critical for the employee to secure the taxpayer’s explanations for any discrepancies.

  5. An understatement of the tax liability alone is not fraud. In order to sustain the civil fraud penalty or make a criminal referral, the compliance employee must establish the intent was to defraud.

  6. For area compliance employees, when it is agreed by the examiner, group manager and FRS that potential for fraud exists, the case will be updated to Status Code 17 (Fraud Development Status). This decision is an important event in the examination and should be documented in the case file. Form 11661, Fraud Development Status, may be utilized to document FRS involvement as well as the decision to update the case to Status Code 17. While in Status Code 17 (Fraud Development Status) and Status Code 18 (Accepted by CI), cycle time will be excluded from monthly "aging" reports to management (Month At a Glance Report). AIMS and ERCS data, however, will include all cases. In order to reconcile to the Month At a Glance Report, Status 17 and 18 cases must be excluded from the overage category and the overage percentage manually computed. Cases should be returned to Status Code 12 if it is later determined that fraud potential no longer exists. Service Center Examination employees will coordinate potential fraud case development and preparation of Form 11661 with their manager, designated Fraud Coordinator and the FRS. At this writing, Status 17 is not valid for potential fraud cases at the service centers.

  7. When it is agreed by the revenue officer, group manager and FRS that potential for fraud exists, the case will be updated to ICS sub code 910. Form 11661 may be utilized to document this decision and input of ICS sub code 910. ICS sub code 910 will remain on the case either until the group manager and FRS concur the case no longer has fraud potential or CI declines referral of the case.

  8. The compliance employee or group manager should not obtain advice and/or direction from CI for a specific case under examination. The FRS is available for consultation.

25.1.2.2  (01-01-2003)
Indicators of Fraud

  1. Listed below are examples of fraud indicators. The following lists are not all-inclusive and are only indicative of the types of actions taxpayers may take to deceive or defraud.

  2. Indicators of Fraud—Income

    1. Omissions of specific items where similar items are included.

    2. Omissions of entire sources of income.

    3. Unexplained failure to report substantial amounts of income determined to have been received.

    4. Substantial unexplained increases in net worth, especially over a period of years.

    5. Substantial excess of personal expenditures over available resources.

    6. Bank deposits from unexplained sources substantially exceeding reported income.

    7. Concealment of bank accounts, brokerage accounts, and other property.

    8. Inadequate explanation for dealing in large sums of currency, or the unexplained expenditure of currency.

    9. Consistent concealment of unexplained currency, especially in a business not calling for large amounts of cash.

    10. Failure to deposit receipts to business account, contrary to normal practices.

    11. Failure to file a return, especially for a period of several years although substantial amounts of taxable income were received.

    12. Cashing checks representing income at check cashing services and banks other than the taxpayer's.

    13. Covering up sources of receipts by false description of source of disclosed income, and/or nontaxable receipts.

  3. Indicators of Fraud—Expenses or Deductions

    1. Substantial overstatement of deductions.

    2. Substantial amounts of personal expenditures deducted as business expenses.

    3. Claiming fictitious deductions.

    4. Dependency exemption claimed for nonexistent, deceased, or self-supporting persons.

    5. Loans of trust funds disguised as purchases or deductions.

  4. Indicators of Fraud—Books and Records

    1. Keeping two sets of books or no books.

    2. False entries or alterations made on the books and records, backdated or post dated documents, false invoices, false applications, statements, other false documents, or applications.

    3. Invoices are irregularly numbered, unnumbered or altered.

    4. Checks made payable to third parties are endorsed back to the taxpayer. Checks made payable to vendors and other business payees are cashed by the taxpayer.

    5. Failure to keep adequate records, concealment of records, or refusal to make certain records available.

    6. Variances between treatment of questionable items on the return as compared with books.

    7. Intentional under or over footing of columns in journal or ledger.

    8. Amounts on return not in agreement with amounts in books.

    9. Amounts posted to ledger accounts not in agreement with source books or records.

    10. Journalizing of questionable items out of correct account.

    11. Recording income items in suspense or asset accounts.

    12. False receipts to donors by exempt organizations.

  5. Indicators of Fraud—Allocations of Income

    1. Distribution of profits to fictitious partners.

    2. Inclusion of income or deductions in the return of a related taxpayer, when difference in tax rates is a factor.

  6. Indicators of Fraud—Conduct of Taxpayer

    1. False statement about a material fact involved in the examination.

    2. Attempts to hinder the examination. For example, failure to answer pertinent questions, repeated cancellations of appointments, refusal to provide records, threatening potential witnesses, including the examiner or assaulting the examiner.

    3. Failure to follow the advice of accountant or attorney.

    4. Failure to make full disclosure of relevant facts to the accountant.

    5. The taxpayer’s knowledge of taxes and business practices where numerous questionable items appear on the returns.

    6. Testimony of employees concerning irregular business practices by the taxpayer.

    7. Destruction of books and records, especially if just after examination was started.

    8. Transfer of assets for purposes of concealment, or diversion of funds and/or assets by officials or trustees.

    9. Patterns of consistent failure over several years to report income fully.

    10. Proof that the return was incorrect to such an extent and in respect to items of such character and magnitude as to compel the conclusion that the falsity was known and deliberate.

    11. Payment of improper expenses by or for officials or trustees.

    12. Willful and intentional failure to execute pension plan amendments

    13. Backdating of applications and related documents.

    14. Making false statements on TEGE determination letter applications.

    15. Use of false social security numbers.

    16. Submission of false Form W–4.

    17. Submitting a false affidavit.

    18. Attempts to bribe the examiner.

  7. Indicators of Fraud—Methods of Concealment

    1. Inadequacy of consideration.

    2. Insolvency of transferor.

    3. Assets placed in other's names.

    4. Transfer of all or nearly all of debtors’ property.

    5. Close relationship between parties to the transfer.

    6. Transfer made in anticipation of a tax assessment or while the investigation of a deficiency is pending.

    7. Reservation of any interest in the property transferred.

    8. Transaction not in the usual course of business.

    9. Retention of possession.

    10. Transactions surrounded by secrecy.

    11. False entries in books of transferor or transferee.

    12. Unusual disposition of the consideration received for the property.

    13. Use of secret bank accounts for income.

    14. Deposits into bank accounts under nominee names.

    15. Conduct of business transactions in false names.

25.1.2.3  (01-01-2003)
Investigative Techniques

  1. Most fraud cases involve individual and business taxpayers with poor or nonexistent internal controls. Those cases where there is no separation of duties have a greater potential for material misstatement of taxable income than individuals with salary and wages. However, fraud can be and is present in all types of returns.

  2. Unusual, inconsistent or incongruous items should alert examiners to the possibility of fraud and the need for further investigation. Taxpayer misconduct should be an early warning sign of possible fraudulent conduct. The method of operating a business (i.e., lack of internal controls, dealing in cash, etc.) may be indicative of improperly filed returns.

  3. The initial contact provides the opportunity to obtain valuable information which may not be readily available later. Indications of fraud may be disclosed in discussions, financial activities and nonresponsive answers. Questions asked should be recorded verbatim. Nonresponsive answers should be noted and judgment used in deciding what information is relevant (affidavits may be used). Workpapers should be noted as to the tax year, the date of the contact, who was present during the contact and the maker of the workpapers. Workpapers should include such information as:

    • Who prepared the information used on the tax return

    • Who approves and classifies expense items

    • Who deposits business receipts

    • How business gross receipts per the tax return are determined

  4. The compliance employee should prepare a memorandum of interview summarizing information obtained and statements made. This will become part of the workpapers to aid in the fraud development.

  5. Throughout the investigation, it is important to keep a current and accurate historical record of all contacts and conversations with the taxpayer. This is necessary to track statements, when records were received and from whom and steps taken to determine the correctness of the information volunteered. Annotations should not be made on records and other evidence received. It is important that the chain of custody of evidence obtained be clearly established through the historical record. Although necessary in any investigation, this area can be critical in sustaining fraud.

  6. Fraud will not ordinarily be discovered when compliance employees readily accept the completeness and accuracy of the records presented and the explanation offered by the taxpayer. It is necessary to go behind the books and to probe beneath the surface. The judgment of the employee will determine the techniques used. The investigation should be extended to the point where the employee is satisfied and the results are substantially correct.

25.1.2.4  (01-01-2003)
Aiding and Abetting

  1. It is important to determine who is responsible for the fraudulent act(s). If the taxpayer isn’t responsible then neither criminal and/or civil fraud are applicable. If the preparer is culpable then preparer penalties should be considered. See IRM 20.1.6.

  2. If a questionable preparer is discovered, contact the Return Preparer Coordinator in your Area PSP. Also see chapter 3.3 in this IRM for additional guidance.

  3. There are also civil and criminal penalties for anyone who aids and abets an understatement of tax liability under IRC Sections 6701 and 7206(2). The individual must be directly involved in the preparation or presentation of the false or fraudulent document. This may include independent contractors such as lawyers, accountants and appraisers who counsel on a course of action. It is possible for criminal referrals and/or civil penalties to apply to both the taxpayer and the person assisting the taxpayer.

25.1.2.5  (01-01-2003)
Bankruptcy Fraud

  1. CI field offices are now authorized to utilize bankruptcy fraud statutes 18 USC 152 and 157 in the prosecution of bankruptcy related tax fraud investigations. Investigations involving allegations of bankruptcy fraud are appropriate when the IRS is a major creditor and tax crimes are suspected. Statute jurisdiction has been extended to bankruptcy fraud violations to increase tax compliance and facilitate bankruptcy related fraud referrals.

  2. The purpose of this section is to alert compliance employees to the tax consequences that may result in a "bust out" or scam. The individual perpetrating bankruptcy fraud may be converting merchandise inventory, cash or other assets to personal use and for personal gain. For an in-depth discussion of bankruptcy fraud, compliance employees should refer to Document 9762, revision 9–96, "Desk Guide for Bankruptcy Tax Crime Referrals."

  3. Compliance employees should become familiar with the methods used in perpetrating bankruptcy fraud and to recognize these illegal acts.

  4. One type of bankruptcy fraud involves the concealment of the transfer of ownership of a business which is acquired either legally or illegally. The creditors, not knowing of the change in ownership, permit the new owners to operate on the former proprietor’s credit rating. After acquiring a business, frequently a number of large bank deposits are made to establish a more favorable credit rating. Then large amounts of merchandise are purchased from a number of suppliers. First, purchases are made for cash, then on fifteen day credit, then on thirty day credit and finally on whatever the creditors will bear. Favoring merchandise that is troublesome to trace, easy to transport and simple to market, such as appliances, furniture and office equipment, payment for all goods is made regularly and on time. The orders are steadily increased but payments eventually decline as to the percentage of what is due. Then, usually just before a busy season or on some specific event, huge orders are placed. When the goods arrive, the " bust out" occurs. The merchandise is sold for cash, sometimes at less than wholesale prices, to organized crime figures or to other business people who are willing to buy at cut-rate prices with little or no questions asked. The creditors are left with substantial claims and a bankrupt business with no assets.

  5. Another scheme is to give the " selected" company a name almost identical to that of a well known and highly creditworthy corporation. The address given may even be on the same street as the reputable concern. Capitalizing on the favorable credit rating of the well known firm, the "selected company" proceeds to order goods from misled suppliers. In this case, the "bust out" can proceed faster because there is a pre-established credit rating and financial statements are often unnecessary.

  6. Some red flags that signal that a bust out scheme might be in process include:

    • A business relationship based principally on trust. Creditors are willing to offer extended payment, hold checks, or take postdated checks. This makes them vulnerable.

    • Buyers with a history of purchasing goods for an unreasonable discount.

    • A large number of bank accounts, indicating a possible kiting scheme. The perpetrator occasionally pays some of his creditors with funds generated by floating checks between bank accounts (used by permission of the Association of Certified Fraud Examiners).

  7. A third form of planned bankruptcy is similar to the first one listed above. In this case, however, orders are placed for merchandise unrelated to the regular line of business, such as a furniture store ordering jewelry as door prizes, usually during the supplier’s busy season. Sometimes rush orders are made during the supplier’s slack season, in the hope that creditors will omit a credit check in their haste to cash in on rush or off season business.

  8. Still another scheme exists whereby an individual acquires a profitable business by surreptitiously acquiring control of the outstanding stock of a corporation. Once in control of the stock, he/she quickly moves in and takes control of the business. All assets of the corporation are then quickly sold for whatever price they will bring leaving the remaining shareholders with a bankrupt corporation.

  9. The compliance employee should also be alert to the purchases of merchandise inventory and other assets for cash near or below the supplier’s cost because of the potential for a "skimming " case. A "skimming" case is one in which the individual or corporation skims off the top by understating sales or revenues. They then correspondingly understate purchases and cost of sales to keep the markup percentage in line with the understated sales or revenues.

  10. Bankruptcy fraud is very subtle. It may be evidenced when examining the accounts receivable and bad debt accounts of a suspected "scam" victim. These telltale signs may take the form of one or more of the following.

    1. A purchaser comes under new management and the change of ownership is not publicly announced and the identity of the new owner is obscure.

    2. A customer orders goods unrelated to his usual line.

    3. Order quantities increase markedly in contradiction to the seasonal nature of the customer’s business.

    4. Financial statements of customers are unaudited and unverified.

    5. Remittances from an account lag, customers’ accounts receivable balance climbs, and/or notes or postdated checks are remitted.

    6. Trade references cannot be verified.

    7. Customer’s name and/or address is similar to that of some other firm.

    8. Rush orders are frequently placed.

    9. Discovery of known racketeers or those with criminal records being installed in positions of importance in a company being serviced.

  11. In the examination of bankrupt companies which have been a part of a scam conspiracy, the officers or principals are generally vague about their plight and are unable or unwilling to furnish details of what transpired. Books and records are generally inadequate or have disappeared. The bankrupt taxpayer’s payroll and expense accounts may be unusually generous. Finally, the remaining assets are usually nominal and include the oldest and least salable kind.

25.1.2.6  (01-01-2003)
Employment Tax Fraud

  1. The package audit policy described in Policy Statement P–4–4, IRM 1.2.1.4.2 (IRM 1.2.1, Policies of the Internal Revenue Service) particularly relates to the examination of employment tax liabilities. Frequently taxpayers fail to treat as employees persons they generally designate as "self-employed or casual labor." There may also be willful attempts to camouflage salary payments or to list as wages, payments where no services have been performed. The most common employment tax fraud, however, is simply not remitting trust fund taxes to the Government. Multiple schemes have been concocted to evade employment tax. The following paragraphs describe the major identified schemes. Also, please see IRM 9.5.3.3.1.1 for a discussion of various employment tax schemes.

  2. Pyramiding liabilities occur where the subject withholds the tax but does not pay it over. After several quarters, the subject moves the assets to a new corporation and abandons the old business activity. The subject continues the withholding but does not pay the tax over, and again abandons the second company when financial problems occur, and forms a new company. When this is accompanied by bankruptcy of the predecessor companies, further complications arise.

  3. Employee leasing companies are a growing area of fraud. This is an industry where an employee leasing company contracts with a client company to handle the client company's administrative duties and hire some or all of the client company's employees, leasing back these employees to the client company. When the leasing company does not pay the employment taxes due on the employees it leases, huge tax deficiencies can occur in a short span of time because the leasing company can be responsible for several client companies. Generally, the employee leasing company will not have any significant assets to collect against, as it is only a service company. When there is indicia of fraud indicating that an employee leasing company was established to fraudulently evade federal employment taxes, consideration should be given to referring the case for CI consideration.

  4. A scheme commonly referred to as the 861 refund scheme, uses Forms 941C, or some other claim for refund, to request a refund of all employment taxes paid. The promoters of these schemes also advise employers to opt out of the income tax system and stop withholding taxes and filing employment tax returns.

25.1.2.6.1  (01-01-2003)
Payroll Padding

  1. Payrolls may be padded for numerous reasons. The purpose is usually the same: to get funds out of a business in the form of a deduction without the recipient paying income tax on the income. This method is commonly used where the paying enterprise is in the type of business which does not sell for cash and money can only be taken out by check. This method could be used as a tax evasion scheme enabling the taxpayer to obtain funds needed for extortion, to pay for personal expenses or to repay gambling losses or debts to loan sharks.

  2. Another way to pad the payroll is to have political party workers on the payroll even though the employee performs no services for the payor company.

  3. To detect indications of payroll padding, focus special attention on payroll records:

    1. If there is a suspicion or knowledge that fictitious employees are being used, then the negotiation of the check should be pursued. If checks are cashed at the same bank or through other parties, the payee may be known at the bank or by the reendorsers.

    2. If Forms W–2 are returned by the Post Office as undeliverable, all payroll checks to such employees should be thoroughly scrutinized as to their disposition and the route they took back to the bank.

    3. Social Security numbers on W–2’s should be verified for legitimacy. Because each employee is required to have a Social Security number, a listing of duplicate numbers might reveal ghost employees (used by permission of the Association of Certified Fraud Examiners).

    4. An analysis of payroll withholdings might reveal either ghost employees or trust account abuses. Ghost employees often will have no withholding taxes, insurance or other normal deductions. Therefore, a listing of any employee without these items might reveal a ghost employee (used by permission of the Association of Certified Fraud Examiners).

    5. If the company provides or assists in insurance coverage, pension plans, etc., test employee terminations to determine whether the employee was also withdrawn from the payroll.

    6. A company may continue issuing checks to an employee who has left. Randomly select employees and compare endorsements at various times during the year.

    7. Key employees or officers may be loaned to political parties to perform various services while being paid their salary by their employer. Attempts should be made to determine where the employees’ services were performed during the payroll periods in question. Examination of expense reimbursement reports would be of assistance in determining the geographical location of the employee at a particular time. This information may serve as a basis for a follow-up interview of the employee.

  4. Some prominent figures in organized crime have no legitimate source of income. They receive income only through illegal activities. Therefore, in order to prove how they support themselves and their family, they must have a source of legitimate income to report for income tax purposes. These individuals will find a business willing to put them on the payroll and issue them regular payroll checks, even though the employee performs no services. The employer is frequently a retail outlet owned by or associated with some other member of organized crime. In most cases these payroll payments are returned to the payer in cash and diverted.

  5. Extend the examination to the suspected prominent figure and trace the disposition of their payroll checks to determine if any of the money was returned to the corporation.

  6. When the entity being examined is suspected of being used as a salary haven by a prominent figure in organized crime, the examining agent should look for certain indications to support the suspicion.

    1. Determine if checks are cashed by the employer.

    2. Establish whether the employee has the qualifications to perform the function for which he/she receives the salary.

    3. If records indicate the employee is still on the payroll at the time of examination, the compliance employee should attempt to establish whether they are actually present on the premises.

    4. If the employee holds a position as outside salesman, the compliance employee should determine who the customers are and establish whether the employee actually contacts these customers.

25.1.2.7  (01-01-2003)
Excise Tax Fraud

  1. In addition to other indications of fraud, the following incidents should be considered in excise cases:

    1. Taxpayer previously filed returns and paid excise tax but stopped filing and paying without explanation.

    2. Taxpayer sold the article at a tax included price but did not report or pay tax to government.

    3. Taxpayer handles identical products, considers one taxable and the other not taxable.

  2. In collected taxes cases warranting assertion of the Trust Fund Recovery Penalty, there will be instances when any appreciable delay in asserting and collecting the tax or penalty would jeopardize the revenue. In all such cases, the area director is authorized to decide whether collection of the penalty might be jeopardized. If in the area director’s opinion the revenue might be jeopardized by following such procedure, the director may disregard it and promptly assess and collect the penalty involved, making necessary quick assessments or jeopardy assessments, as circumstances warrant. Except for potential jeopardy cases, the Service does not authorize assessment of additional penalties during the time a recommendation for criminal prosecution is under consideration or during the period such cases may be awaiting trial or pending an appeal.

25.1.2.7.1  (01-01-2003)
Excise Taxes—Willful Failure to Pay

  1. IRC Section 4103 provides that in cases of willful failure to pay gasoline, diesel, or aviation fuel taxes under IRC Sections 4041(a)(1), 4081 or 4091, each person: (1) who is an officer, or agent of the taxpayer and is under a duty to ensure that the tax is paid and who willfully fails to perform this duty, or, (2) who willfully causes the taxpayer to fail to pay the tax, is jointly and severally liable with the taxpayer for the tax. Section 4103 applies to nonpayment of taxes for periods ending after November 30, 1990.

  2. The assessment statute for Section 4103 is identical to the limitations period for the Section 4041(a)(1), 4081 or 4091 taxpayer, i.e., three years from the actual Form 720 filing date (not the presumptive date). If no return was filed or if a fraudulent return with intent to evade the tax was filed, there is no assessment statute.

25.1.2.7.2  (01-01-2003)
Section 4103 cases—Referrals to Collection Function

  1. Determine willfulness and duty to ensure tax is paid and failure to perform such duty, or willfulness and the causation of the taxpayer's failure to pay tax, as appropriate, on the part of the person(s) involved.

  2. Prepare a memorandum to the Technical Support function. The subject line will state "Referral of Potential Section 4103 Case." The memorandum will be forwarded through the field territory manager and will contain the following information:

    • Examiner’s name and telephone number.

    • Taxpayer’s name, taxpayer’s identification number (TIN), and current address.

    • Tax period(s), statute date(s), abstract number(s) and deficiencies involved.

    • Names, titles, TIN’s and current addresses of all persons who appear responsible for ensuring payment of the tax.

    • The examiners best estimate of the projected disposition of the case.

    • An explanation of the proposed adjustments and the facts supporting the examiner’s determination.

  3. Appropriate remarks will be included in the workpapers with a copy of the completed referral memorandum in the case file. In cases where Section 4103 does not apply, examiners will comment in the workpapers that a referral was considered but not made and include the reasons.

  4. When Technical Support receives a referral from the examination function, the collection function will make the final determination in assessing the personal liability for excise tax under section 4103.


More Internal Revenue Manual