The Income Verification Express Services Program Needs Improvements to Better Protect Tax Return Information

Treasury Inspector General for Tax Administration

Office of Audit

The Income Verification Express Services Program Needs Improvements to Better Protect Tax Return Information

Issued on January, 26 2011

Highlights

Highlights of Reference Number: 2011-40-014 to the Internal Revenue Service Commissioner for the Wage and Investment Division.

IMPACT ON TAXPAYERS

Borrowers cannot obtain loans unless they sign a consent that allows the Internal Revenue Service (IRS) to disclose their nonpublic income information to their lenders. Lenders can obtain this income information from the Income Verification Express Services (IVES) Program. Taxpayers’ personally identifiable information is at risk of theft or misuse when taxpayers submit IVES requests for tax return information through third parties because controls are insufficient to ensure taxpayer information the IRS provides to IVES Program participants is protected.

WHY TIGTA DID THE AUDIT

Personally identifiable information, such as a Social Security number, is the most valuable tool an identity thief can obtain to commit financial fraud. It becomes even more valuable if it is linked to other personal data, such as income information used to prepare a tax return. The IRS should be able to assure taxpayers that it is taking every precaution possible to protect their personal information.

The overall objective of this review was to evaluate regulations and IVES enrollment policies that ensure lenders, such as banks, and companies that specialize in making third-party requests for lenders (Income Verification Specialists) properly protect taxpayers’ tax return information.

WHAT TIGTA FOUND

IVES Program participants obtain and collect large quantities of taxpayers’ personally identifiable information and associated tax return information that could be used to commit identity theft. During the last two calendar years, the IVES Program processed more than 10 million requests annually.

Nonetheless, the IRS does not have a screening process and does not define minimum requirements in the form of a user agreement to help ensure IVES Program participants meet minimum standards and protect tax return information. To be eligible to receive large quantities of taxpayer income information from the IRS via the IVES Program, applicants simply must submit an IVES application and register for e-Services. In addition, the IRS does not require IVES Program participants to maintain electronic security and not disclose the information they receive from the IRS to nonaffiliated third parties.

WHAT TIGTA RECOMMENDED

TIGTA recommended that the Commissioner, Wage and Investment Division, (1) develop and enforce minimum requirements for the IVES Program; (2) update the IVES application to include a statement that taxpayer information can only be used for the purpose the taxpayer intended as well as ensuring the current version is provided to all applicants, is posted on IRS.gov, and is the only version accepted; (3) within one year of revising the IVES application, contact and obtain a completed application from all current IVES Program participants; and (4) revise transcript request forms to allow taxpayers to limit lenders’ disclosure of their tax return information to nonaffiliated third parties only if it is in the course of processing or selling their loan.

The IRS agreed with our recommendations and plans to (1) explore minimum requirements for IVES participants; (2) revise the IVES application and ensure it provides the current version to all IVES applicants and on IRS.gov, and only accepts the most current version from applicants; (3) obtain a completed version of the new form from all IVES Program participants; and (4) develop the necessary language for transcript requests forms to allow taxpayers to limit lenders’ disclosure.

READ THE FULL REPORT

To view the report, including the scope, methodology, and full IRS response, go to:

http://www.treas.gov/tigta/auditreports/2011reports/201140014fr.html.

Email Address: TIGTACommunications@tigta.treas.gov

Phone Number: 202-622-6500

Web Site: http://www.tigta.gov