Internal Revenue Service

Individual Taxpayer Indentification Numbers Can Be Improperly Obtained and Used Gao ID: GAO-04-529T March 10, 2004

The Internal Revenue Service (IRS) issues Individual Taxpayer Identification Numbers (ITINs) to those who are not eligible for a social security number (SSN) from the Social Security Administration (SSA). ITIN-related concerns include whether any weaknesses in IRS's controls would allow ITINs to be issued and used for illegal purposes and possible security breaches, whether employers are confused about their responsibilities to IRS, SSA, and the Department of Homeland Security (DHS) for identifying their employees, and how IRS, SSA, and DHS share data when illegal resident aliens receive ITINs. Because of these concerns, GAO was asked to: (1) describe why IRS created the ITIN, (2) describe IRS's processes and controls for issuing ITINs, (3) do a limited test of IRS's processes and controls, and (4) describe certain concerns and problems for employers and government agencies when ITINs are issued to illegal resident aliens.

IRS created the ITIN in 1996 to improve tax administration. IRS needed a better way to identify the tax reporting of those who could not obtain an SSN to use on tax returns and other tax documents. The cumulative number of ITINs issued exceeded 7 million by the end of 2003. IRS receives ITIN applications from the mail, applicants walking into IRS offices, and authorized non-IRS entities. In December 2003, IRS made changes to improve its ITIN controls. However, IRS remains limited in its ability to verify applicants' identities. For instance, IRS staff does not see most applicants and IRS does not verify the validity of documents. Before December 2003, GAO staff obtained an ITIN by submitting bogus documents through the mail and used the ITIN to open a bank account and obtain an ATM card. Staff also fabricated an ITIN and used it to obtain a voter registration card. While limited, this test indicates that IRS's controls could be bypassed and that an ITIN could be used for nontax purposes. Despite the December changes, the weaknesses GAO exploited remain. Resolving these limitations could be challenging. IRS has concluded that most resident aliens who have ITINs and earn wage income are not legally employed in the United States. Given this context, the use of ITINs raises various issues. Employers have raised concerns that when they identify employees and their work eligibility, they could have conflicting obligations to IRS, SSA, and DHS. These concerns appear to be largely unfounded if employers do what is specifically required. Data sharing--especially of IRS data--may help DHS to target immigration enforcement, but, among other things, officials cited legal restrictions and the potential for employment to be hidden from tax administrators as affecting their decisions about sharing data.

GAO-04-529T, Internal Revenue Service: Individual Taxpayer Indentification Numbers Can Be Improperly Obtained and Used This is the accessible text file for GAO report number GAO-04-529T entitled 'Internal Revenue Service: Individual Taxpayer Indentification Numbers Can Be Improperly Obtained and Used' which was released on March 10, 2004. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittee on Oversight and Social Security, Committee on Ways and Means, House of Representatives: For Release on Delivery Expected at 10 a.m. EDT Thursday, March 10, 2004: Internal revenue service: Individual Taxpayer Identification Numbers Can Be Improperly Obtained and Used: Statement of Michael Brostek, Director, Tax Issues: [Hyperlink, http: //www.gao.gov/cgi-bin/getrpt?GAO-04-529T]: GAO Highlights: Highlights of GAO-04-529, a report to a testimony to the House Ways and Means Subcommittees on Oversight and on Social Security Why GAO Did This Study: The Internal Revenue Service (IRS) issues Individual Taxpayer Identification Numbers (ITINs) to those who are not eligible for a social security number (SSN) from the Social Security Administration (SSA). ITIN-related concerns include whether any weaknesses in IRS‘s controls would allow ITINs to be issued and used for illegal purposes and possible security breaches, whether employers are confused about their responsibilities to IRS, SSA, and the Department of Homeland Security (DHS) for identifying their employees, and how IRS, SSA, and DHS share data when illegal resident aliens receive ITINs. Because of these concerns, GAO was asked to: (1) describe why IRS created the ITIN, (2) describe IRS‘s processes and controls for issuing ITINs, (3) do a limited test of IRS‘s processes and controls, and (4) describe certain concerns and problems for employers and government agencies when ITINs are issued to illegal resident aliens. What GAO Found: IRS created the ITIN in 1996 to improve tax administration. IRS needed a better way to identify the tax reporting of those who could not obtain an SSN to use on tax returns and other tax documents. The cumulative number of ITINs issued exceeded 7 million by the end of 2003. IRS receives ITIN applications from the mail, applicants walking into IRS offices, and authorized non-IRS entities. In December 2003, IRS made changes to improve its ITIN controls. However, IRS remains limited in its ability to verify applicants‘ identities. For instance, IRS staff does not see most applicants and IRS does not verify the validity of documents. Before December 2003, GAO staff obtained an ITIN by submitting bogus documents through the mail and used the ITIN to open a bank account and obtain an ATM card. Staff also fabricated an ITIN and used it to obtain a voter registration card. While limited, this test indicates that IRS‘s controls could be bypassed and that an ITIN could be used for nontax purposes. Despite the December changes, the weaknesses GAO exploited remain. Resolving these limitations could be challenging. IRS has concluded that most resident aliens who have ITINs and earn wage income are not legally employed in the United States. Given this context, the use of ITINs raises various issues. Employers have raised concerns that when they identify employees and their work eligibility, they could have conflicting obligations to IRS, SSA, and DHS. These concerns appear to be largely unfounded if employers do what is specifically required. Data sharing”especially of IRS data”may help DHS to target immigration enforcement, but, among other things, officials cited legal restrictions and the potential for employment to be hidden from tax administrators as affecting their decisions about sharing data. What GAO Recommends: Although GAO is not making recommendations, this hearing is a useful venue for Congress to consider whether to provide IRS, SSA, and DHS guidance on how to address concerns about ITIN issuance controls and policies for dealing with illegal resident aliens. www.gao.gov/cgi-bin/getrpt?GAO-04-529T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Michael Brostek at (202) 512-9110 or brostekm@gao.gov. [End of section] Messrs. Chairmen and Members of the Subcommittees: I am pleased to participate in the hearing today on various issues related to the Individual Taxpayer Identification Number (ITIN) issued by the Internal Revenue Service (IRS). As you requested, my statement today describes why IRS created the ITIN, the processes and controls IRS has in place for issuing ITINs, the results of our limited test of the controls over issuing an ITIN, and certain concerns and problems for employers and government agencies that ensue when ITINs are issued to illegal resident aliens.[Footnote 1] IRS issues ITINs to individuals who are required to have a U.S. taxpayer identification number (TIN) but who are not eligible to obtain a social security number (SSN) from the Social Security Administration (SSA). An ITIN has nine digits formatted like an SSN (NNN-NN-NNNN) but beginning with the number "9".[Footnote 2] IRS issues ITINs for tax processing purposes only. Having an ITIN does not affect a holder's immigration status, or authorize the holder to work or receive Social Security benefits. In requesting this testimony, you sought a better understanding of the vulnerabilities in the ITIN issuance process, including whether weaknesses allow ITINs to be issued and used for illegal purposes and possible security breaches. You also expressed interest in the extent to which employers may be confused by their responsibilities vis-�-vis IRS, SSA, and the Department of Homeland Security (DHS) in ensuring the identity of their employees, and whether federal agencies are sharing information to deal with illegal resident aliens who may be issued ITINs. Today's statement is based on interviews, reviews of agency documents and various publications, and limited tests of the ITIN issuance controls. Specifically, to address the four areas, we interviewed officials from IRS including the Taxpayer Advocate Service, SSA, and the Departments of the Treasury, Homeland Security, and Labor. We reviewed documents from these agencies as well as other literature. In addition, our Office of Special Investigations (OSI) did limited testing of IRS's controls to determine whether it could fraudulently obtain an ITIN by mailing or presenting bogus identity documents to IRS. OSI used an IRS-issued ITIN and a fake ITIN it generated for nontax purposes. We did our work in Washington, D.C. from September 2003 through February 2004 in accordance with generally accepted government auditing standards and we performed our investigative work in accordance with standards prescribed by the President's Council on Integrity and Efficiency. Our results in these four areas showed that: * IRS created the ITIN in 1996 to improve tax administration. IRS needed a better way to identify and track the tax reporting of noncitizens that could not obtain an SSN for use when filing tax returns. Beyond the filing of tax returns, ITINS have other legitimate tax uses, such as for filing documents other than tax returns and for claiming benefits related to a tax treaty. According to IRS, most ITINs have been used at least once on a tax return and ITINs also have been used for other legitimate tax purposes. * IRS made changes to improve its processes for issuing ITINs in December 2003, but continues to have limited controls to verify the identity of ITIN applicants. For example, the majority of ITIN applicants apply by mail and IRS cannot be sure the applicant is the same individual described by the documentation submitted. IRS also does not verify with third parties the validity of the documents submitted with the ITIN applications. * Before IRS changed its procedures in December, we obtained an ITIN by applying with bogus documents through the mail. We also created a bogus ITIN without applying to IRS. Using the IRS-issued ITIN, we opened a bank account and obtained an ATM card. We used the bogus ITIN to obtain a voter registration card. While very limited, this test illustrates weaknesses in IRS's ITIN controls, which have not been completely addressed by the changes made in December, and shows that ITINs can be used for nontax purposes, such as blending into society under a false identity. Resolving the continuing limitations in IRS's ITIN issuance controls would be challenging. * Although precise data are not available, hundreds of thousands of ITINs are issued to aliens who subsequently earn wage income. IRS and the Treasury Inspector General for Tax Administration (TIGTA) have concluded that these individuals are illegal resident aliens. Given this context, employers have raised concerns about potentially conflicting obligations to IRS, SSA, and DHS when they identify employees and their work eligibility. These concerns appear to be largely unfounded if employers do what is specifically required. Sharing IRS data with DHS may provide enhanced information to target enforcement of immigration laws, but to differing degrees, officials cited such factors as legal restrictions and the potential for employment to be hidden from tax administrators as affecting their decisions about whether and how to share data. Background: IRS requires a unique TIN to process any tax return or tax-related document, and associate the return or document with a taxpayer's history. A TIN allows IRS to better manage a host of tax administration functions--such as crediting tax payments, and verifying compliance in filing returns, reporting income, and paying taxes. IRS also needs it to process information returns filed by employers and financial institutions to report certain types of payments (e.g., wages or interest) made to individuals. One type of TIN is the SSN, which SSA is authorized to issue to United States citizens, aliens allowed to work in the United States, or others, in limited cases, for nonwork purposes. For example, according to SSA, if an applicant only needs an SSN to obtain certain government benefits as specified in SSA regulations, SSA must issue an SSN and social security card but the card specifically states that it is not valid for work purposes. Individuals must use an SSN when filing a required tax return, unless they cannot legally obtain an SSN. For those who cannot obtain an SSN but need a TIN for tax purposes, IRS created the ITIN. IRS's 2003 training manual on ITINs identifies such individuals, as shown below. * An alien who does not reside in the United States and who is filing a U.S. tax return to (1) claim a tax treaty benefit, (2) claim a tax refund, or (3) file a joint tax return with a spouse who is a U.S. citizen or resident. * An alien who lives in the United States and who is filing a U.S. tax return. * Individuals claimed on a U.S. tax return as a (1) dependent, or (2) spouse. An alien is a resident for tax purposes if the individual (1) is a lawful permanent resident (green card test[Footnote 3]) in the United States for any time during the year, (2) is present in the United States for 31 or more calendar days during the current year and for a substantial time--183 or more weighted days--during a 3-year period weighted toward the current year (substantial presence test), or (3) elects to be treated as a U.S. resident (first-year election test).[Footnote 4] IRS does not believe that it has the legal authority to distinguish between legal and illegal resident aliens for tax purposes. Individuals who meet the definition of a resident alien are generally taxed in the same manner as U.S. citizens and holders of green cards, meaning that they are taxed on their worldwide income. One exception is that resident aliens who have ITINs are ineligible to claim the refundable earned income tax credit, which requires a valid SSN issued for work purposes. A nonresident alien is subject to tax on income from U.S. sources but generally not on foreign source income. IRS Created the ITIN to Improve Tax Adminstration: IRS created the ITIN in July 1996 to improve tax administration for individuals who were ineligible to obtain an SSN. IRS needed a better way to identify and track tax filing and reporting by these individuals and by employers and financial institutions that file other tax documents related to the individual's income. Each individual taxpayer is to use a unique and permanent TIN, which allows IRS to associate their filed tax returns with their tax records and with information returns on payments made to them, and to more effectively use programs to enforce tax filing and reporting compliance. For individuals who lacked an SSN, IRS did not have a permanent TIN to use in tracking their tax obligations and history prior to the ITIN. Prior to July 1996, IRS used a system of temporary TINs when a taxpayer did not have an SSN to facilitate one-time processing of a tax return. The temporary TIN was assigned to a return filed without an SSN rather than to a taxpayer. However, IRS had to post returns with temporary TINs to the invalid segment of IRS's masterfile because these returns could not be associated with a valid taxpayer account.[Footnote 5] Posting to the invalid segment created problems for IRS enforcement programs, such as negating income verification through document matching. Because the temporary TINs were unique to IRS, IRS could not easily match the amounts of income and withheld taxes reported on these tax returns against information returns submitted by third parties to report such amounts. In 1995, we reported that accounts in the invalid segment had more than doubled the growth rate compared to those in the valid segment from 1986 through 1994. We also reported that IRS refunded $1.4 billion for tax year 1993 returns posted to the invalid segment.[Footnote 6] Although no one knows how much of this $1.4 billion may have been erroneously refunded, the risk was higher because IRS had less certainty about these filers' identities absent a valid TIN and about the accuracy of their returns absent the ability to match a filed return with third-party data. Also, prior to December 1996, SSA was issuing "nonwork" SSNs to individuals who had tax obligations but were not authorized to work or were not otherwise part of the social security system. With the growth in the earnings suspense file--SSA records that could not be associated with a wage earner, SSA decided to reduce the number of nonwork SSNs. Starting in December 1996, SSA tightened restrictions on who could apply for a nonwork SSN. In response to these events and the needs of tax administration, IRS created the ITIN as a permanent TIN assigned to individuals who needed to file a tax return but were ineligible to obtain an SSN. Among other things, IRS was concerned was that information returns could not be matched with a tax return. Such returns report third-party payments made to those such as nonresident aliens who invested in companies or real estate in the United States, or received rent and royalty payments. IRS issued its first ITINs in July 1996. Figure 1 shows that IRS has issued over 7.2 million ITINs through December 2003 and over 1 million ITINs annually in more recent years.[Footnote 7] Figure 1: Number of ITINs Issued Annually and Cumulative Total, Calendar Years 1996 to 2003: [See PDF for image] Note: 1996 does not cover a full calendar year because the ITIN program began in July 1996. [End of figure] According to IRS, most of the ITINs issued have been used for legitimate tax purposes such as on tax returns and other tax-related documents. IRS analysis in 2003 showed that about 75 percent of the ITINs issued since its inception through September 2003 have been used at least once on filed tax returns as a required identification number. The actual portion of ITINs used for tax purposes would be higher than 75 percent if IRS had computed the frequency of uses beyond return filing such as to: (1) obtain treaty benefits or exemptions from withheld tax, and (2) file information returns on payments made, such as Forms W-2 (Wage and Tax Statement) for wage income. IRS does not track the frequency of these other uses. IRS Provides Multiple Ways to Obtain an ITIN but Its Controls to Verify the Correctness of Issuance and Use Are Limited: IRS provides multiple avenues to apply for an ITIN, all of which result in IRS reviewing the applications and documents to establish an individual's identity. However, IRS's controls over the issuance and use of ITINs are limited. IRS made changes to improve its controls in December 2003, but the changes did not fully address the control limitations. Among other limitations, IRS does not see most applicants, documents are not verified with third parties, and few staff can translate or verify foreign language documents. ITIN Application Process: Individuals apply for ITINs by filing a Form W-7 (Application for IRS Individual Taxpayer Identification Number) with IRS. As of December 17, 2003, applicants must provide the tax return for which an ITIN is needed, and documentation and a photograph to verify their identity and foreign status, such as a passport, driver's license, or identity card. The ITIN application can be mailed to IRS, submitted at an IRS walk-in, taxpayer assistance center, or submitted through an acceptance agent. Each way has slightly different procedures and requirements. * An applicant can mail Form W-7 and supporting documents to the Philadelphia Service Center (campus). The documents must be originals or notarized copies. Under IRS procedures, the documents are to be examined by an ITIN unit employee and originals are to be returned to the applicant while IRS is to retain notarized copies. According to IRS, this mail option historically accounts for about 70 percent of the applications. * An applicant can apply at an IRS taxpayer assistance center that provides walk-in assistance. An IRS employee is to review the application and documents submitted. If the employee deems the documented proof to be satisfactory, the employee is to make an appropriate notation on Form W-7, copy the documents, and return them to the applicant. The employee is to transmit Form W-7 and the copied documents to Philadelphia for final review and issuance of the ITIN. If the employee deems the documents to be suspect or unsatisfactory, the employee is to return them to the applicant. According to IRS, about 20 percent of applicants use this walk-in option. * An applicant can use the services of an IRS-approved acceptance agent.[Footnote 8] Agents include colleges, financial institutions, and accounting firms, and can be located outside of the United States. Acceptance agents help prepare a Form W-7 and must submit this form and related documentation to IRS. Certified acceptance agents are authorized to also certify whether the documented proof is adequate. They are required to keep copies of the documents for 3 years after making an appropriate notation on the Form W-7 and forwarding it to IRS. Less than 5 percent of applicants use an acceptance agent--whether or not certified. Limited Controls Over ITIN Issuance: IRS has limited controls to verify ITIN applicants' identities. Among the key limitations in the issuance process are that IRS employees do not have to see the applicant in most cases to verify their identity, applicants' documents are not verified with third parties, and IRS has few staff able to translate or verify foreign language documents. IRS's ability to establish the applicant's identity is hindered when IRS employees do not see the applicant as they review identifying information and photographs submitted. This is the case for applications that are sent through the mail, which account for 70 percent of applications. A similar problem can arise for "walk in" applications because third parties can submit a Form W-7 for ITIN applicants. As long as the Form W-7 is signed and documentation is provided, IRS does not require applicants to appear. IRS employees may have difficulty in determining the validity of an unfamiliar document submitted with a Form W-7 to verify identity. An IRS letter to state motor vehicle departments in August 2003 indicated that IRS generally accepts documents submitted with a Form W-7 at face value without validating their authenticity with issuing agencies, or, as discussed above, requiring applicants to appear in person. As of December 17, 2003, IRS listed 13 types of documents that could be used, such as a passport, foreign voter registration card, visa, or U.S. or a foreign driver's license.[Footnote 9] Prior to that, IRS had listed 40 types of documents. IRS reduced the list, in part, because of the difficulty for IRS employees who see low volumes of Forms W-7 to know all types of documents. Even with this reduction in the number of acceptable types of documents, IRS employees still can encounter many variations to consider for each type of document. For example, an IRS research study completed in October 2003 indicated that 17 countries accounted for 85 percent to 87 percent of the ITIN applicants during 1999 through 2001. In each of these years, Mexican citizens accounted for 54 percent to 57 percent of the ITIN applications submitted to IRS. The remaining ITIN applicants can come from many other countries. Each country could have unique formats for each type of acceptable document, which may be unfamiliar to IRS employees. IRS employees have limited capability to interpret documents submitted in a foreign language. IRS does not track how many documents are submitted in a foreign language but as noted above, ITIN applicants can come from many countries. As of October 2003, 10 of the 230 employees at the ITIN Philadelphia site were bilingual---6 in Spanish, 1 in Chinese, 1 in Korean, 1 in Japanese, and 1 in Ukrainian/Polish, according to IRS. Nor does IRS generally require ITIN applicants to provide translated copies of documents submitted in a foreign language. According to the Form W-7 instructions, the applicant may be required to provide a certified translation of the foreign language document to obtain an ITIN. IRS states that it will attempt to translate any foreign documents provided. If IRS cannot translate it, IRS's procedure is to ask the applicant for the required translation. Even if documents can be read, some IRS employees do not have much experience in judging whether the documents are genuine. According to IRS officials, much of this knowledge comes from on-the-job experience- -employees that see more documents are more likely to be able to spot an invalid or bogus document. Each IRS employee that provides taxpayer assistance receives the standard 8-hour IRS training on ITIN, including document identification and validation, given to all employees when hired--whether the employee handles ITIN applications in Philadelphia or at a walk-in site. IRS Is Attempting to Improve ITIN Issuance Controls: Knowing of weaknesses in its ITIN processes and controls, IRS has made some changes to improve its controls and is considering other improvements. IRS's concern about the large number of ITINs issued prompted creation of a task force in 2002 to conduct an in-depth review of ITINs. The task force identified many problems and recommendations in its September 2002 final report. IRS designated 22 recommendations as high priority, and created an ITIN office to study their feasibility and oversee any implementation. We did not have time to review the implementation status of all 22 recommendations but know that action has been taken on some of the recommendations. For example, IRS has started a campaign to educate states, employers, financial institutions, and other government agencies on the appropriate use of ITINs. To this end, IRS sent letters in August 2003 to the directors of all state motor vehicle departments asking them to not accept ITINs for drivers' license purposes. IRS also has considered legislative proposals to make ITIN use illegal for nontax purposes, and to assess information return penalties for improper Form W-7 filings. IRS announced three other recommendations that took effect on December 17, 2003. First, to help eliminate the nontax use of ITINs, the applicant will have to show a federal tax purpose for seeking the ITIN. A Form W-7 application without proof that an ITIN is needed for federal tax purposes is to be rejected. IRS is requiring taxpayers to attach the tax return for which an ITIN is needed to a Form W-7.[Footnote 10] Nonresident aliens who need an ITIN for tax purposes other than filing a tax return, such as to obtain tax treaty benefits, will need to prove ownership of the asset that is eligible for a benefit when they file the Form W-7. Second, as mentioned earlier, IRS reduced to 13 from 40 the number of documents that it will accept as proof of identity to obtain an ITIN. Third, IRS will no longer issue an ITIN card, reasoning that the card could be mistaken for an SSN card. Rather, it will issue an authorization letter. Although these changes appear to have the potential to better ensure that ITINs are issued for valid tax-related purposes, we do not know how much these changes may improve IRS's controls over issuance. Weaknesses in ITIN Controls Can Contribute to Tax Fraud: Weak controls over the issuance of ITINs can contribute to tax fraud by individuals seeking to obtain a tax refund that is not truly owed to them. For example, if an individual uses bogus documentation to obtain an ITIN under a false identity, that individual could use that ITIN to file fraudulent tax returns that claim tax refunds. In such situations, the individual could attach a bogus Form W-2 to the tax return to create support for any wages claimed on the fraudulent return, even though ITIN holders generally are not authorized to have SSNs and earn wages in the United States.[Footnote 11] IRS has not measured how often such tax fraud schemes related to ITINs have been used but has some anecdotal data. IRS has found that ITINs have been used in schemes that resulted in millions of dollars in fraudulent tax refunds. For 1999 through 2003, IRS found 12,241 tax returns, that used an ITIN with bogus Form W-2s attached that claimed refunds in excess of $22.1 million. IRS was able to stop $18 million of these refunds. One scheme in California over these four years accounted for 9,664 of these false returns. IRS's ITIN Controls Can Be Circumvented to Obtain ITINS and Use Them for Non-tax Purposes: Before IRS instituted the changes during December 2003, we did a limited test to assess the security of the ITIN program controls. We attempted to improperly obtain and use ITINs for nontax purposes during September through November 2003. We were able to obtain an ITIN from IRS using fake identity documentation and use this ITIN as well as a bogus ITIN we created for nontax purposes. Although IRS changed its procedures after we obtained and used the ITINs, the changes made do not fully address the weaknesses we exploited, such as IRS's limited ability to verify the validity of documents. Overcoming these weaknesses would be challenging. We applied for an ITIN using two methods. First, we mailed an ITIN application to IRS's Philadelphia Service Center using a bogus foreign birth certificate as proof of identity. Second, we submitted bogus foreign documentation as proof of identity at an IRS taxpayer assistance site. After we obtained an ITIN through the mailed application, we used it to open a bank account and obtain an ATM card. We did not receive the ITIN from the application submitted at the walk- in site because we already received an ITIN for that individual through the mailed application; IRS apparently followed its procedure to not issue multiple ITINs to the same individual. We also created a bogus ITIN displayed on a fake ITIN card. We used the bogus ITIN in lieu of a required SSN to obtain a Virginia voter registration card. Virginia requires an SSN to register to vote but presumably voter registration officials did not verify the number we put on the application.[Footnote 12] Only U.S. citizens are eligible to obtain a voter registration card. We were twice unsuccessful in using the bogus ITIN to open a bank account in the District of Columbia. Officials at both banks told our staff that they could not validate this ITIN based on their access to a credit reporting agency database. Our test of IRS's ITIN issuance controls and whether an individual can use an ITIN for nontax purposes was too limited to show the extent to which ITIN issuance controls prevent improperly issued ITINs. Nor does the test show the magnitude of any abuse, in either receiving ITINs under false pretenses or using them for nontax purposes. Rather, the test indicates that IRS's ITIN process and controls could be circumvented, and that a person who obtains an ITIN using bogus documentation may have little difficulty in using the ITIN for certain nontax purposes. Although IRS revised its procedures for issuing ITINs subsequent to our test, the changes made do not completely address the control weaknesses we exploited. On one hand, IRS staff will need to review fewer types of documents and will be further trained in 2004 on document validation and document inspection equipment to help identify questionable documents. Also, because IRS switched to a letter from an SSN-like card to help clarify that the issued ITIN is not an SSN, using an ITIN to obtain other documents may be more difficult. On the other hand, IRS will neither require applicants to appear in person nor verify documents with third parties such as the country issuing them. Thus, IRS remains limited in its ability to ensure that the documents submitted with an ITIN application are valid and that the applicant is the same individual described by those documents. IRS officials said that requiring ITIN applicants to apply in-person and verifying documents with third parties would pose challenges, such as significantly delaying the issuance of ITINs and processing of returns that are now to be attached to ITIN applications. According to IRS, requiring in-person appearances would significantly burden IRS and applicants for various reasons. First, IRS locations that accept applications do not have the capacity, space or staffing to handle the increased ITIN traffic. Second, not all ITIN applicants live near such IRS locations and those in foreign countries would have virtually no place to go. Third, assistance to customers with other tax issues would be diminished, particularly when the ITIN workload now only represents about 7 percent of the customers assisted. IRS also noted that verifying identification documents would be burdensome on customers and costly for IRS, particularly when a significant proportion of the documents come from foreign sources. Difficult Issues Arise When Illegal Resident Aliens Receive ITINS, Become Employed, and Receive Wage Income: Because many ITINs are provided to aliens who are not authorized to work but who nevertheless do, employers and government agencies face many difficult issues. Often, these issues center on what role employers and agencies have, or should have, in furthering the federal policy that immigrants should only be in the United States legally. Employees who are illegal resident aliens likely provide employers inaccurate TINs, which could be either SSNs or ITINs. In this context, employers' concerns that they might be penalized if they provide inaccurate wage reports to IRS and SSA appear largely unfounded if they do what they are required to do. Employers also appear to have been concerned about what they are expected to do under the government's broader policies on illegal immigration. However, if employers do what is required in verifying the identity and work eligibility of employees, they appear to limit the likelihood of needing to take additional actions under DHS guidance related to possible illegal resident aliens. When illegal resident aliens obtain employment and earn wages, IRS has data that could provide DHS enhanced information to use in targeting its enforcement efforts. However, to differing degrees, officials cite limited resources, other data sources available to them, legal restrictions, and potential impact on voluntary compliance as factors affecting their decisions about whether and how to share data. Tax Returns Using ITINs Often Involve Illegal Resident Aliens and Their Associated Wage Statements Likely Show Up in SSA's Earnings Suspense File: IRS and TIGTA have concluded that many of the taxpayers who file tax returns with ITINs are illegal resident aliens. Although estimates are not precise, according to TIGTA, hundreds of thousands of the tax returns filed with ITINs each year likely involve employed illegal resident aliens. Because a substantial portion of these returns have forms W-2 attached with SSNs as the identifying number, they likely lead to hundreds of thousands of new records being added annually to SSA's earnings suspense file--a large and growing file of wage earnings for which SSA cannot identify the owner. In a December 2003 letter that responded to a TIGTA report,[Footnote 13] IRS concluded that most resident aliens who have ITINs and also report wage income were not legally employed in the United States because they used an ITIN instead of a valid SSN on their tax returns. If these individuals had qualified for an SSN, they would not need to file with an ITIN. Further, IRS said that it believes that most ITIN holders whose wages are reported on Forms W-2 are using stolen or fabricated SSNs. In this report, TIGTA had estimated for tax year 2000 that 353,000 resident aliens who were not authorized to work in the United States filed a tax return with an ITIN and also reported wages. TIGTA concluded that these individuals likely were unauthorized resident aliens (i.e., illegal resident aliens) since they did not use an SSN as their identifying number on the tax return. TIGTA estimated that at least 265,000 of these returns had Forms W-2 attached that did not use valid SSNs. These illegal resident aliens can contribute to the size of SSA's earnings suspense file when they work and provide their employers an incorrect identification number and/or name. New employees are supposed to fill out an IRS Form W-4 (Employee's Withholding Allowance Certificate) when they begin employment to identify how many, if any, exemptions to claim for income tax withholding, and must provide their name and SSN. The employer uses the W-4 information to help complete a Form W-2 to report wages the employee earned and the amount withheld for income tax purposes for the calendar year. The Form W-2 is sent to SSA, which uses the form to record the employee's earnings for use in determining future benefits. After recording the wages, SSA forwards the Form W-2 information to IRS so that IRS can match the wages reported on the W-2 to those reported by the taxpayer on a tax return. If an illegal resident alien provides an ITIN or an SSN (someone else's or an SSN-like number that was made up) on the W-4 and the employer records the name and number on a W-2 form, those numbers will show up as "mismatches" when SSA attempts to validate that the employee's name and number match those in SSA's records. In these cases, SSA posts a record of the wage earnings into its suspense file. Although it is difficult to compute their precise impact, ITIN mismatches represent a very small portion of the postings to the earnings suspense file since it was created and since the ITIN was created. Based on a preliminary analysis in 2002 of SSA data for 1996 (when the ITIN was created) through 2000 (the most recent year of available data then), the suspense file contained roughly 119,000 numbers that looked like ITINs[Footnote 14] and wages of about $936 million. The entire file contained over 230 million postings and more than $365 billion in uncredited wages through 2000. For those same years (1996 through 2000), about 38 million additional postings (with about $166 billion in wages) entered the suspense file.[Footnote 15] Thus, the initial computation of about 119,000 numbers with wages reported under likely ITINs represented about 0.3 percent of new postings and about 0.6 percent of new wages added to the suspense file between 1996 and 2000. Illegal resident aliens' use of SSNs that are not valid for employment purposes likely accounts for more of the growth in SSA's suspense file than does their use of ITINs. We did not attempt to compute the growth in the suspense file that may be due to illegal resident aliens improperly using an SSN. However, as discussed earlier, for tax year 2000, TIGTA estimated that at least 265,000 tax returns[Footnote 16] had W-2s attached that used invalid SSNs, which is higher than the 119,000 likely ITINs in the suspense file since 1996. If Employers Do What Is Required, They Appear to Face Little Likelihood of Being Penalized: Employers' concerns about potentially being penalized by IRS if they submit inaccurate wage reports--which can occur when illegal resident aliens provide them ITINs or SSNs upon obtaining employment--appear to be largely unfounded if employers do what is required. Further, if employers do what is required of them, they also appear to minimize their responsibilities to take additional actions under DHS regulations related to possible illegal resident aliens. Employers have responsibilities to IRS, SSA, and DHS when they hire employees. In addition to the Forms W-4 and W-2 responsibilities, employers are responsible under DHS regulations for verifying employees' identity and employment eligibility. Employers must ensure that employees fill out a DHS Form I-9 (Employment Eligibility Verification Form) when they start work. Employers must review documents provided by employees establishing their identity and eligibility to work and retain the Form I-9 for 3 years after a person begins work or 1 year after a person's employment is terminated. Pursuant to your interest, we contacted two groups that represent employers to better understand what concerns, if any, they may have about their responsibilities to these agencies. Officials from those groups did not provide us any examples where the guidance of IRS, SSA, and DHS were directly in conflict. However, based on our review of two IRS letters,[Footnote 17] it appeared that some employers may have believed that (1) they had greater responsibilities than they actually do under IRS guidance and those perceived responsibilities might lead to penalties, and (2) following one agency's advice may put them at risk with another agency. Representatives of one of the employer groups we spoke with said that IRS's responses, as partially described below, allayed their concerns by clarifying actions employers are required to undertake. The Information Reporting Program Advisory Committee (IRPAC), which represents those (such as employers) who have interests in IRS's information returns programs, asked IRS about any advantage or disadvantage to using IRS's TIN matching program or SSA's SSN verification systems[Footnote 18] for purposes of information reporting accuracy penalties.[Footnote 19] The inference from this question appeared to be that some employers believed they were required or expected to use these systems to verify that the SSN provided by an employee was correct. IRS's response clarified that (1) the TIN- matching program was not available to employers for this purpose due to statutory restrictions and (2) employers only have to ask an employee fill out a Form W-4 and then can rely on the SSN as provided on that form. IRS clarified that under its rules employers have no responsibility to verify the accuracy of the SSN provided by the employee. In general, IRS informed employers that they must solicit an SSN from the employee when the employee is hired by having the employee fill out a Form W-4. The employer should retain the Form W-4 in its records and use the SSN provided on the Form W-4 when completing a W-2 to report wages paid to the employee. If IRS subsequently notifies the employer that the SSN is invalid, the employer may need to solicit an SSN from the employee once or twice more. The employer may rely on the SSN provided by the employee with no further verification. The employers' questions to IRS also implied that they were concerned that fulfilling their responsibilities to IRS might create the need to take action to comply with DHS requirements. In its letter to IRS, IRPAC noted that federal immigration representatives had told some employers that if an employer used SSA's SSN verification system or IRS's TIN matching program, a mismatch notice would constitute constructive notice of a possible work authorization issue. In general, if questions arise about an employee's work authorization, DHS guidance provides that an employer might need to take certain actions, such as providing the employee another opportunity to provide proper Form I-9 documentation. We did not verify whether a mismatch could be constructive notice of a work authorization issue. However, because employers cannot use the TIN matching program for this purpose and are not required to use SSA's SSN verification system, employers can avoid possibly having constructive notice of a work authorization issue by simply not verifying an employee's identity. Greater Data Sharing Regarding ITIN Taxpayers Might Help DHS Identify Illegal Immigrants, But Several Issues Affect Any Decision to Increase Data Sharing: Enhanced sharing of IRS data might help DHS in addressing illegal immigration, but whether and how to share data is a complex policy issue. Such data sharing could provide DHS additional information to use in targeting its enforcement efforts. However, to differing degrees, officials cite limited resources, other data sources available to them, legal restrictions, and potential impact on voluntary compliance as factors affecting their decisions about whether and how to share data. Among IRS's principal responsibilities, IRS is to ensure that all taxpayers meet their tax obligations, including illegal resident aliens who are not authorized to work in the United States but who have a tax obligation. Among SSA's responsibilities is ensuring that individuals who have paid social security taxes on their covered earnings receive credit. Such credit is important so that workers will receive the benefits to which they are entitled based on their work, even persons with such earnings from unauthorized work. In addition to other responsibilities, DHS is responsible for enforcing the nation's immigration laws, including deterring illegal immigration and locating and deporting illegal resident aliens. As discussed earlier, IRS data may identify hundreds of thousands of individuals who are likely to be illegal resident aliens. Individuals who obtain ITINs and report wage income on a tax return may be illegal resident aliens. IRS has data that could be used to identify illegal resident aliens and/or their employers. The data would include such specifics as an individual's name, address, and place(s) of employment in the last calendar year. Although DHS officials we spoke with said that IRS data might be useful in carrying out their responsibilities, they noted that they have other sources of data on illegal immigrants and have limited resources to pursue all potential leads on illegal immigration. Further, they recognized that current statutory restrictions on sharing tax data would need to be modified to permit sharing of IRS data with them.[Footnote 20] IRS officials similarly noted a number of issues that relate to increasing data sharing among the agencies. IRS officials said that they cannot share these data with DHS under current statutory restrictions on the sharing of tax data. IRS officials also said that any consideration of additional sharing of tax data with federal agencies requires substantial justification and should be considered in rare circumstances because the confidentiality of tax data is considered to be fundamental to taxpayers' willingness to voluntarily and accurately report their tax obligations. Finally, IRS officials also noted a potential adverse effect of increased data sharing. To the extent that illegal resident aliens become aware of greater sharing of information by IRS with other agencies, some of the individuals may move into "underground" jobs and avoid their tax obligations. Thus, IRS faces a fundamental tension in considering steps that might further other agencies' achievement of their missions but that potentially undercut IRS's ability to ensure that all taxpayers, regardless of their legal immigration status, meet their tax obligations. Concluding Observations: IRS's creation of the ITIN helped it resolve several tax administration challenges. However, in creating the ITIN, IRS opened an avenue for individuals to use to establish an identity and to blend into society. IRS's controls over the issuance of ITINs have been limited and consequently, we had little difficulty obtaining an ITIN with bogus documents and then using that ITIN, as well as a completely made up ITIN, to take additional steps to blend into society. IRS's recent efforts to improve its ITIN issuance process--which changed the application procedures from those we tested--might make it somewhat more difficult to obtain an ITIN with bogus information but do not fully address the weaknesses we exploited. Because a significant but not precisely known number of ITIN holders are illegal resident aliens, tax return data that IRS receives could potentially assist DHS in carrying out enforcement of immigration laws. However, agency officials have not aggressively sought to enhance data sharing, citing limited resources, legal restrictions, and possible voluntary compliance impacts. Changing the current statutory provisions that limit the sharing of tax-related data with agencies or emphasizing enhanced efforts by IRS, SSA, and DHS to address the presence of illegal resident aliens are difficult policy issues. For instance, to what extent would increased data sharing undermine the willingness of taxpayers to voluntarily and accurately report information IRS needs to administer tax laws? What priority should these agencies place on addressing illegal resident aliens versus their other responsibilities? Given the legal, budgetary, and policy issues attendant to increased data sharing, this hearing is one opportunity for Congress to consider whether to provide new guidance to the agencies on how to proceed. Messrs. Chairman, this concludes my prepared statement. I would be happy to respond to any questions you or other Members of the Subcommittees may have at this time. For further information on this testimony, please contact Michael Brostek at (202 512-9110) or [Hyperlink, brostekm@gao.gov]. Individuals making key contributions to this testimony include George Guttman, Jay Pelkofer, and Tom Short. (450265): FOOTNOTES [1] In this testimony, we use the term alien to mean a foreign-born individual who has not been naturalized and is still a subject or citizen of a foreign country. A resident alien is someone meeting this definition but also considered a resident of the United States for tax purposes, as described later in this testimony. A nonresident alien does not reside in the United States, but may have a need to interact with IRS. For this testimony, we defined an illegal resident alien is a resident alien who is not legally in the United States and also may refer to them as illegal aliens, undocumented workers, or unauthorized resident aliens. [2] SSA officials said that they also receive other identification numbers that start with "9". [3] A green card is an identity document issued to lawful permanent residents by DHS that attests to the permanent residence status of an individual in the United States. [4] 26 U.S.C. �7701(b)(1)(A). [5] The masterfile is a record of transactions in a taxpayer's account. If a taxpayer has a TIN, IRS posts account information to the valid segment of the masterfile. Otherwise, IRS posts the information to the invalid segment. [6] United States General Accounting Office, Tax Administration: IRS Could Do More To Verify Taxpayer Identities, GAO/GGD-95-148 (Washington, D.C.: Aug. 30, 1995). [7] IRS issued 60,682 ITINs in 1996; 1,363,071 in 1997; 566,745 in 1998; 615,413 in 1999; 818,392 in 2000; 1,088,837 in 2001; 1,493,284 in 2002; 1,229,097 in 2003; and 77,759 through Feb. 13, 2004. [8] A list of acceptance agents that are available to the general public is available on the IRS Web site (www.irs.gov). [9] Other documents include an identification card issued by U.S. or foreign military agencies, a state, or a national government; a DHS photo identification; birth certificate; and medical or school records for dependents. [10] Applicants who are not authorized to work but report wage income on the tax return could still qualify for an ITIN, as discussed elsewhere in this testimony. [11] By analyzing a sample of tax returns filed in tax years 1999 and 2000 with an ITIN for the primary filer, IRS estimated that more than 90 percent of the returns also reported wage income. [12] Given the limited time to do our work, our test only included Virginia. We do not know whether other states also would have issued us a voter registration card in this manner. Since we did our test, Virginia has announced changes to strengthen its checks of identification documentation such as for a driver's license. [13] Internal Revenue Service's Individual Taxpayer Identification Number Creates Significant Challenges for Tax Administration, Treasury Inspector General for Tax Administration, Jan. 2004, Reference Number 2004-30-023. [14] We did not confirm that each Form W-2 actually reported an ITIN because we did not cross match the SSA records with an IRS file of issued ITINs. Rather, we counted all numbers in the suspense file that appeared to be an ITIN due to their ITIN-like format. [15] For a number of reasons, the number of suspense file accounts fluctuates daily, making a precise count difficult. While new accounts enter the suspense file, others are withdrawn. SSA has the ability to resolve certain types of identification problems for some of the accounts. Also, individuals come to SSA to report errors in their earnings records. These numbers on the accounts in the suspense file cover through tax year 2000, as of November 2003. [16] In its report, TIGTA stated that computed the margin of error for this estimate was plus or minus 17,732. [17] On July 24, 2002, the American Society for Payroll Management sent a letter and IRS responded to their concerns on January 13, 2003. A set of follow-up questions produced another IRS response on September 23, 2003. [18] TIN Matching is an IRS program that allows payers who submit certain information returns subject to backup withholding taxes when the payee does not provide a TIN to match payee TIN and name combinations against IRS records prior to submitting information returns. SSA's verification system is a system that employers may choose to use in an effort to verify that an SSN matches a given individual's name. [19] 26 U.S.C. �6721 provides for a penalty for failure to file a complete and accurate information return, including a failure to include the correct TIN (or SSN). The penalty is $50 per return up to $250,000 per year. [20] Section 6103 of the Internal Revenue Code allows IRS to disclose taxpayer information to federal agencies and authorized employees of those agencies, but only under specific conditions. Section 6103 does not currently authorize data sharing between IRS and DHS specifically for immigration enforcement.