The IRS posted instructions on its website for taxpayers or their CPA or other authorized representative to obtain copies of returns filed by thieves using the taxpayers’ stolen identification. The new procedures represent a change of policy for the Service, which previously had refused to release fraudulent returns due to privacy concerns.

Acknowledging that taxpayers victimized by stolen identification tax refund fraud may have a compelling concern to determine just what information about them was stolen and how it was used, the IRS said it will provide copies of fraudulent returns for the current tax year and up to six previous tax years. However, requests for the returns must meet strict requirements, and certain information will be redacted from the copies provided. Also, the IRS must have resolved the underlying identity theft case before it will provide a copy of any affected return. For now, only individual returns in the 1040 series may be requested.

Due to federal privacy laws, the victim’s name and SSN must be listed as either the primary or secondary taxpayer on the fraudulent return; return information cannot be disclosed to any person listed only as a dependent. The request must be in writing and signed by the taxpayer or representative and include certain documentation.

A request by an identity theft victim must include the taxpayer’s:

Name and Social Security number (SSN);
Mailing address;
Tax year or years requested; and
The statement “I declare that I am the taxpayer.”
In addition to the victim’s items in 1 through 3 above, a request by a person authorized to obtain an identity theft victim’s tax information must include the requesting person’s:

Name and tax identification number;
Relationship to the identity theft victim;
Mailing address;
Centralized authorization file number, if documentation of authorization is on file with the IRS covering the tax year or years requested; and
The statement “I declare that I am a person authorized to obtain the tax information requested.”
The requesting identity theft victim or authorized person must also include a copy of his or her government-issued identification, such as a driver’s license or passport. A requesting authorized person must also include documents demonstrating the person’s authority to receive the requested tax return information, such as Form 2848, Power of Attorney and Declaration of Representative, or Form 8821, Tax Information Authorization, unless:

The person is requesting return information of a minor child as a parent or legal guardian, or;
The person’s authority to obtain return information for the requested tax year(s) is on file with the IRS, and the person is providing his or her CAF number.
The identity theft victim’s mailing address on the request must match the IRS’s last known address on file for the victim.

The provided returns will partly redact names and addresses of primary and secondary taxpayers and dependents (or children reported for other tax benefits). They will fully redact names and addresses of all other persons or entities. They will redact, except for the last four digits, taxpayer identification numbers, employer identification numbers, telephone numbers, and bank routing and account numbers. Personally identifiable numbers (e.g., designee’s personal identification number (DPIN), preparer tax identification number (PTIN), etc.) and signatures will be fully redacted.

Requests should be mailed to the IRS at P.O. Box 9039, Andover, MA 01810-0939.

If the underlying case has been resolved, taxpayers or their representatives will receive requested returns or follow-up correspondence within 90 days. The IRS will acknowledge receipt of a request within 30 days.