A Number Too Big to Be Comfortable
Somewhere between $116 billion and $304 billion vanishes from the federal treasury every year, and it does so not through some singular, cinematic heist but through the accumulated, unglamorous churn of stolen identities, falsified deductions, and return preparers who treat the tax code as a suggestion.
That is the range the Government Accountability Office arrived at in a new report, built from a Monte Carlo simulation stitching together adjudicated fraud cases, detected fraud that never made it to court, and the vast, unlit expanse of the shadow economy.
Put another way, somewhere between two and six percent of what Americans owe the federal government simply disappears into fraud each year, an amount that could fund a meaningful slice of veterans’ health care or national security spending, if only anyone at the IRS had been assigned to stop it.
Here is the part that should trouble you more than the number itself. The IRS has spent years assessing its fraud risks with real diligence, in keeping with GAO’s own Fraud Risk Framework. It knows where the exposure sits. It has documented, biannually, a fraud risk profile that identifies individual income tax fraud as one of its highest exposures, and it flagged, as far back as 2023, that new tax credits arrive faster than the fraud controls meant to guard them.
Diagnosis, in other words, is not the problem. The problem is that having correctly identified the disease, the agency has declined to write a prescription.
The Excuses, Collected Like Specimens
GAO went looking for the IRS’s antifraud strategy, the coordinated document that leading fraud-risk practice says should translate a risk assessment into an actual plan of controls.
It does not exist, at the agency level or within any of the divisions responsible for chasing fraud. What GAO got instead, when it asked division officials why, reads less like institutional analysis and more like a set of alibis assembled after the fact.
Some officials believed the agency’s Office of the Chief Risk and Control Officer already owned the antifraud strategy. That office told GAO, on the record, that no such strategy exists there either. Other officials had simply never identified a specific need for one.
Others still offered up their division’s routine audit activity as though conducting fraud detection were the same thing as having a documented strategy for it, a distinction that GAO’s own Fraud Risk Framework treats as fairly foundational. And at least one division pointed to its mission statement, the kind of aspirational paragraph that adorns an agency homepage, as the functional equivalent of a plan to stop nine and ten figure annual losses.
None of these things are strategies. A mission statement does not specify how existing and new controls will address a risk the agency has already flagged as high. Standard operating procedure is not the same as a coordinated response to an evolving threat. GAO says as much, plainly, and notes that nobody at IRS could tell them who was actually supposed to own this problem, what the plan was, or when it might materialize.
Recommendation one asks IRS to write the strategy down.
Recommendation two asks it to name someone whose job that is.
Partial Agreement, Fully Argued
IRS’s written response to the draft report is where this gets genuinely entertaining, in the grim way that bureaucratic self-defense often is.
The agency “partially agreed” with both recommendations, which is administrative language for agreeing just enough to avoid the appearance of stonewalling while conceding nothing structural. It pointed to its Chief Tax Compliance Officer as the entity coordinating fraud initiatives, though GAO notes this designation arrived only in response to being asked. Even then, it does not cover the full list of responsibilities a genuine antifraud entity is supposed to hold, from managing the risk assessment process to serving as the agency’s institutional memory on fraud controls.
IRS also pushed back on the report’s framing, arguing that GAO had blurred the line between fraud and ordinary taxpayer noncompliance, and that judging its fraud posture through a narrow lens missed the fuller picture of its compliance framework.
GAO’s rebuttal is the sharpest passage in the document. It reiterates, patiently, that its definition of fraud tracks the IRS’s own definition, that its estimate specifically excludes nonfraudulent noncompliance like taxpayer error, and that it interviewed officials across essentially every division with fraud responsibility, not merely the criminal investigators.
Then it lands the number IRS handed it itself. The agency’s own projected net tax gap for 2022 was $606 billion. Between that figure and GAO’s fraud estimate, the report notes dryly, additional action seems warranted regardless of how the taxonomy gets sliced.
What a Strategy Actually Buys
Strip away the institutional throat clearing and the case here is almost embarrassingly simple. The IRS knows, with real precision, what its highest fraud risks look like. It has a Return Review Program that legitimately prevented an estimated $88 billion in fraudulent refund payments from 2018 through 2024, proof that targeted controls work when someone builds them.
What it lacks is the connective tissue between knowing and doing, the single document and single office that would let those controls scale to match risks the agency itself already identified years ago and simply left unaddressed.
GAO’s closing argument is worth sitting with, because it reframes what “strategy” even means in this context.
A pay-and-chase model, where the agency waits for fraud to happen and then tries to claw the money back through audits and collections, is fundamentally mismatched against fraudsters who are, by definition, trying to avoid exactly that kind of detection.
Proactive controls, designed and coordinated ahead of the fraud rather than in response to it, are cheaper and more effective, but they require someone to actually own the coordinating. Absent that person and that document, the IRS is left doing what it has always done—identifying the fire, describing the fire in exhaustive and well organized detail, and then waiting for someone else to decide who holds the hose.
