GAO Just Nearly Doubled the Federal Fraud Bill
Last month the Government Accountability Office reported that tax fraud costs the government an estimated $116 billion to $304 billion a year, roughly 2 to 6 percent of all federal tax owed in 2022. The estimate covers every type of malfeasance, from business owners deliberately hiding income to criminal organizations filing returns in stolen names to collect refunds.
Alongside GAO’s 2024 estimate that the government loses $233 billion to $521 billion a year to fraud in its spending programs (that earlier study deliberately excluded revenue), the new total annual federal fraud losses fall somewhere between $349 billion and $825 billion. There are caveats. The studies cover different years and use different data and models, and the 2024 estimate reflects the pandemic, the most fraud-friendly spending environment in modern history. Even so, the estimates are rigorously calculated and even the low end exceeds the budgets of most cabinet departments.
For most of its history, federal fraud has been discussed through anecdotes and indictments, and GAO is to be lauded for putting a number out, especially given the methodological challenges associated with estimating something as opaque as fraud losses. What the government does with this information, however, is another question. And IRS’s response to GAO’s report is discouraging.
Who Owns Fraud at IRS
As part of its work, GAO examined how IRS manages fraud risk and found that the agency has no documented antifraud strategy and no entity formally responsible for coordinating fraud risk management across its divisions. GAO recommended that IRS fix both, and IRS partially agreed, arguing that its existing compliance system is sufficient and that its Chief Tax Compliance Officer fulfills the role of a formal responsible entity.
IRS’s fraud analytics rank among the most advanced in government. It runs automated return screening using predictive models, clustering and business rules, and it has a specialized fraud staff and a criminal investigation division. According to IRS, its Return Review Program alone stopped $88 billion in invalid and potentially fraudulent refunds between 2018 and 2024. That figure measures refunds blocked rather than confirmed fraud avoided, but it reflects a serious operation. The Security Summit, a partnership IRS launched in 2015 with state tax agencies and the tax software industry, supplies dozens of filing data points that help flag identity theft before a refund goes out.
Despite this impressive capability, IRS doesn’t have a strategy that guides the entire agency and connects the dots on fraud schemes as diverse as multifaceted as the ones IRS faces. When GAO asked IRS officials to describe the agency’s antifraud strategy, some cited fraud detection during audits, and others cited procedures in the Internal Revenue Manual or their divisions’ mission statements. Several believed the agency’s risk management office owned the strategy. You can’t address a problem that exceeds $300 billion a year without an agency-wide strategy.
IRS folds fraud into its broader tax compliance program and the Chief Tax Compliance Officer is the senior official coordinating fraud work across divisions. GAO concluded that the role falls short of an entity with enterprise-wide antifraud responsibility.
Tax compliance is a necessary function in any government, but especially one as large and complex as the U.S. government. Tax compliance is built around finding taxpayers who owe something but may not pay it correctly. It spans honest mistakes, confusion over complex rules and deliberate underreporting, and its tools, from taxpayer education to audits and collections, reflect that range. Fraud risk management starts from a very different premise. It assumes an adversary who studies the system and builds schemes around its weaknesses.
Identity theft refund fraud illustrates the problem the government is up against. The people filing those returns belong to organized criminal networks that use stolen or synthetic identities and compromised credentials to impersonate real filers and redirect their refunds. An audit program designed to catch underreported income wasn’t designed to stop that. Addressing the threat of organized tax fraud requires identity verification, network analysis, cross-government data validation and pre-refund payment controls. A strategy can match each control to the specific risk it is meant to address, and ensure resources are allocated to the biggest risks.
GAO made this point, emphasizing that controls built for honest taxpayer error do little against someone working to avoid detection, and IRS cannot show that its general compliance activities address the specific fraud risks its own assessments identified. If fraud prevention gets measured through compliance metrics, the agency risks chasing the wrong threats.
Federal agencies have been required to assess and manage fraud risks for years, and IRS has made some real progress in this area. GAO found that the agency routinely conducts fraud risk assessments and maintains an enterprise fraud risk profile. The problem arises in translating those assessments into a coordinated plan of action.
GAO provides an illustrative example. In 2023, IRS identified the risk that new tax credits could be enacted before adequate fraud controls were established, potentially creating opportunities for fraudulent claims and undermining confidence in the tax system. Yet GAO found that IRS had not identified a specific plan for addressing that risk.
Importantly, that was the same year the agency froze processing of Employee Retention Credit claims after a flood of fraudulent filings. When ERC claims overwhelmed the agency, IRS digitized more than a million of them, worth $86 billion, and sorted them by fraud risk. A strategy should identify this risk and mitigate it before a credit launches rather than after a processing freeze.
This finding raises an important management question: What process ensures that significant fraud risks identified by the agency lead to explicit decisions about controls, investments, accountability, and implementation? A meaningful antifraud strategy should answer that question. It should establish a common understanding of the agency’s most significant fraud exposures, identify the controls intended to address them, assign responsibility for implementing those controls, and define how leadership will evaluate their effectiveness. It should also require decisions about the costs and benefits of competing interventions, recognizing that fraud cannot be eliminated entirely and that controls can impose burdens on legitimate taxpayers.
This is particularly important in an organization as large and complex as IRS, where fraud risks cut across operating divisions, technology systems, enforcement functions, and taxpayer services. A division may have excellent controls for detecting suspicious returns, while another has intelligence about criminal schemes that could improve those controls. A third may be responsible for identity authentication, while a fourth oversees technology investments that could address vulnerabilities across multiple programs. Without enterprise-wide coordination, these capabilities cannot be leveraged to address complex fraud threats.
A strategy should also create a basis for evaluating whether the agency is investing in the right interventions. A dollar spent investigating an established fraud scheme may produce measurable enforcement results, while a dollar invested in stronger pre-refund verification may prevent losses that would otherwise never be detected. Both investments can be valuable, but their relative benefits can’t be assessed without weighing them against one another and making some tradeoffs. An enterprise strategy would allow IRS leadership to consider these investments as part of a broader portfolio of fraud risk reduction activities.
Building a Modern Fraud Prevention Architecture
The IRS findings aren’t limited to the IRS; this is a government-wide pattern. Federal antifraud activities have been built around detecting, investigating and recovering losses after the money is gone. Those functions remain essential, especially for complex evasion that no automated check will catch. But they are insufficient. What’s needed is a modern fraud prevention architecture with senior level authority to ensure action is taken, pre-payment controls built in, and dedicated funding to build the sort of sustainable capability needed to address today’s fraud risk environment.
Agencies need clearly designated senior-level responsibility for fraud risk management, supported by personnel with the expertise and authority to coordinate across program operations, technology, finance, legal, and investigative functions. The designated leader or entity must be able to influence investment decisions, establish common priorities, and hold operating units accountable for addressing significant risks. At IRS, the Chief Tax Compliance Officer could fill that role if the position carried an explicit prevention mandate, authority across divisions and responsibility for measuring results. It may be time to start defining a new role, such as a Chief Integrity Officer, or a Chief Fraud Prevention Officer.
Government programs should identify where fraud is most likely to occur, how it is perpetrated, what losses it could generate, and which controls can most effectively reduce the exposure. This analysis should guide decisions about investment in identity verification, third-party data validation, automated screening, payment controls, investigative referrals, and other interventions. For IRS, that might mean strengthening the ability to verify claims before refunds are issued, identifying patterns associated with organized identity theft, and improving the use of information already available across government and trusted third parties. It also means ensuring that new tax credits and other provisions are evaluated for fraud vulnerabilities before implementation, rather than discovering weaknesses after criminals have begun exploiting them.
A modern architecture should also take advantage of advances in data analytics and privacy-enhancing technologies. Government increasingly has opportunities to verify critical facts without collecting or exposing more personal information than necessary. Secure, narrowly tailored verification could help agencies establish whether a claimed identity, income source, or other eligibility attribute is valid while limiting unnecessary disclosure of sensitive data. These capabilities will require appropriate legal authorities, technical safeguards, and careful attention to accuracy, privacy, and due process. But they offer a promising path toward more effective fraud prevention without making legitimate interactions with government unnecessarily burdensome.
A modern antifraud architecture also requires a fundamental change in how government finances prevention. Federal agencies are expected to identify and manage fraud risks, yet many have limited dedicated resources to develop the systems, analytical capabilities, and verification controls needed to address them. In programs that distribute billions of dollars in benefits, fraud prevention investments often compete for relatively small administrative budgets already stretched by essential program operations.
Congress should address this structural mismatch by establishing dedicated funding for promising fraud prevention initiatives and making those resources accessible to agencies with significant risks but limited capacity. Funding should support implementation and rigorous evaluation, allowing agencies to demonstrate which controls work, at what cost, and with what effects on legitimate beneficiaries. The objective should be to create a virtuous cycle in which better evidence supports additional investment, successful controls are scaled across programs, and ineffective approaches are improved or replaced. Government cannot reasonably demand sophisticated fraud prevention capabilities while leaving agencies without the resources to build them.
Whether annual fraud losses are $349 billion or $825 billion, the problem is urgent. IRS has more data, more enforcement tools and more fraud experience than nearly any other federal agency, so agencies with a fraction of its resources are unlikely to do better. Congress should require every agency to show how its fraud risk assessments shape operational priorities, how it selects and evaluates preventive controls, and what those investments actually prevent. The ultimate measure of progress will be whether government can use what it has learned about the scale and nature of fraud to make its systems more resilient against deliberate exploitation.
Sources
Government Accountability Office, Tax Fraud: The Federal Government Loses an Estimated $116 Billion to $304 Billion Annually, GAO-26-107810, September 25, 2026. https://www.gao.gov/products/gao-26-107810
Government Accountability Office, Fraud Risk Management: 2018–2022 Data Show Federal Government Loses an Estimated $233 Billion to $521 Billion Annually to Fraud, Based on Various Risk Environments, GAO-24-105833, April 2024. https://www.gao.gov/products/gao-24-105833
Photo by Sean Lee on Unsplash. Article first posted on GovIntegrity.