Income, Deduction and Taxpayer Identity Schemes

5 minutes 5 Questions

In the Certified Fraud Examiner (CFE) body of knowledge, tax fraud is commonly divided into three broad categories of schemes: income schemes, deduction schemes, and taxpayer identity schemes. Income schemes involve the deliberate understatement or concealment of income to reduce tax liability. Common methods include skimming cash receipts before they are recorded, failing to report income from side businesses, bartering, or offshore accounts, using multiple sets of books, and structuring deposits to avoid currency reporting requirements. Business owners may also disguise personal income as corporate expenses or keep income in nominee accounts. CFEs detect these schemes through indirect methods such as net worth analysis, bank deposit analysis, source-and-application-of-funds analysis, and lifestyle comparisons that reveal spending inconsistent with reported income. Deduction schemes involve overstating or fabricating expenses, credits, and exemptions. Examples include claiming personal expenses (vacations, vehicles, home improvements) as business deductions, inflating charitable contributions, creating fictitious vendors or employees to generate phony expenses, claiming dependents who do not exist or do not qualify, and misclassifying capital expenditures as deductible repairs. Abusive tax shelters and inflated depreciation also fall here. Examiners look for round-number expenses, missing documentation, duplicate invoices, and expenses inconsistent with the nature or scale of the business. Taxpayer identity schemes exploit the identities of other people or create false identities to obtain fraudulent refunds or evade taxes. Stolen Identity Refund Fraud (SIRF) involves filing returns early using stolen Social Security numbers to claim refunds before the legitimate taxpayer files. Other variations include using deceased persons' identities, fabricating employer identification numbers, dishonest preparers altering client returns to divert refunds, and ghost preparers who refuse to sign returns. Red flags include multiple refunds directed to one bank account or address, duplicate filings, and mismatched wage data. Together, understanding these schemes allows CFEs to recognize red flags, apply appropriate analytical techniques, and support investigations and prosecutions of tax fraud.

Income, Deduction and Taxpayer Identity Schemes (ACFE CFE – Tax Fraud): Complete Study Guide

1. Why This Topic Matters
Tax fraud sits in the Financial Transactions and Fraud Schemes section of the CFE Exam, and the Fraud Examiners Manual treats income, deduction and taxpayer identity schemes as the core building blocks of individual and business tax fraud. Every government relies on self-assessment, so the system is only as strong as the honesty of the people filing. Fraud examiners must understand these schemes because: (1) tax fraud is almost always a by-product of other frauds – skimmed cash, embezzled funds, kickbacks and bribes are rarely reported as income, so a tax analysis often exposes the underlying crime; (2) the indirect methods used to prove unreported income (net worth, bank deposits, expenditures) are the same tools used in asset tracing and lifestyle analysis; and (3) identity-based refund fraud has become one of the fastest growing financial crimes in the world. On the exam, this area tests whether you can distinguish lawful tax avoidance from unlawful evasion, name the scheme being described in a scenario, identify the badges (indicators) of fraud, and choose the correct investigative method.

2. What It Is – Core Definitions
Tax avoidance is the legal use of the tax code to minimise liability (timing income, claiming legitimate deductions, choosing favourable structures). Tax evasion is the wilful attempt to defeat or evade a tax that is legally owed through illegal means – concealing income, inflating deductions, falsifying records, or using another person's identity. The dividing line is wilfulness and deceit: avoidance is open and lawful, evasion is concealed and unlawful.

In most jurisdictions (the manual uses the US model as the primary illustration) criminal tax evasion requires three elements:
(a) an additional tax due and owing (a deficiency);
(b) an affirmative act of evasion (not mere passive failure);
(c) wilfulness – a voluntary, intentional violation of a known legal duty.
Negligence, honest mistake, or a good-faith misunderstanding of a complex law is not fraud. A civil fraud penalty (in the US, 75% of the underpayment attributable to fraud) requires clear and convincing evidence, while criminal conviction requires proof beyond a reasonable doubt.

The manual groups the most common individual and small-business schemes into three families:
• Income schemes – understating or hiding what was earned.
• Deduction and credit schemes – overstating what may be subtracted from income or tax.
• Taxpayer identity schemes – misrepresenting who the taxpayer is, who the dependents are, or filing in someone else's name to steal refunds.

3. How Income Schemes Work
The objective is to reduce reported gross income so that taxable income and tax fall. Common methods:

a) Skimming / unreported cash receipts. Cash-intensive businesses (restaurants, salons, contractors, taxis, retail) simply fail to ring up or record a portion of sales. Because the cash never enters the books, there is no audit trail. Indicators: gross profit margins far below industry norms, cash deposits that do not reconcile to recorded sales, owner lifestyle inconsistent with reported income.

b) Off-book income and side businesses. Consulting fees, rental income, barter transactions, tips, gambling winnings and online marketplace sales are omitted entirely.

c) Diversion into nominee or offshore accounts. Income is routed to accounts held by relatives, shell entities, trusts or foreign banks in secrecy jurisdictions and never repatriated on paper. Failure to report foreign accounts is itself a violation in many countries.

d) Mischaracterising income. Wages disguised as loans, shareholder distributions reported as non-taxable return of capital, personal income run through a corporation as 'reimbursements', or ordinary income converted to capital gains to obtain a lower rate.

e) Structured or deliberate under-invoicing. Issuing two sets of invoices – a true one for the customer and a reduced one for the books – or maintaining a second set of records.

f) Non-filing. Simply not filing a return. Note for exam purposes: wilful failure to file is generally a lesser offence (a misdemeanour in the US) than evasion, because it lacks an affirmative act – unless combined with concealment, which can elevate it to evasion (the Spies doctrine: affirmative acts such as keeping double books, destroying records, or handling affairs to avoid usual records).

Proving unreported income – indirect methods (heavily tested):
• Specific items method – direct method; identifies particular omitted transactions (e.g., a specific unreported commission cheque). Preferred when records exist.
• Net worth method – compares closing net worth to opening net worth; the increase, plus non-deductible living expenses, less non-taxable sources, equals income. Requires a firm, well-supported opening net worth. Best when the subject accumulates assets.
• Bank deposits method – totals all deposits, removes transfers, loans and non-taxable items, adds cash expenditures not deposited; the result is gross receipts. Best when the subject deposits most income.
• Expenditures (source and application of funds) method – compares known spending to known sources; excess spending implies unreported income. Best when the subject spends rather than saves.
• Percentage markup / unit and volume methods – reconstruct sales from cost of goods and known markups, or from units sold (e.g., number of pizza boxes purchased). Used for cash businesses with poor records.
Exam rule of thumb: when records are unreliable or missing, use an indirect method; when the question stresses a likely source requirement or a cash hoard defence, think net worth method.

4. How Deduction and Credit Schemes Work
Instead of hiding income, the taxpayer inflates subtractions. Because deductions are claimed openly on the return, these schemes depend on fabricated or altered documentation.

a) Personal expenses disguised as business expenses. Family vacations booked as 'conferences', personal vehicles, home renovations, meals and entertainment, or relatives placed on payroll for no work. This is the single most common small-business deduction scheme.

b) Fictitious or inflated expenses. Invoices from non-existent vendors, altered receipts, duplicate claims of the same expense, or padded cost of goods sold. Shell vendor schemes used for embezzlement often double as deduction fraud.

c) Overstated charitable contributions. Claiming donations never made, inflating the value of donated property, or using sham charities or 'donation receipt' mills.

d) Improper depreciation and capital treatment. Expensing capital assets immediately, depreciating personal-use assets, or claiming assets that were never purchased.

e) Fabricated losses. Hobby activities presented as businesses to generate deductible losses; sham partnership or trust losses passed through to the individual; abusive tax shelters that create paper losses with no economic substance.

f) Refundable credit fraud. Earned income, child, education and energy credits are refundable or partially refundable in many systems, which makes them attractive: the fraudster manipulates reported income to land in the 'sweet spot' that maximises the credit, or invents dependents, tuition or qualifying expenses.

g) Return-preparer deduction fraud. Dishonest preparers inflate deductions and credits on hundreds of client returns to boost refunds (and their fees, sometimes a percentage of the refund), often without the client's knowledge. Indicators: preparer refuses to sign the return, demands cash fees, promises a large refund before seeing records, or directs refunds to the preparer's account.

5. How Taxpayer Identity Schemes Work
These schemes misrepresent identity rather than amounts, and are frequently committed by outsiders rather than the taxpayer.

a) Stolen identity refund fraud (SIRF). The fraudster obtains a victim's name and taxpayer identification number (often from data breaches, medical or school records, or insider access) and files an early, fabricated return showing wages and withholding that generate a large refund, directed to a prepaid card, controlled bank account or address. The legitimate taxpayer discovers the fraud only when their real return is rejected as a duplicate. Favoured targets: deceased persons, children, the elderly, prisoners, and low-income individuals who are not required to file.

b) False dependents and exemptions. Claiming children who do not exist, who live with someone else, who have already been claimed, or purchasing or 'renting' another family's children's identification numbers to claim exemptions and refundable credits.

c) Filing status manipulation. Falsely claiming head-of-household or single status while married, or two spouses each claiming the same dependents on separate returns.

d) Fraudulent use of another person's number to work. Employment under a stolen or fabricated identification number so wages are never matched to the true earner (employment-related identity theft); the victim later receives notices for income they never earned.

e) Nominee and straw-man filings. Income or assets are placed under a nominee's identity so the real owner stays below filing thresholds or outside enforcement reach.

f) Preparer-facilitated identity fraud. Rogue preparers harvest client data to file additional fraudulent returns or redirect legitimate refunds.

g) Fictitious or deceased taxpayer schemes. Creating entirely fake identities, or filing on behalf of deceased people whose numbers have not yet been flagged.

Controls that counter identity schemes (know these for the exam): third-party information matching (wage statements versus returns), filing-season delays on refundable credits, identity protection PINs, refund direct-deposit limits per account, data analytics flagging multiple refunds to one address or account, and public-private information sharing.

6. Badges of Fraud – Indicators Examiners Look For
The manual's 'badges of fraud' are the evidentiary signals that separate wilful evasion from error. Memorise the categories:
• Understatement of income – omissions of specific items, unexplained bank deposits, income from third-party records absent from the return, concealed bank accounts.
• Fictitious or improper deductions – substantial personal expenditures deducted, fabricated invoices, duplicate deductions.
• Accounting irregularities – two sets of books, false entries, altered or backdated documents, missing records, unreconciled accounts.
• Allocation of income – shifting income to related parties, nominees or entities in lower brackets.
• Acts and conduct of the taxpayer – false statements to investigators, destroying records, dealing extensively in cash, use of currency or cashier's cheques, structuring, lack of cooperation, attempts to bribe or influence the examiner.
• Pattern and consistency – repeated understatements over several years indicate intent rather than mistake.
A single badge rarely proves fraud; a pattern of badges supports an inference of wilfulness.

7. Investigative Approach
1. Determine the correct tax liability using the best available method (direct first, indirect if records are unreliable).
2. Establish the deficiency and quantify it for each period.
3. Document affirmative acts – the concealment, false documents, nominee accounts, false statements.
4. Prove wilfulness circumstantially through badges of fraud, pattern, sophistication of the taxpayer and prior warnings.
5. Anticipate defences: cash hoard, gifts, loans, inheritances, prior accumulated funds, reliance on a preparer, lack of knowledge of the law. The net worth method in particular requires the examiner to investigate and negate reasonable non-taxable sources ('likely source' or 'negating leads').
6. Coordinate with tax authorities – in most jurisdictions tax information is confidential and the fraud examiner's role is to gather evidence, prepare a report and refer the matter.

8. Exam Tips: Answering Questions on Income, Deduction and Taxpayer Identity Schemes

Tip 1 – Identify the lever being manipulated. Ask: is the scenario about what came in (income scheme), what was subtracted (deduction/credit scheme), or who the taxpayer or dependent is (identity scheme)? Most scenario questions are solved by this single classification. A fabricated vendor invoice is a deduction scheme; an unrecorded cash sale is an income scheme; a return filed with a dead person's number is an identity scheme.

Tip 2 – Avoidance versus evasion hinges on legality and wilfulness. If the facts describe lawful planning done openly, the answer is avoidance, not fraud. If the facts describe concealment, deceit or false documents, it is evasion. Watch for distractors that call aggressive-but-legal planning 'fraud'.

Tip 3 – Know the three elements of evasion and the role of affirmative acts. Questions often ask which element is missing. Mere failure to file without more is not evasion; failure to file combined with concealment (double books, false statements) can be.

Tip 4 – Match the indirect method to the facts. Assets accumulate → net worth. Income flows through bank accounts → bank deposits. Lavish spending, few assets → expenditures/source and application of funds. Cash business, known cost of goods → markup or unit-and-volume. Specific document proving a specific omitted item → specific items method. If the question mentions the need for a firm opening balance or the 'cash hoard' defence, it is the net worth method.

Tip 5 – Remember what refundable credits do. Refundable credits can produce a payment larger than tax paid, which is why identity thieves and dishonest preparers target them. Questions about fraudsters 'engineering' income to a specific level are pointing at credit fraud.

Tip 6 – For identity refund fraud, think timing and targets. Fraudsters file early before the real taxpayer, target people unlikely to file (children, deceased, elderly, prisoners), and use untraceable refund channels (prepaid cards, multiple refunds to one account). The victim usually learns of the fraud when a genuine return is rejected as a duplicate.

Tip 7 – Badges of fraud are circumstantial evidence of intent, not the crime itself. If asked how wilfulness is proven, the answer is through a pattern of badges and conduct, since direct evidence of state of mind is rarely available.

Tip 8 – Preparer fraud questions. Red flags: fee based on refund size, refusal to sign, cash-only payments, refund routed to preparer, promises before reviewing documents. The taxpayer remains legally responsible for the return, but the preparer may be criminally liable for aiding or assisting false returns.

Tip 9 – Tax fraud is a derivative of other fraud. If a scenario involves embezzlement, bribery or skimming and asks about an additional violation, unreported income (tax evasion) is almost always a correct supplementary answer – illegal income is still taxable.

Tip 10 – Eliminate absolutes. Answers claiming a method 'always' proves fraud or that a single badge 'establishes' wilfulness are usually wrong. Fraud determinations rest on the totality of circumstances.

9. Practice Scenarios

Scenario A: A restaurant owner reports gross receipts well below industry averages, deposits large cash sums into a relative's account, and recently bought a vacation property with cash. Which scheme and which method? → Income scheme (skimming with nominee concealment). Net worth or expenditures method is appropriate because the owner is converting unreported income into assets; bank deposits analysis of the relative's account supplements it.

Scenario B: A consultant deducts a family trip to a resort as a 'client development conference', with altered receipts. → Deduction scheme: personal expenses disguised as business expenses, with fabricated documentation as the affirmative act.

Scenario C: A taxpayer's electronically filed return is rejected because a return was already accepted under her identification number, showing wages from an employer she never worked for. → Taxpayer identity scheme: stolen identity refund fraud. The investigator should trace the refund destination account or card and the filing IP/address.

Scenario D: A business owner restructures operations into a lawful pass-through entity on advice of counsel to reduce tax, fully disclosed on the return. → Tax avoidance; no fraud.

Scenario E: A preparer promises every client a refund of at least a set amount before seeing any documents, charges 20% of the refund, and does not sign returns. → Return-preparer fraud involving inflated deductions and credits; the unsigned return and contingent fee are classic red flags.

10. Key Takeaways
• Tax evasion = deficiency + affirmative act + wilfulness; avoidance is legal.
• Income schemes hide receipts (skimming, nominees, offshore, mischaracterisation); deduction schemes inflate subtractions (personal expenses, fictitious invoices, sham losses, credits); identity schemes misstate who is filing or who is claimed (SIRF, false dependents, stolen numbers).
• Indirect methods (net worth, bank deposits, expenditures, markup, unit and volume) reconstruct income when records fail; the specific items method is direct.
• Badges of fraud – understatement, fictitious deductions, double books, cash dealing, false statements, patterns – prove wilfulness circumstantially.
• On the exam, classify the lever, test for wilfulness, match the method to the facts, and remember that other frauds almost always generate unreported income.
Test mode:

CFE - Income, Deduction and Taxpayer Identity Schemes Example Questions

Test your knowledge of Income, Deduction and Taxpayer Identity Schemes

Question 1

A fraud examiner reviews a self-employed contractor's tax return. The gross receipts reported match the bank deposits. However, the return claims large subcontractor expenses paid to the contractor's sibling. The sibling operates no trade, reports no such business, and transfers each payment back to the contractor's personal account within days. Which tax fraud scheme do these facts BEST describe?

Question 2

In a stolen taxpayer identity scheme, the victim often first learns of the fraud when a legitimate return is rejected because a return under that taxpayer identification number was already filed.

Question 3

In tax fraud, which of the following BEST describes a falsified tax deduction scheme?

More Income, Deduction and Taxpayer Identity Schemes questions
15 questions (total)