IRS enforcement increasingly targets suspicious preparer patterns rather than just individual returns. A single return with an erroneous credit can appear to be a mistake. A cluster of returns, all routed through the same preparer identifiers, all using the same questionable positions, and all producing unusually similar outcomes, is sure to draw IRS scrutiny. IRS Criminal Investigation has stated that its work plays an integral role in shutting down criminal tax preparer networks and that it continues to integrate new technological tools to make it harder for preparers that aid and abed income tax evasion to hide. When IRS CI pursues return preparer fraud, it does not need to guess where the scheme sits. It can identify repeatable patterns across of a preparers tax filings and then trace the financial and operational links that connect returns to preparer identifiers, refund channels, and related actors.
The practical point for taxpayers and preparers is simple. The IRS does not need a traditional, in-person audit to start building a case. It can start with data, with the use of sophisticated and proprietary AI programs, identify clusters, and escalate quickly if the data suggests criminal tax intent. CI’s internal procedures describe how it identifies fraudulent preparer trends and develops investigation techniques to support high-impact criminal tax investigations using both human and artificial intelligence.
How the IRS Sees Preparers and Builds Clusters
The IRS can easily group returns based on electronic filing identification numbers (EFIN) or preparer tax identification numbers (PTIN). Anyone who prepares or assists in preparing federal tax returns for compensation must have a valid PTIN before preparing returns. If a firm electronically files returns, the IRS uses an Electronic Filing Identification Number (EFIN) to identify the authorized e-file provider. The IRS issues the EFIN after the provider completes the e-file application and passes a suitability check. That structure gives the IRS a way to map returns to individual preparers and their associated firms, and then to compare statistical analysis outcomes across peer groups.
The IRS also uses automated screening systems to identify suspicious filing patterns. In the context of refund fraud and identity theft, the Return Review Program uses filters and models to select returns for Return Integrity Verification Operations review. CI consistently strives to identify emerging trends and developing schemes related to preparer fraud using both human and artificial intelligence to support criminal tax investigations. When the IRS sees concentration, they can investigate an individual preparer or a preparer cluster even when every single return looks facially ordinary.
Clusters tend to share repeatable ‘tells’ that data can expose quickly: unusually high refundable credits or low taxable net income when compared to appropriate peer groups. The IRS also makes not of the repeated use of the same employer or payer information across unrelated taxpayers, repeatable withholding patterns that do not match wage profiles, repeated routing of refunds into the same financial products, or other repeatable electronic filing attributes that concentrate around the same preparer identifiers. We never treat those signals as merely theoretical as the IRS and the Security Summit partnership routinely treat tax professionals as high-value targets for data theft because stolen client data can drive fraudulent return filing at scale.
What “Network Enforcement” Looks Like in the Real World
When IRS analytics points to a cluster, enforcement can shift from return-by-return adjustments to preparer-centered enforcement. The IRS can assess preparer penalties when preparers understate liability based on unreasonable positions or willful or reckless conduct, and the IRS publicly summarizes penalty amounts under IRC § 6694(a) and § 6694(b). The IRM also describes a broader set of preparer and promoter penalties, including penalties under IRC § 6695 for failures such as failing to sign, failing to furnish identifying numbers, failing to retain copies, or negotiating refund checks. These penalties can become business-ending when the IRS asserts them across dozens or hundreds of returns.
The government can also seek injunctive relief to shut down preparers who repeatedly engage in prohibited conduct. IRC § 7407 authorizes a civil action to enjoin a tax return preparer from further engaging in specified misconduct, and it authorizes a court to enjoin the person from acting as a tax return preparer where the court finds repeated misconduct and concludes that a narrower injunction would not suffice. The IRS also maintains a public record of enforcement actions that barred preparers from preparing returns, including cases tied to fraudulent refundable credit claims. The Department of Justice has also brought preparer injunction actions in California federal courts.
Network enforcement can also reach the firm’s e-file access. The IRS requires e-file providers to pass suitability checks, and it can use that suitability framework, alongside civil injunctions and preparer penalties, to disrupt the operational capacity of high-risk preparer shops.
How Civil Exposure Turns Into Criminal Tax Investigation Risk
Most preparer-cluster problems start as civil compliance matters, but the risk of criminal tax investigation rises when the facts support willfulness, fabrication, or identity theft. IRS CI publicly identifies identity theft schemes as an emphasis area, and its mission directs investigations in a manner that fosters confidence in the tax system and compliance with the law. When IRS analytics identifies a cluster with refund theft signatures, false withholding, fabricated wage statements, or systematic credit inflation, CI can view the pattern as a scheme rather than a series of mistakes.
The fastest way to trigger a criminal tax investigation is to create a narrative of documentary fraud. If a preparer backfills workpapers, fabricates due diligence notes, alters source documents, or uses “template facts” across unrelated clients, the record can shift from negligence to intentional deception. The same risk applies to taxpayers who sign returns containing fictional facts, even if a preparer promised a refund. Preparers must also manage data security, as cybercriminals target preparers to steal client data for fraudulent filings. The IRS has warned tax professionals about data theft and recommended security planning and protective measures.
If you suspect an eggshell or reverse-eggshell fact pattern, you should treat the matter as potentially high-risk from the start. You should not approach the issue as a routine “fix the numbers” problem. You should approach it as a civil and criminal exposure problem where communications, document handling, and sequencing will shape the government’s intent narrative. You should route sensitive factual development through counsel because attorney-client privilege and attorney work product protection can reduce self-inflicted damage, and counsel can structure accountant involvement through a Kovel arrangement when you need confidential financial analysis to support legal strategy.
California Spillover and Parallel Risk
Clusters and preparer schemes can spill into California when clients file California returns, when federal adjustments trigger state conformity issues, or when identity-theft refund fraud involves state refunds. California state also requires taxpayers to report federal changes within six months of a final federal determination, and the FTB warns that untimely reporting can affect assessment periods. Even when the IRS targets a preparer, downstream clients can face state follow-through once federal changes finalize, and they may face additional documentation burdens when they try to repair returns under scrutiny.
Contact the Tax Law Offices of David W. Klasing Today
Contact the Tax Law Offices of David W. Klasing if you suspect the IRS has started to group returns around a preparer, an EFIN, a PTIN, a refund product channel, or repeated credit and withholding patterns, and you need a coordinated civil and criminal tax defense strategy. Cluster-driven enforcement can move fast because it relies on data patterns that the IRS can verify across many returns at once. You should involve experienced dual-licensed Tax Attorneys and CPAs when you need one team to control communications, preserve privilege, stabilize documents, and build a transaction-supported explanation that the government can test without turning your response into willfulness evidence.
Contact the Tax Law Offices of David W. Klasing immediately if you received preparer penalty correspondence, an injunction threat, an e-file suitability problem, client audits that share a repeatable theme, or any CI-driven contact suggesting a criminal tax investigation posture. These matters often turn on early decisions about what you produce, how you explain it, and whether you can prove that your records reflect reality instead of after-the-fact rationalizations. Call 800-681-1295 or contact us online HERE to request a confidential, reduced-rate initial consultation.
