Last year, the FBI warned individuals and businesses that “malicious actors increasingly employ AI-powered voice and video cloning techniques to impersonate trusted individuals” and “seek to deceive unsuspecting victims into divulging sensitive information or authorizing fraudulent transactions” (FBI San Francisco Media Office, “FBI Warns of Increasing Threat of Cyber Criminals Utilizing Artificial Intelligence,” May 8, 2024, https://tinyurl.com/24h87exw). Overall, theft via fraud has become more common, and more sophisticated, with each passing year. While everyone should be extremely cautious when sharing personal information, tax professionals should be aware of the limited ways in which they can assist clients who end up in this unfortunate position. Once stolen, these funds are often incredibly difficult to recover.
Theft Loss Under IRC section 165
For many victims, having their funds stolen may only be the start of their troubles. If the money stolen from them was taxable income, or the theft triggered taxable income, the victim also owes the government taxes due to their “gains” on the very funds they no longer have. For example, if a scammer convinces a victim to sell off their stocks or withdraw from their 401(k) as part of the scheme, those sales/withdrawals would be considered capital gains/income and would be taxed accordingly. Furthermore, depending upon the victim’s financial situation, this newly (falsely) inflated income might impact their eligibility for public benefit programs such as Medicaid and SNAP, or health insurance subsidies available under the Affordable Care Act.
In such situations, IRC section 165(a) states that “there shall be allowed as a deduction any loss sustained during the taxable year and not compensated for by insurance or otherwise.” Losses for individuals that fall under IRC section 165(a) are limited by section 165(c) to three categories: 1) those “incurred in a trade or business,” 2) those “incurred in any transaction entered into for profit, though not connected with a trade or business,” 3) those “not connected with a trade or business or a transaction entered into for profit, if such losses arise from fire, storm, shipwreck, or other casualty, or from theft.” While there are various intricacies to this rule [e.g., section 165(h)(2) states that net casualty losses are deductible only if they exceed 10% of a taxpayer’s adjusted gross income], fraud losses of the third type described above would normally fall under this statute and the tax code would thereby provide victims some degree of protection from further hardships.
The TCJA’s Modifications to Theft Loss
In late December 2017, Congress passed the Tax Cuts and Jobs Act (TCJA). The TCJA had significant effects on both individuals and corporations.
Most relevant to this discussion, the TCJA modified IRC section 165 by adding a new subsection which significantly limited personal casualty and theft loss deductions. This newly added IRC section165(h)(5)(A) states that “in the case of an individual, except as provided in subparagraph (B), any personal casualty loss which (but for this paragraph) would be deductible in a taxable year beginning after December 31, 2017, and before January 1, 2026, shall be allowed as a deduction under subsection (a) only to the extent it is attributable to a federally declared disaster.” In other words, if the individual taxpayer’s loss did not arise due to a federally declared disaster, the loss deduction is no longer available. As of January 1, 2018, theft loss is, therefore, no longer generally deductible under IRC section 165.
Exception for Theft Loss Victims Under the TCJA
Though the TCJA severely limited the theft loss deduction, it did carve out a narrow exception that could help some theft loss victims who also had personal casualty gains in the same year. Personal casualty gains are defined as “the recognized gain from any involuntary conversion of property which is described in subsection (c)(3) arising from fire, storm, shipwreck, or other casualty, or from theft” [IRC section 165(h)(3)(A)]. Personal casualty gains frequently take the form of something like an insurance payout for a destroyed home or a stolen piece of property. Under section 165(h) (5)(B), “if a taxpayer has personal casualty gains for any taxable year to which subparagraph (A) applies … subparagraph (A) shall not apply to the portion of the personal casualty loss not attributable to a Federally declared disaster (as so defined) to the extent such loss does not exceed such gains.”
In IRS Publication 547 (“Casualties, Disasters, and Thefts,” https://irs.gov/pub/irs-pdf/p547.pdf), the IRS uses the following example to explain how taxpayers can still claim personal casualty losses: A taxpayer experiences multiple personal casualties in 2023. First, their diamond necklace is stolen, resulting in a $15,500 casualty loss. Then, they lose their camper to a lightning strike. Since the camper was insured with a replacement-value insurance policy, this results in a $13,000 personal casualty gain. Finally, they lose their car in a flood determined to be a federally declared disaster, resulting in another casualty loss of $25,000.
Because the taxpayer experienced a $13,000 casualty gain due to the replacement-value insurance for the camper, they can now offset that gain with a portion of their stolen necklace casualty loss (only $13,000, not the full $15,500 value of the necklace, since the exception allows the offset only “to the extent such loss does not exceed such gains” [IRC section165(h)(5)(B)(i)]. Finally, the taxpayer can claim the full $25,000 casualty loss for their car because the TCJA modifications still allow personal casualty losses “attributable to a Federally declared disaster.”
This scenario, of course, only allows the taxpayer to claim personal casualty losses because the taxpayer happened to experience a completely unrelated personal casualty gain in the same year. In certain cases, however, the personal casualty gains and personal casualty losses may be intertwined. In the example discussed above, where a scammer convinces their victim to sell off stocks or withdraw from their 401(k) as part of the scheme, one could argue that the victim experienced both a personal casualty loss (the loss of funds stolen by the scammer) and a personal casualty gain [the gains on stock sales or 401(k) withdrawal that were only recognized because of the scam]. Therefore, under a plain reading of IRC section 165(h) (5)(B), the victim should be allowed to offset these personal casualty gains with the personal casualty losses sustained from the same scam.
But even this reading may have pitfalls for certain unlucky taxpayers due to the timing of their losses and gains. Under IRC section 165(e), “any loss arising from theft shall be treated as sustained during the taxable year in which the taxpayer discovers such loss.” This is particularly relevant in the fraud context, where some victims may be conned for years before truly realizing what is happening. Therefore, it is possible for the loss from funds stolen in one year to only be considered “sustained” in a later year (such as when the victim formally files a police report). If this occurs, the later sustained personal casualty loss can no longer be used to offset the earlier personal casualty gain.
This is not necessarily the case for all scam victims. While the TCJA strongly limits a taxpayer’s ability to claim personal casualty loss deductions arising from fire, storm, shipwreck, other casualty, or theft, it does not limited losses “incurred in a trade or business” or “incurred in any transaction entered into for profit, though not connected with a trade or business” [IRC section 165(c) (2)-(3)]. A victim of a Ponzi scheme, for example, or a victim of a scam where they were promised a return on their investment, should still be able to claim a personal casualty loss deduction.
Advisors should also always check the state rules on this topic, as certain states have more permissible deduction policies than the current version of IRC section 165. Even if a loss cannot be claimed federally, it may still be applied against a taxpayer’s state income tax in certain cases.
The Road Ahead
The TCJA limitations imposed on IRC section 165 are currently set to expire at the end of 2025 [IRC section 165(h)(5)(A)]. Whether they will be renewed—or what may take their place—remains uncertain. But the continual growth of AI technology, which is making it easier for scammers to implement more complex schemes and, to a larger and larger degree, automate the process in ways that allow them to target significantly more people, makes this issue a growing concern. It is likely that fraud incidents will only continue to increase. CPAs should remain up to date on the ways in which they can help taxpayers mitigate the effects of these scams, and everyone should approach any communication that requests sensitive personal data with a healthy degree of skepticism.
