Federal Agents Track Underground Tax Data Markets

Federal investigators are stepping up efforts to disrupt underground markets for taxpayer data as stolen personal records continue to fuel tax-related identity theft and fraudulent tax refunds. Recent cases show these operations function like organized businesses, using digital payments and global networks to sell sensitive taxpayer information.

Justice Department Cases Reveal Organized Data Sales Networks

Federal prosecutors say underground taxpayer data markets have evolved into structured platforms where stolen taxpayer information is packaged and sold. In one case, the SSNDOB marketplace allegedly offered records tied to roughly 24 million individuals and generated millions in revenue through repeat buyers and cryptocurrency payments.

Investigators found that these platforms rely on dark web channels to sell taxpayer data and on offshore infrastructure to avoid detection. Officials say the scale of these operations highlights how taxpayer data trafficking has become a persistent threat tied to broader cybercrime networks.

Stolen SSNs and Records Drive Tax Fraud Schemes

Authorities say stolen SSNs and taxpayer records are among the most valuable commodities in these markets. Criminals use this data to file false tax return schemes, redirect refunds, or create synthetic identities that can be reused across financial systems.

In related cases, law enforcement linked compromised personal data to large-scale fraudulent tax refunds exceeding tens of millions of dollars. Officials caution that once data becomes public, it can circulate repeatedly, heightening the risk of long-term identity fraud.

The Internal Revenue Service notes that tax-related identity theft often occurs when someone files a return using another person’s Social Security number. Business identity theft is also on the rise, with EIN misuse enabling criminals to impersonate companies or open fraudulent accounts.

Federal Agencies Expand Cyber and Financial Tracking

The IRS Criminal Investigation Cyber Crimes Unit is working alongside the FBI and other agencies to track illicit activity tied to underground taxpayer data markets. Investigators follow digital payment trails and monitor cybercrime forums to identify sellers and buyers.

The FBI’s cyber teams focus on dismantling the infrastructure behind these networks, targeting both the operators and the systems that support dark web sales of taxpayer data. Meanwhile, financial regulators analyze suspicious transactions linked to identity theft and fraud.

Cybersecurity officials say ransomware attacks and data breaches continue to feed these markets. Cybercriminals frequently resell stolen credentials and personal records, perpetuating a cycle of repeated exploitation across various fraud schemes.

Tax Season Raises Risks for Identity Theft Victims

Officials warn that tax season identity fraud can have immediate consequences for affected taxpayers. A fraudulent return filed first can delay a legitimate refund and trigger lengthy verification processes.

Warning signs include rejected filings due to duplicate returns, unexpected tax notices, or alerts about new accounts linked to a taxpayer’s information. Victims may spend months resolving issues and restoring accurate records.

Experts advise taxpayers to monitor financial accounts closely, secure personal data, and respond quickly to any signs of unauthorized activity. Strengthening account protections and reviewing credit reports can help reduce exposure to further fraud.

Sources

• Justice Department: SSNDOB Marketplace seizure case
• IRS: Identity theft guide for individuals
• CISA: Identity theft and personal cyber threats

‍By William Mc Lee, Editor-in-Chief & Tax Expert—Get Tax Relief Now