Thanks to the IRS, the cost of identity theft protection is not included in gross income. In August 2015, the IRS released Announcement 2015-22 (Federal Tax Treatment of Identity Protection Services Provided to Data Breach Victims) stipulating that they would not include identity protection services in an identity theft victim’s gross income.

More about Identity theft in the U.S.

Identity theft is a growing problem in the U.S. and can come in different forms. It occurs when a person wrongfully obtains and uses another person’s personal information in a way that involves fraud or deception. An identity thief will usually steal an individual’s name, banking or credit account numbers, social security numbers for his/her own economic gain. When Announcement 2015-22 was originally released, identity theft had been the number one consumer complaint to the Federal Trade Commission (FTC) over the last 15 years.

So, is the cost protection services provided taxable?

No, an individual whose personal information may have been compromised in a data breach does not need to include the value of the identity protection services (provided by the organization that experienced the data breach) in gross income.

Do companies usually provide ID theft protection for employees?

Many companies and organizations provide id protection services to victims of breaches so they can monitor their financial and other accounts. Services usually include:

• Credit monitoring and reporting services
• Identity theft insurance policies
• Identity restoration services

These services are intended to prevent/mitigate losses due to identity theft resulting from the data breach.

Do employers have to pay additional payroll taxes if providing these services?

No, just as the services do not result in additional federal taxes for employees, providing protection services will not increase employers’ federal payroll taxes.

IRS guidance

Announcement 2015-22- The IRS released clarification in August 2015 on the tax-free status of credit monitoring and other id protection services provided by employers to their employees.
Announcement 2016-02- The IRS released additional clarification December 2015 expanding the favorable tax treatment for employer-provided identity protection services. The value of identity protection services before a breach occurs is also nontaxable, thanks to this ruling.

However, the IRS’ guidance only applies to identity protection services, not to cash that an individual may receive in lieu of protection, or proceeds received under an id theft insurance policy.

So the value of identity protection services should not be reported on W-2s or 1099-MISCs.

Questions on identity theft protection? Contact us.