The IRS’s 2026 Dirty Dozen is a curated list of twelve schemes that are actively harming taxpayers, delaying refunds, and consuming enforcement resources during the current filing season. The list focuses on patterns the IRS is already tracking in its filters and enforcement programs.
This article is Part 3 of Aura Advisors’ three part series on the 2026 Dirty Dozen. It addresses the final three items on the list: overstated withholding schemes, spear phishing attacks targeting tax professionals, and aggressive Offer in Compromise marketing and then connects the full set of twelve scams to planning and audit risk.
Overstated Withholding Schemes (Fabricated Wage And Withholding Data)
Taxpayers are encouraged to claim false or inflated withholding, sometimes described as “other withholding,” using incorrect or invented data on Forms W-2, W-2G, 1099 series forms, or Schedule K-1.
The goal is to generate a large refund despite reporting little or no actual income or withholding. Because the IRS cross checks withholding against third party reports, these claims frequently trigger delays, math error adjustments, and in some cases examinations and penalties.
Spear Phishing And Malware Attacks Targeting Tax Professionals
Tax professionals receive emails that appear to be from new clients, existing clients, or legitimate businesses requesting documents, which actually contain malicious links or attachments. Once opened, these can allow criminals to access client data, tax software, and filing credentials.
The downstream risk is large scale identity theft and fraudulent filing using genuine taxpayer information. This can result in multiple false returns, misdirected refunds, and a lengthy remediation process for both the taxpayer and the firm.
Aggressive Or Misleading Offer In Compromise Marketing (“OIC Mills”)
The Offer in Compromise program is a legitimate tool for taxpayers who cannot pay their full tax liability, but some companies market unrealistic promises and charge high fees to taxpayers who do not qualify. These operations often rely on scripted sales tactics, not individualized financial analysis, and leave taxpayers with significant fees and no resolved tax problem.
Any evaluation of Offer in Compromise eligibility should begin with the IRS’s own criteria and tools, followed by tailored analysis from a qualified professional, not a one size fits all marketing pitch. Review our article on options when you can not pay your bill in full here.
How These Schemes Interact With Real Returns
The risk is less about a single email, call, or idea and more about how these schemes change what appears on the return compared to the taxpayer’s real economic activity and the IRS’s third party data.
Phishing, smishing, AI calls, and spear phishing are entry points for identity theft. Once credentials and personal data are compromised, criminals can open accounts, access transcripts, or file returns in the taxpayer’s name.
Social media “hacks,” bogus self employment credits, fabricated withholding, and abusive Form 2439 claims all aim to manufacture refunds by creating fake or exaggerated entitlement to credits.
Ghost preparers, OIC mills, and non cash contribution promoters provide the infrastructure to execute these ideas at scale while shifting risk back onto taxpayers.
From the IRS’s perspective, a return that includes one or more of these features fits a known pattern. Once it is flagged, other aspects of the return and related years may also be reviewed.
Planning Steps For Taxpayers And Advisors
In an environment where the IRS has already identified these twelve areas as problems, planning should assume that any filing that resembles them may face additional scrutiny. Below are the planning steps to keep in mind for taxpayers and advisors:
Control Access and Communication Channels
Set up IRS Online Accounts only through the official site, enable multi factor authentication where available, and treat any unsolicited email, text, or call that references the IRS as suspect until independently verified.
Never provide your Multi Factor Authentication codes (those emailed, texted, or provided via an authenticator app) to someone on the phone or in a chat.
Apply For an IP PIN
An Identity Protection PIN (IP PIN) is a 6-digit code assigned by the IRS annually. This IP PIN is required in order to file your annual tax return, preventing an unauthorized individual from filing a fraudulent return with your Social Security number.
Apply for an IP PIN here.
Treat Credits and Withholding as Reconciliations, Not Opportunities
Only claim withholding that can be tied to actual forms and payments and only claim Form 2439 credits where there is a real investment in a qualifying fund or trust supported by official documentation and brokerage records.
Apply A Defensibility Test to Social Media and Promoter Claims
Before using any “strategy” found online, ask whether you could defend the position in writing to an examiner using statute, regulations, and genuine documentation.
If not, the position should not appear on the return. Talk with a licensed tax professional who can apply the tax laws to your unique tax situation.
Require Transparency from Preparers and Consultants
Work only with preparers who sign returns, provide valid identification numbers, and are willing to explain the treatment of each high impact item, especially large non cash charitable deductions, unusual credits, or significant withholding differences.
Document High Risk Areas in Advance
For non cash charitable contributions, complex investment structures, or any return that includes significant credits or refunds, assemble supporting documents and valuation support before filing, not after an exam notice arrives.
Risk And Audit Exposure in the 2026 Environment
Because the IRS has publicly highlighted these twelve categories, taxpayers who participate in them will have more difficulty arguing that they did not understand the risk.
Several exposure points are likely in the current cycle.
Refund Timing Risk
Returns with fabricated or questionable credits or withholding can be frozen for verification, delaying refunds until documentation is reviewed.
Penalty Exposure
When the IRS determines that a position was unreasonable or knowingly false, it can impose accuracy related penalties and, in serious cases, fraud penalties in addition to tax and interest.
Broader Review of The Taxpayer Profile
Once a return is selected based on one Dirty Dozen pattern, exam activity may expand to look at additional years, related entities, or related taxpayers, especially where a promoter or preparer appears repeatedly.
For taxpayers operating in or near these areas, the incremental benefit of an aggressive position is unlikely to outweigh the cost of an extended review and potential penalties once these patterns are on the IRS’s radar.
Final Thoughts
The 2026 Dirty Dozen is not just a list of scams to avoid. It is a description of how the IRS is currently thinking about risk and where it is focusing its enforcement tools. When behavior is named in this way, it is reasonable to assume that filters, analytics, and exam programs have already been calibrated to detect it.
By treating credits, withholding, and high impact elections as documentation driven, defensible positions rather than as shortcuts, taxpayers can reduce the likelihood that their filings resemble the patterns the IRS has already flagged.
If you are unsure how your current filing posture aligns with these enforcement priorities, do not hesitate to contact our team today to learn more.
Aura Advisors is a boutique tax consulting and compliance firm working with start ups, emerging growth companies, and affluent individuals. Making it safer for good people and good companies to continue to do good things.
For More Reading
IRS Dirty Dozen 2026, Part 1: Impersonation, Fake Charities, And Social Media “Tax Hacks”
IRS Dirty Dozen 2026, Part 2: Online Accounts, Capital Gain Credits, And Ghost Preparers
Short-Term vs. Long-Term Rentals: Understanding the Tax Implications