Have a question? Interested in learning more? Start here:
According to the IRS, identity theft has been the number one consumer complaint to the Federal Trade Commission for 15 consecutive years. The Bureau of Justice Statistics estimates that 17.6 million people were victims of identity theft in 2014. Organizations at every level are trying to protect employee and customer personal information from computer hacking that can disclose sensitive information to identity thieves.
As a protective measure, some businesses are providing credit monitoring and identity theft protection services in the hopes of preventing and mitigating damage from a data breach. Some insurance carriers are now also offering identity protection services to their customers at no additional cost. Questions were posed to the IRS concerning the taxability of identity protection services provided at no cost to customers, employees or other individuals whose personal information may have been compromised in a data breach.
In general, identity protection services monitor personal information that is on the internet, usually on public records, credit applications, websites or even on social media. These services look for unusual activity that could be identity theft. Depending on the service, it may include different corrections to help customers protect themselves from monetary loss. Some of the most common types of monitoring and services include the following:
If an identity protection service finds that a customer’s personal information has been compromised, the services kick in and work to resolve the issue. This is beneficial for customers because trying to determine where the theft is occurring can be extremely difficult. The headaches and potential for financial loss caused by this type of fraud are not something to ignore.
For those looking to save themselves from having to be on the lookout for fraud or pinpoint where it’s coming from, identity protection services may be worth it. Plus, the best services offer identity theft insurance, adding another layer of protection against monetary loss. However, those on a budget may want to avoid these services, especially as some with the most expansive offerings can be quite expensive.
If you’re not sure whether or not to pay for identity theft protection, consider your risks. Those who most benefit from protection include the following:
In such cases, it makes sense to pay a service that will do the work to protect identifying personal information from theft. The amount someone may pay for the service is likely less than the potential loss they may face due to fraud.
Someone who would like to DIY their own identity theft protection can do so by completing the following tasks, which are the same as what a professional service may provide:
In reality, most people don’t have the time or energy to perform these tasks, so it makes sense to pay for services instead.
The taxation of this identity protection benefit/service was considered by the IRS in 2015 and again in early 2016. Originally, the IRS determined that an individual whose personal information may have been compromised in a data breach does not have to include the value of such an identity protection service in his or her gross income. Similarly, the IRS had ruled that an employer providing such data protection services to employees whose personal information may have been compromised in a data breach of the employer’s recordkeeping system (or employer’s agent or service provider) does not have to include the value of such service in the employee’s gross income or wages. The value does not have to be reported on an individual’s W-2. (See IRS Announcement 2015-22.)
But what about identity theft protection services that are offered as a precautionary measure before a breach occurs? Blue Cross Blue Shield, for example, is now offering online identity protection services to all eligible BCBS members on an opt-in basis as of January 1, 2016. The offering includes credit monitoring, fraud detection and fraud resolution support. After the IRS elicited comments on Announcement 2015-22, it decided to extend the same tax treatment to identity protection services provided to employees or other individuals before a breach occurs, similar to that offered by Blue Cross Blue Shield. (See Announcement 2016-02.) The reasoning behind this ruling is that providing identity protection services to employees and others before a data breach occurs will foster earlier detection of a data breach and may minimize the impact of a breach on operations.
While this tax treatment does not apply to cash received in lieu of the identity protection service or proceeds received under an identity theft insurance policy, it is a benefit that is worthwhile to flag for your clients at a time when identity theft continues be a growing problem in the United States.
Identity protection services are a benefit that some companies offer their employees or to simply protect themselves from a data breach. If you’re a small business owner interested in this service, it makes sense to fully understand it and the tax implications that it may present. For more information and guidance, contact Fringe Benefit Analysts today.
