Deductibility of theft losses for victims of certain scams

The IRS Office of Chief Counsel advised in a Chief Counsel Advice memorandum (CCA) that generally, for tax years 2018 through 2025, only transactions entered into for profit qualify as deductible individual theft losses under Sec. 165 and that application of the Ponzi-loss safe harbor in Rev. Proc. 2009-20 depends on the specific elements of the crime.

Facts: In the CCA’s scenario, during 2024, Taxpayers 1 through 5 invested their funds in both individual retirement accounts (IRAs) and non-IRA brokerage-type accounts. These original investments had profit potential with the clear intention of producing income and therefore constituted transactions entered into for profit. During 2024, Taxpayers 1 through 5 were the victims of various scams perpetrated by individuals designated “Scammer A,” whose identities were unknown. The scams constituted criminal fraud, larceny, or embezzlement under the law of the state where the victims resided. In each scam, the transfers that the taxpayers made to Scammer A were irreversible and were not covered by insurance. Also in 2024, the victims had no legal recourse against any third party, and law enforcement had concluded that there was little to no prospect of any recovery. As a result, Taxpayers 1 through 5 had no reasonable prospect of recovery and had sustained an actual theft loss under Sec. 165 in 2024.

Taxpayer 1 fell victim to a compromised-account scam, in which Scammer A posed as a fraud specialist from Taxpayer 1’s financial institution and fraudulently induced Taxpayer 1 to authorize distributions from their accounts and to transfer all the funds to new investment accounts created by Scammer A. Once deposited in the new investment accounts, the funds were immediately transferred to an overseas account by Scammer A.

Taxpayer 2 was the victim of a “pig butchering” investment scam (so called because it seeks to “fatten up” the victim for a larger theft by initially appearing to generate returns), in which Scammer A sent an unsolicited email with a link to a website advertising a cryptocurrency investment opportunity that promised large profits. After visiting the website and concluding that it appeared legitimate, Taxpayer 2 deposited a small amount of cash to invest. The account balance grew, and Taxpayer 2 decided to withdraw the money. The receipt of the payout bolstered Taxpayer 2’s belief that the opportunity was legitimate and led to a larger deposit, which also grew and that Taxpayer 2 successfully withdrew. The third iteration, however, resulted in Taxpayer 2’s even larger deposit withdrawal request being met with an error message and no response from customer support. Subsequent research by Taxpayer 2 unearthed similar claims from several people saying that the website and Scammer A had defrauded them. However, Scammer A was never identified and was never charged with any state or federal crime.

Taxpayer 3 was the victim of a phishing scam in which they received an unsolicited email from Scammer A informing them that their accounts had been compromised and directing them to call Scammer A to ensure that their funds would be protected. During the phone call, at the direction of Scammer A, Taxpayer 3 clicked a link in the email that gave Scammer A access to Taxpayer 3’s computer. Scammer A thus collected Taxpayer 3’s username and password to their investment accounts. The following day, Taxpayer 3 discovered that Scammer A had distributed all the funds in the investment accounts to an overseas account. Taxpayer 3 had not authorized the distributions.

Taxpayer 4, the victim of a romance scam, received an unsolicited text message from Scammer A and subsequently developed a virtual romantic relationship with them. Having been led to believe that Scammer A could not afford medical bills for a close relative, Taxpayer 4 authorized distributions from their investment accounts into a personal bank account. Taxpayer 4 then transferred the funds to Scammer A’s overseas account and never heard from Scammer A again.

In the final scam, Scammer A led Taxpayer 5 to believe that their grandson had been kidnapped by Scammer A and was being held for ransom. In a phone call, Taxpayer 5 heard what they believed to be the grandson’s voice (which in fact Scammer A had cloned using artificial intelligence). Scammer A instructed Taxpayer 5 to transfer the ransom payment to an overseas account and not to contact law enforcement. Taxpayer 5 authorized distributions from their investment accounts, which were deposited in Scammer A’s overseas account. Taxpayer 5 later learned that the kidnapping had not taken place.

Discussion: Given these five situations, the primary issue the CCA addressed was whether the scam victims sustained a theft loss under Sec. 165 that was deductible in 2024.

Sec. 165(a) permits a deduction for any loss sustained during the tax year and not compensated for by insurance or otherwise. For individuals, Sec. 165(c) limits the deduction to losses incurred in a trade or business; losses incurred in any transaction entered into for profit, though not connected with a trade or business; and personal casualty losses, which are losses of property not connected with a trade or business or a transaction entered into for profit, if such losses arise from fire, storm, shipwreck, or other casualty, or from theft.

With respect to theft losses, Rev. Rul. 2009-9 provides that “theft” is broadly defined, covering “any criminal appropriation of another’s property to the use of the taker, including theft by swindling, false pretenses and any other form of guile.” Regs. Sec. 1.165-8(d) further clarifies that “theft” includes, but is not limited to, larceny, embezzlement, and robbery. Therefore, to claim a theft loss, the loss must have “resulted from an illegal taking of property done with criminal intent that is considered theft under applicable state law” (Rev. Rul. 2009-9; Vennes, T.C. Memo. 2021-93). Additionally, Sec. 165(e) provides that theft losses are treated as sustained during the year in which the loss is discovered, and Regs. Sec. 1.165-1(d)(3) further clarifies that no loss has been sustained if there is a reasonable prospect of recovery. Finally, the amount of a loss deduction is generally limited to the taxpayer’s adjusted basis in the property (Sec. 165(b)).

The basic treatment of Sec. 165(c)(3) personal casualty losses outlined above is disallowed for tax years 2018 through 2025 except to the extent of personal casualty gains or losses attributable to a federally declared disaster (Sec. 165(h)(5)). Therefore, between 2018 and 2025, individuals are generally allowed a Sec. 165 deduction only for theft losses sustained in a transaction entered into for profit. Although “transaction entered into for profit” is not statutorily defined, the Tax Court has applied a five-factor test focusing on the taxpayer’s motive (Wright, T.C. Memo. 2024-100).

Rev. Proc. 2009-20 also provides an optional safe harbor that allows taxpayers to claim Sec. 165 theft losses from a “criminally fraudulent investment arrangement, commonly known as a ‘Ponzi scheme,’ if specific requirements set forth in the revenue procedure are satisfied,” the CCA noted. In particular, the taxpayer would need to establish that they are (1) a “qualified investor” who (2) incurred a “qualified loss” from (3) a “qualified investment” in (4) a “specified fraudulent arrangement,” all as defined in Rev. Proc. 2009-20.

Conclusions: In Taxpayer 1’s situation, because the distribution and transfers were motivated by an intent to safeguard and reinvest the funds in the same manner as before the distributions and theft by Scammer A, the losses were incurred in a transaction entered into for profit under Sec. 165(c)(2), the CCA stated. As a result, Taxpayer 1 would be permitted to deduct the loss in 2024 in the amount of Taxpayer 1’s basis in the property because “it qualifies as a theft loss and there is no reasonable prospect of recovery.” Taxpayer 1 would be liable for federal income tax on the IRA account distribution and would recognize gain or loss from the disposition of assets in the non-IRA account, giving Taxpayer 1 basis in all of the stolen funds for purposes of calculating the amount of the deductible theft loss.

Taxpayer 2’s situation would also constitute a transaction entered into for profit under Sec. 165(c)(2) because the funds were transferred to Scammer A’s website for investment purposes. Therefore, Taxpayer 2 would be entitled to deduct the theft loss in 2024 and would apply the same steps as Taxpayer 1 in determining the amount of the loss and the basis in the stolen funds.

Taxpayer 3’s case is slightly different in that they “did not authorize the transactions in which funds from the IRA and non-IRA accounts were distributed or transferred to Scammer A.” For that reason, the CCA concluded that to determine the character of the loss, the stolen property would be evaluated to determine if it was connected to the taxpayer’s trade or business, invested for profit, or held as general personal property. Taxpayer 3 held the funds as investments, which establishes a profit motive, and the theft of those funds establishes that the loss was incurred in a transaction entered into for a profit under Sec. 165(c)(2). Accordingly, Taxpayer 3 also would be entitled to deduct the theft loss in 2024 and would apply the same steps as Taxpayers 1 and 2 in determining the amount of the loss and the basis in the stolen funds.

Taxpayer 4’s motive for the transfer to Scammer A was not to invest or reinvest the funds but to help Scammer A’s purported sick relative. Despite the fraudulent inducement, there was no profit motive and, therefore, Taxpayer 4 did not incur the losses in a transaction entered into for profit. Instead, the losses constituted personal casualty losses under Sec. 165(c) which are disallowed for 2018 through 2025 by Sec. 165(h), as noted above. Assuming that Taxpayer 4 did not have any personal casualty gains and that the losses were not federally declared disasters, the losses would not be deductible in 2024. Additionally, Taxpayer 4 would be liable for tax on the distributions.

Similar to Taxpayer 4, Taxpayer 5’s distributions to pay a fraudulent ransom demand did not constitute a transaction entered into for profit under Sec. 165(c)and instead would be personal casualty losses under Sec. 165(c)(3), which, again, are currently disallowed under Sec. 165(h). Similarly, assuming that Taxpayer 5 did not have any personal casualty gains and that the losses were not federally declared disasters, the losses would not be deductible in 2024, and Taxpayer 5 would be liable for tax on the distributions.

In the case of all five taxpayers, the Ponzi-loss safe harbor would not apply because the losses were not the result of a “specified fraudulent arrangement” under Rev. Proc. 2009-20. Scammer A never purported to earn income, report fictitious income amounts, or make any payments to these taxpayers. Furthermore, because the Ponzi safe harbor applies only to allowable theft losses, Taxpayers 4 and 5 would further be prohibited from using it because their losses were personal casualty losses disallowed by Sec. 165(h). Taxpayer 2’s situation is closely aligned with the requirements of Rev. Proc. 2009-20 except for the fact that Scammer A “was never identified, charged with any state or Federal crime, or the subject of a state or Federal criminal complaint.” As a result, Taxpayer 2’s loss was not a “qualified loss” under the revenue procedure and would not be eligible for the Ponzi safe harbor.

For individual taxpayers, theft losses sustained under Sec. 165 due to an illegal taking of property that is a criminal theft under applicable state law are generally deductible only if the loss was incurred in a transaction entered into for profit under Sec. 165(c)(2). Such theft losses that are the result of transactions that are not entered into for profit are generally considered personal casualty losses under Sec. 165(c)(3) and are disallowed as a deduction for tax years 2018 through 2025 under Sec. 165(h). Relief may still be available under Rev. Proc. 2009-20 for situations that meet its criteria.

• CCA 202511015

Matthew Geiszler, Ph.D., is a lecturer in accounting in the Brooks School of Public Policy, and John McKinley, CPA, CGMA, J.D., LL.M., is a professor of the practice in accounting and taxation in the SC Johnson College of Business, both at Cornell University. To comment on this column, contact Paul Bonner, the JofA‘s tax editor.