Auditors at the Treasury Inspector General for Tax Administration pulled 114 identity-theft case files from the IRS and found that only 4 of them closed within the agency’s own 120-day target, with the sample as a whole averaging 655 days from start to finish. The finding, published September 21, offers one of the clearest looks yet at how far a typical identity-theft case strays from the timeline the IRS sets for itself. A target met in only 4 of 114 files sampled is not a rounding error; it points to a goal the agency’s own casework routinely misses by months, not days. The report goes case by case to explain where that time actually goes, and it puts a specific number on a wait that most affected taxpayers can otherwise only guess at.
TIGTA’s Sample of 114 Case Files
To test how long an identity-theft case actually takes, rather than rely only on the IRS’s own summary statistics, TIGTA pulled a sample of 114 closed case files and timed each one from the date it opened to the date the IRS finished working it. The Treasury Inspector General for Tax Administration’s September 21 report found that just 4 of those 114 cases closed within 120 days, the internal target the IRS has set for this kind of case. The other 110 cases in the sample ran past that target, some by a matter of weeks and others by much more, and the sample’s average across all 114 files came to 655 days from open to close. The finding was one of two identity-theft-related audits TIGTA listed as published on September 21, part of the office’s regular schedule of testing IRS programs against the targets the agency sets for itself.
Inside the kit: The 13-page kit and a refund status tracker spreadsheet give a household a place to log its own case timeline against the days the IRS says a case like this should take. Open The IRS Refund Recovery Kit to start that count.
A 120-Day Target and a 655-Day Reality
A 120-day target works out to roughly four months, a window built around how long the IRS believes it should take to verify a stolen identity, correct the account and release whatever refund was on hold. The sample’s 655-day average is more than five times that target, and it reflects cases the IRS had already closed rather than ones still stuck in the queue, so it is not inflated by a handful of extreme outliers still open when the audit ran. A gap this size between a stated target and an actual outcome is exactly the kind of finding TIGTA exists to surface, since the IRS sets its own goals and otherwise faces little outside check on whether it meets them. The IRS kept its prevention messaging running while this sample was being reviewed: on September 16 the agency’s newsroom closed out its summer Security Summit series by urging tax professionals to stay vigilant against identity theft, a reminder aimed at stopping new cases rather than speeding up the ones already sitting in the queue.
How the Sample Compares to the Agency-Wide Average
The 655-day sample average sits close to, but is not identical to, the 20-month figure TIGTA separately calculated for every identity-theft case the IRS closed from fiscal year 2023 through fiscal year 2025; 655 days works out to roughly 21 or 22 months, a slightly longer stretch than that broader three-year average. The difference comes from what each number measures: the 20-month figure covers every case the IRS closed across three full years, while the 655-day figure comes from TIGTA’s own file-by-file sample built specifically to test the 120-day target. Read together, the two numbers point in the same direction rather than contradicting each other, and neither one describes a case that closes quickly. A reader comparing the two should treat them as two different rulers measuring the same slow process, not as competing claims about it.
What a 655-Day Average Means While a Case Is Still Open
A taxpayer living through one of these cases has no way to know, from the outside, whether their own file will land closer to the 120-day target or closer to the 655-day average; the sample does not name individual taxpayers or say what separated the fastest closures from the slowest. What the sample does establish is that meeting the IRS’s own target was the exception rather than the rule in the cases TIGTA reviewed, closing in 120 days or less in only 4 of 114 tries. That leaves nearly every other taxpayer in a comparable case guessing at a timeline the agency itself rarely hits, with no public breakdown of which cases moved fastest or why.
What the Two Numbers Leave Unanswered
TIGTA’s file-by-file review does not explain why the 4 fastest cases in the sample closed in 120 days or less while the other 110 did not, and the published report does not break out what separated a quick case from a slow one. That gap matters because the 655-day average blends fast and slow cases into a single number, and a taxpayer reading the finding has no way to tell in advance which side of that average a case is more likely to land on. What the sample does settle, regardless of any single case’s path through it, is that the IRS’s 120-day target described an outcome most cases in this sample simply did not reach.
A 655-Day Case File and the Records Behind It
Only 4 of the 114 identity-theft cases TIGTA reviewed closed inside the IRS’s own 120-day target, and the other 110 each generated their own stack of notices, letters and requests over an average of 655 days. Nothing in that audit gives an individual household a faster path through its own open case, and a lost or unanswered notice can add to the wait rather than shorten it.
The IRS Refund Recovery Kit includes a 13-page kit and a refund status tracker spreadsheet, built for logging the date of every notice a case produces against how long a case like this is actually taking.
Compare a case’s timeline against the tracker in The IRS Refund Recovery Kit.
This article was produced with AI assistance and reviewed by a human editor. The case numbers above are linked to the audit that counted them.
