Tax Deductibility of Phishing, Pig-Butchering, and Other Scam Losses

New technological developments also create new opportunities for tech-savvy bad actors to scam, steal, and victimize. Being able to deduct these theft losses from taxes provides taxpayers some relief from the pain of the loss. But, since 2017, not all individual theft losses are deductible. This change has led to uncertainty as to when a theft loss may qualify for a deduction, particularly under the Ponzi loss safe harbor in Rev. Proc. 2009-20. The IRS recently published a Memorandum from the Office of Chief Counsel, CCA 202511015, providing some much-needed guidance in this area. 

Theft Loss Deductions and Limitations  

The Tax Cuts and Jobs Act (TCJA) eliminated the deduction for regular “theft” losses until 2026. However, if a “theft” loss qualifies as being from a transaction entered into for profit, then IRC Sec. 165(c) would allow an ordinary loss deduction even under the TCJA.  

Rev. Proc. 2009-20 also provides a safe harbor for taxpayers to claim a theft loss even if it would otherwise be disallowed if the loss is due to a Ponzi scheme. Ponzi scheme loss qualification under the 2009 pronouncements has a few advantages over plain loss deductions as follows:

1. One can choose to take 95% of the loss in the year discovered if not seeking recovery or 75% if seeking recovery.  
2. The losses are deductible as ordinary theft losses, not capital losses from investments. Capital losses are limited to $3,000 per year if there are no capital gains to offset. Ponzi losses have no limits and any excess over income can be carried forward. 

One recent event that impacted taxpayers hoped would qualify for the Ponzi scheme safe harbor was the bankruptcy of FTX, a cryptocurrency investment exchange. Instead, account holders’ losses will be offset by the increase in crypto token prices from the date FTX filed for bankruptcy and the date FTX liquidated its assets. 

The Scams 

The CCA covers five different scenarios where the impacted taxpayer made payments from IRA accounts as well as non-IRA brokerage accounts to a scammer. This distinction is important because IRA accounts are deemed to automatically be for “investment” purposes, which is a necessary condition for deductibility. With this as background, let’s explore the five scenarios covered in the CCA and the IRS advice on deductibility under IRC Sec. 165 and Rev. Proc. 2009-20. 

Taxpayer 1: Compromised Account Scam 

A taxpayer is convinced by someone posing as fraud specialist with the taxpayers’ financial institution that his account has been compromised, and he must immediately transfer the assets from the “compromised” account to a new account. The scammer already has backdoor access to the new accounts and proceeds to withdraw the money and disappear. 

The victim himself authorized and initiated the transfers, which is an important consideration. Despite this, because the accounts were deemed to be held for “investment,” the losses qualify for ordinary theft loss. However, the early withdrawal of the IRA funds also causes them to be immediately taxable as ordinary income. This ordinary income can be offset with an ordinary deduction for the theft loss. The non-IRA withdrawals and loss are also ordinary income, and the deduction allowed is limited to the basis. 

Taxpayer Two: Pig Butchering Investment Scam  

This scam gets its name from the fact that the scammer “fattens up” the victim by inducing him to continue to invest beyond the initial investment. A “unique, extraordinary investment opportunity” is presented to the victim who relies on screen shots, text messages, and real-looking websites to invest a small bit of money in a “no-lose,” high-profit, short-term investment. (The CCA notes that a common variation on this is promising enormous returns on investments in new cryptocurrencies.) The victim invests a small amount of money and soon sees screen shots of his account balance growing rapidly in a short time. The victim may even make some withdrawals of cash to test the system and receive it. This induces him to invest even more money.  

When he next tries to withdraw, he is either unable to do so or is asked to send a payment for “withholding taxes.” The victim loses all his money, some of which might have come from IRA accounts. Again, because the monies were invested for “gain” and despite the victim having initiated and transferred the money, the losses are considered ordinary theft losses. Again, any IRA withdrawals are immediate ordinary income. 

Taxpayer Three: Phishing Scam 

The victim is contacted via an email coming from what looks like a financial institution where he has an account asking him to click on an enclosed link to check his account’s security. Foolishly, the victim clicks on the link. This downloads malware to his computer that records his keystrokes. Scammers ask the victim to enter his own confidential username and password into his now-linked financial institution account and the scammer’s malware records that information. Scammer then uses the stolen information to log into victim’s account and drain it of assets. The victim did not authorize or transfer the funds himself.  

The IRS looks to the nature of the assets to see if they were “investment” assets held for financial gain and if so, the loss is an “investment” theft loss deductible as ordinary loss. This would imply that if the assets were in a non-interest-bearing account or were not put aside for investment, then the loss might not be deductible. It is unclear whether holding an asset for future appreciation, such as a coin or stamp collection or cryptocurrency “meme coins,” would qualify. Once again, any IRA theft would become taxable income to the victim and the non-IRA losses would be limited to basis. 

Taxpayer Four: Romance Scam 

A victim, usually elderly and living alone, is contacted through social media, a “wrong” phone call, or a chance-but-targeted meeting and begins a correspondence that at first seems innocuous and non-financial related. After gaining the victim’s trust, the scammer convinces the victim to send them money for a personal emergency. Initially the amounts are small but soon grow large and when attempts to reclaim funds are made, the victim is given a guilt trip and further induced to make additional contributions. Eventually, the victim’s close relatives discover and stop the scam. The losses are not deductible as they were not made for investment purposes. 

Taxpayer Five: Kidnapping Scam 

In this scam, the victim receives a call from a scammer posing as a purported kidnapper or a police officer claiming a loved one has been kidnapped. The victim is asked to send money via crypto exchange, gift card purchase, or just plain cash delivery. The caller ID may even reflect a police precinct making the call.  When the victim asks for proof of life, the voice of the loved one is heard, which is typically generated using AI technology after a scam call to the loved one where a simple conversation is recorded.  Money is sent quickly under threat of harm to the loved one. This loss, too, is not deductible as it is not investment related.  

The IRS determined that none of the taxpayers qualified for the Ponzi safe harbor under Rev. Proc. 2009-20.  

Tips for Avoiding Scams 

Everyone should become familiar with ways to distinguish real emails from fake ones, real financial institution websites from fake ones, and always be skeptical when asked to send money. 

1. Avoid clicking on images, even if sent by loved ones, without first confirming with the sender, as images can contain malware.  
2. Avoid assuming caller ID is accurately reflecting the identity of a caller. 
3. Do call financial institutions using the numbers on the back of credit or debit cards to confirm correspondence or calls.  
4. Know that certain institutions, like the IRS, banks, other credit card issuers, will never ask you for personal information in unsolicited phone calls.  

Finally, with AI becoming more prevalent, even real-sounding and real-looking material may be falsified. If someone is asking you to send money, always use independent means to confirm.