Is IRA fraud still taxable? What does the IRS waive in 2026?

Every few weeks, a client calls our Los Angeles office with the same story. Someone claiming to be from their bank, a government agency, or a tech-support desk convinced them that their accounts were compromised. To “protect” the money, they withdrew a large sum from their IRA and moved it to a “secure” account. The account belonged to the scammer. By the time the client understood what had happened, the money was gone, and a second problem was waiting: the tax bill. IRA fraud is now common enough that the IRS Office of Chief Counsel has published guidance on it and has issued a string of private letter rulings to victims. This post explains what the tax law actually does when retirement money is stolen, when the IRS will grant relief, and the steps that decide whether that relief is worth anything.

Why is an IRA withdrawal taxable when the money was stolen? 💸

Because the tax code looks at the distribution, not at what happened to the money afterward. You directed the custodian to pay the funds out; that is a taxable distribution to you.

A traditional IRA distribution is includible in gross income in the year received unless an exception applies. The most common exception is a rollover: if you redeposit the amount into an IRA or an eligible employer plan within 60 days, the distribution is not taxed. The IRS rollover rules on this point are mechanical. The custodian reports the withdrawal on Form 1099-R, and the IRS matches that form against your return.

Fraud breaks the rollover in two ways. First, victims rarely discover the scheme within 60 days. The scammer often keeps the victim engaged for weeks with fake case numbers, forged agency letters, and a “case manager” who calls back on schedule. Second, even when the victim realizes what happened in time, the money is gone, and a rollover requires an actual deposit. The result is what the IRS itself describes as a double hit: the retirement savings are lost, and the stolen amount is taxed as income.

If you are under 59½, the 10% additional tax on early distributions applies on top of the income tax unless another exception fits. For a California resident in a mid-to-high bracket, a $200,000 stolen distribution can produce a combined federal and state tax cost approaching $80,000 to $90,000 before anyone considers the additional tax.

What does the FBI say about how these IRA scams work? 🕵️

The FBI’s Internet Crime Complaint Center has warned that criminals impersonate government agencies, financial institutions, and tech-support staff to pressure victims into moving retirement money to accounts the criminals control.

The FBI Internet Crime Complaint Center alert describes a layered scheme sometimes called the “phantom hacker” scam. It usually runs in three acts. A tech-support impersonator gains remote access to the victim’s computer and “finds” evidence of hacking. A second caller, posing as a fraud specialist at the victim’s bank, confirms the intrusion. A third caller, posing as a federal official, instructs the victim to move the money to a “government-protected” account, often by wire or by converting it to cryptocurrency. Older adults with substantial retirement balances are the primary target.

The pattern matters for tax purposes because the IRS rulings turn on the facts of how the victim was manipulated. A victim who can document the impersonation, the remote-access session, the forged letters, and the police report is in a far stronger position than one who only remembers a phone call.

When will the IRS waive the 60-day rollover deadline for IRA fraud? ⏳

The IRS has granted waivers to fraud victims in at least three private letter rulings, most recently PLR 202623022 in June 2026. Each waiver was granted on the specific facts, and each required a formal ruling request.

The IRS has authority to waive the 60-day requirement where failing to do so would be against equity or good conscience, including in cases of casualty, disaster, or events beyond the taxpayer’s reasonable control. In practice, that authority has been exercised for fraud victims in a recognizable line of rulings:

Notice what these rulings do not say. None of them makes the stolen money reappear. A waiver extends the window; it does not fund the deposit. In PLR 202535015, the taxpayers recovered the funds before seeking relief, which is why the waiver was worth something. Where recovery is unclear, the taxpayer must have other cash available to redeposit the same amount, or the distribution stays taxable.

Can IRA fraud losses be deducted as a theft loss? 📉

Sometimes. In Chief Counsel Advice 202511015, the IRS concluded that scam losses can be deductible theft losses when the victim entered the transaction with a profit motive, but not when the scam was purely personal.

The IRS Chief Counsel Advice 202511015 walks through several fact patterns that will sound familiar to anyone who has read the FBI alert: a compromised-account scam, a phishing scam, a cryptocurrency investment scam, a romance scam, and a kidnapping scam. The distinction the IRS draws is about the victim’s purpose in transferring the money.

• Profit-motivated transfers. Where the victim moved funds to invest them, or to protect an investment account from a claimed intrusion, the IRS treated the loss as a theft loss incurred in a transaction entered into for profit. Those losses can be deductible, subject to the usual substantiation and timing rules.
• Personal transfers. Where the victim sent money to a romantic partner or to pay a fictitious ransom, the IRS treated the loss as a personal casualty or theft loss. Under current law, personal casualty and theft losses are generally deductible only when attributable to a federally declared disaster, so these victims received no deduction.
• The IRA layer. A theft-loss deduction, where available, does not erase the IRA distribution. The distribution is income; the theft loss is a separate itemized deduction claimed on Form 4684, with its own limits. Victims who take the standard deduction get no benefit from it.

What should an IRA fraud victim do first? 🚨

Freeze what can be frozen, report to law enforcement and the FBI, preserve evidence, and get a CPA involved before year-end so the tax filings and the waiver request are coordinated.

1. Contact the IRA custodian and receiving bank immediately. Wires can sometimes be recalled within hours; cryptocurrency transfers rarely can. Ask the custodian to note the account as compromised.
2. File a police report and a complaint at ic3.gov. Both the FBI complaint number and the police report are exhibits in a later waiver request.
3. Preserve every artifact. Emails, text messages, call logs, remote-access session records, the forged agency letters, and account statements. The rulings above were granted to taxpayers who could reconstruct the deception step by step.
4. Do not wait for the 1099-R. Decide before December 31 whether a waiver request is realistic, which depends on whether you have or expect to have funds to redeposit.
5. Talk to someone before the next withdrawal. Every victim in these rulings was alone with the caller. A five-minute conversation with a family member, attorney, or CPA is the single most effective control we have seen.

How can you protect your IRA from fraud in the first place? 🔒

Treat any urgent request to move retirement money as a red flag, verify callers through the number on your statement, never grant remote access, and involve a second person before any large withdrawal.

• Be skeptical of urgency. Legitimate banks and agencies do not require you to move money today.
• Verify independently. Hang up and call the number printed on your account statement or the institution’s official website, not a number the caller gives you.
• Refuse “safe,” “secure,” or “protected” accounts. There is no such government program.
• Treat any instruction to convert retirement savings to cryptocurrency as a scam until proven otherwise.
• Never allow remote access to your computer or phone at a caller’s request.
• Consider a trusted-contact designation with your custodian so a family member is alerted to unusual activity.

Frequently asked questions about IRA fraud ❓

Q. If my IRA money was stolen, do I still owe tax on the withdrawal?

Often, yes. When you take a distribution from a traditional IRA and send the money to a fraudster, the IRS treats it as a distribution to you. The custodian issues a Form 1099-R, and the amount is generally taxable income in the year of withdrawal, plus a 10% additional tax if you are under 59½ and no exception applies. The loss of the money does not undo the distribution.

Q. Can the IRS waive the 60-day rollover deadline for IRA fraud victims?

Yes, case by case. The IRS has granted 60-day waivers to scam victims in private letter rulings, including PLR 202244029 and, most recently, PLR 202623022 released in June 2026. A waiver lets you complete the rollover late so the distribution is not taxed. The catch is that you still need money to redeposit.

Q. Does the self-certification procedure in Rev. Proc. 2020-46 cover fraud?

No. Rev. Proc. 2020-46 lists eleven acceptable reasons for missing the 60-day deadline, such as financial-institution error, a misplaced check, serious illness, or a postal error. Being deceived by a scammer is not one of them. Fraud victims must request a private letter ruling and pay the IRS user fee.

Q. Can I deduct the stolen IRA money as a theft loss?

It depends on why you handed the money over. In Chief Counsel Advice 202511015, the IRS concluded that losses from scams entered into with a profit motive, such as a fake investment or a compromised-account scheme where the victim was moving money to protect it, can qualify as deductible theft losses. Losses from purely personal scams, such as romance or kidnapping schemes, are treated as personal casualty losses and are generally not deductible under current law.

Q. What should I do in the first 48 hours after discovering IRA fraud?

Call your IRA custodian and bank to freeze or reverse transfers, report the fraud to local law enforcement and the FBI at ic3.gov, preserve every email, text, and account record, and contact your CPA before year-end so the 1099-R, any theft-loss claim, and a possible waiver request are handled together.

Q. Does a waiver help if the stolen funds were never recovered?

Only partly. A waiver extends the rollover window, but a rollover requires you to deposit the same amount into an IRA or eligible plan. If the funds were not recovered and you do not have other cash to redeposit, the distribution remains taxable even with a waiver in hand.

This article is general information, not tax or legal advice for your situation. Fraud cases turn on their facts. If you or a family member has been targeted, contact SW Accounting & Consulting Corp for a confidential review.