IRS Criminal vs Civil Tax Investigation: The Warning Signs

The line between a civil IRS audit and a criminal investigation is the most consequential boundary in the tax system. On one side: adjustments, penalties, and a payment plan. On the other: prosecution, conviction, and prison. The IRS processes roughly 1.3 million civil audits per year and refers approximately 2,000 cases to its Criminal Investigation division (IRS-CI). Of those referrals, roughly 75% result in prosecution, and over 90% of prosecutions result in conviction. If you are on the wrong side of this line, cooperating as if it were a normal audit can provide the evidence used to convict you. This page covers the differences between civil and criminal, the warning signs that a case is turning, and what to do about it.

What is the difference between a civil audit and a criminal investigation?

A civil audit is an administrative process. The IRS examines your return, asks for documentation, proposes adjustments, and assesses additional tax, penalties, and interest. The worst civil outcome is a large bill. The IRS’s tools are administrative: reassessments, penalty assessments, liens and levies, and wage garnishments. The standard of proof is preponderance of the evidence (more likely than not). You can contest the results through IRS Appeals or Tax Court.

A criminal investigation is a law enforcement process. IRS Criminal Investigation (IRS-CI) special agents investigate potential criminal violations. The agents carry badges and firearms. They build cases for the Department of Justice to prosecute. The worst criminal outcome is prison (up to five years per count for tax evasion under IRC 7201, up to three years per count for filing a false return under IRC 7206). The standard of proof is beyond a reasonable doubt. The case is tried in federal district court with a jury.

The two processes are supposed to be separate. The IRS’s internal rules (IRM 4.8) establish a “wall” between the civil and criminal functions. In practice, a civil audit can generate a criminal referral, and the criminal investigation can later refer the case back to civil if prosecution is declined. The transition from civil to criminal is the danger zone.

What triggers a criminal investigation?

IRS-CI initiates investigations from several sources:

Referrals from civil auditors. The most common path. A revenue agent conducting a civil audit discovers “badges of fraud” (indicators of intentional wrongdoing) and refers the case to the IRS’s Fraud Technical Advisor. If the advisor agrees the indicators are present, the case is referred to IRS-CI.

Information from third parties. Tips from former employees, business partners, ex-spouses, and whistleblowers. The IRS whistleblower program under IRC 7623 pays awards of 15-30% of the collected proceeds for information leading to enforcement action.

Grand jury subpoenas and DOJ referrals. A federal grand jury investigating other crimes (drug trafficking, money laundering, RICO) may uncover tax violations.

Financial institution reports. Banks file Suspicious Activity Reports (SARs) when they identify transactions that suggest money laundering or tax evasion. Structuring (breaking transactions into amounts under $10,000 to avoid Currency Transaction Reports) is itself a federal crime.

Public information. Social media posts showing expensive lifestyles inconsistent with reported income, news coverage of business activities, and property records can trigger inquiries.

What are the “badges of fraud”?

The IRS uses the term “badges of fraud” (or “indicators of fraud”) to describe patterns suggesting intentional underreporting. No single badge proves fraud, but multiple badges together can support a criminal referral. The classic badges:

1. Understating income. Reporting less income than was actually received. The IRS identifies this through bank deposit analysis (total deposits exceed reported income), information matching (1099s and W-2s show more income than the return), and lifestyle analysis (spending exceeds reported income).

2. Maintaining two sets of books. Keeping one set of books for the business and a different set for the tax return. This is strong evidence of intent.

3. False or forged documents. Fabricating receipts, invoices, or deduction documentation. The IRS has forensic document analysis capabilities and can detect altered documents.

4. Concealing bank accounts or income sources. Using nominee entities, offshore accounts, or structuring transactions to hide income. For cross-border filers, failing to report foreign bank accounts (FBAR) while actively concealing the accounts can be treated as willful concealment.

5. Destroying records. Shredding documents, deleting electronic files, or otherwise destroying evidence after an audit begins.

6. Repeated underreporting. A pattern of underreporting over multiple years, especially when the underreporting involves different types of income or different methods of concealment.

7. Filing false returns under penalty of perjury. Every tax return is signed under penalty of perjury. Filing a return you know is false is itself a criminal act.

8. Claiming personal expenses as business deductions. A vacation classified as a business trip, a home renovation classified as a business expense, or personal meals classified as business entertainment. Isolated misclassifications are civil issues; a systematic pattern of fictitious business deductions can be criminal.

What are the warning signs during an audit?

If you are in a civil audit and the case is being considered for criminal referral, the transition produces observable signals:

The audit suddenly pauses. The auditor was requesting documents and asking questions, and then goes silent for weeks or months. This can mean the case has been referred to the Fraud Technical Advisor and the auditor has been told to stop working the case until CI evaluates it.

The auditor asks about your intent. Questions shift from “do you have a receipt for this?” to “why did you report it this way?” or “did you know this income was taxable?” Intent is a civil issue (it affects penalties), but a focus on intent can indicate the auditor is building a fraud referral.

New agents appear. If IRS-CI special agents show up (they will identify themselves as special agents), the investigation has already moved from civil to criminal. Special agents are law enforcement officers, not revenue agents. They may be accompanied by local law enforcement.

You receive a “subject” letter. IRS-CI sends a letter informing you that you are the subject of a criminal investigation. This is not always the first contact (special agents may visit first), but it is an unmistakable signal.

A grand jury subpoena arrives. A federal grand jury subpoena for your financial records means a criminal case is being built. This is a court process, not an IRS administrative process.

Your accountant is contacted independently. If the IRS contacts your accountant or return preparer separately (not through you), it may be seeking evidence of fraud from the preparer’s files. Under IRC 7525, the tax practitioner privilege does not protect communications made in furtherance of a crime.

What should I do if I see warning signs?

Stop talking to the IRS immediately. Do not answer any more questions, do not provide any more documents, and do not make any statements. Anything you say to a revenue agent during a civil audit can be used against you in a criminal prosecution. There is no Miranda warning in a civil audit; the agent is not required to tell you that your statements can be used against you until the case is formally criminal.

Hire a criminal tax attorney. Not a CPA, not a general tax lawyer, and not a general criminal defense attorney. Criminal tax defense is a specialty. The attorney-client privilege (IRC 7525 and the common law) protects communications with an attorney in a way it does not protect communications with a CPA or enrolled agent in a criminal context.

Do not destroy anything. Destroying records after an investigation begins (or after you know one is likely) is obstruction of justice, a separate federal crime. Keep everything exactly as it is.

Exercise your Fifth Amendment right. In a criminal investigation, you have the right to remain silent. You cannot be compelled to produce testimonial evidence (statements, explanations) that would incriminate you. You can, however, be compelled to produce non-testimonial evidence (documents, bank records) under a grand jury subpoena.

What are the criminal tax statutes?

The primary criminal tax statutes, in order of severity:

Tax evasion (IRC 7201). Willfully attempting to evade or defeat any tax. Requires an affirmative act of evasion (not just failing to file). Up to 5 years per count, $250,000 fine.

Filing a false return (IRC 7206(1)). Willfully making and signing a return that the filer does not believe to be true and correct as to every material matter. Up to 3 years per count, $250,000 fine.

Aiding and assisting (IRC 7206(2)). Willfully aiding in the preparation of a false return. This applies to tax preparers, accountants, and advisors. Up to 3 years per count, $250,000 fine.

Failure to file (IRC 7203). Willfully failing to file a return, pay a tax, or keep records. Up to 1 year per count (misdemeanor, not felony), $100,000 fine. Willful failure to file FBARs carries up to 5 years and $250,000 under 31 USC 5322.

Tax fraud conspiracy (18 USC 371). Agreement between two or more persons to defraud the United States. Commonly charged alongside the tax-specific statutes. Up to 5 years.

The word “willfully” appears in every statute. The government must prove that the defendant knew their conduct was illegal and chose to do it anyway. Ignorance of the law (genuine, good-faith ignorance) is a defense to criminal tax charges, unlike most other federal crimes. This is the Cheek v. United States (1991 SCC) rule. But “I thought my accountant handled it” is generally not sufficient; the defense requires a genuine belief that no law was being violated.

How does this affect cross-border filers?

Cross-border filers face criminal exposure in both countries simultaneously. The CRA has its own criminal tax provisions under ITA 238 (failure to file, up to 1 year and $25,000) and ITA 239 (tax evasion, up to 5 years and 200% of the tax evaded). Dual prosecution (by both the IRS and the CRA for the same underlying conduct) is rare but legally possible because they are different sovereigns.

Information sharing under Article XXVII of the treaty allows both agencies to share information, including information relevant to criminal investigations. A criminal investigation on one side can trigger scrutiny on the other.

For US citizens or green card holders who live in Canada and have not filed US returns: the non-filing itself can be criminal under IRC 7203 if it is “willful.” Filing delinquent returns through the streamlined procedures certifies non-willfulness. If the non-filing was genuinely willful (you knew about the obligation and chose not to file), the streamlined procedures are not available and a criminal tax attorney should evaluate the risk before any disclosure is made.

What should I do next?

If you are in a civil audit and the audit is proceeding normally (document requests, clear communication, no intent questions), cooperate. Most audits are civil from start to finish. If you see warning signs (silence from the auditor, intent questions, new agents, a subpoena), stop cooperating and consult a criminal tax attorney before saying or producing anything else. If you have unfiled returns and are considering voluntary disclosure, evaluate the willfulness question honestly before choosing a path. The FBAR penalty decision tree and the streamlined procedures both depend on the answer.

This guide is general information, not tax advice for your specific situation. Which points apply, and how, depends on your facts.