Picture this. A con artist talks you into emptying your IRA and wiring him the money. He vanishes. A few months later, the IRS bills you tens of thousands of dollars in income tax on money you never got to keep.
That’s not a hypothetical. It’s the law, and thanks to the 2025 tax bill, it’s now permanent.
I’ve been a CPA since 1981, and this is the cruelest rule I know of. Let me explain how it works, who it hits, why Congress hasn’t fixed it, and what to do if it happens to you.
Why stolen money is taxable
Money in a traditional IRA or 401(k) has never been taxed. The deal is you pay income tax when it comes out. That’s true whether you take it out to buy a boat, pay for surgery, or hand it to a stranger who says he’s from the government.
The withdrawal is income. Period. The IRS doesn’t care where the money went afterward.
For decades there was a pressure valve. If someone stole from you, you could claim a theft-loss deduction that roughly offset the income. The 2017 Tax Cuts and Jobs Act shut that valve for 2018 through 2025, allowing personal theft losses only when they stem from a federally declared disaster.
That suspension was supposed to expire at the end of last year. Instead, the July 2025 tax law, the one supporters call the One Big Beautiful Bill, made it permanent.
So here’s the math for a single retiree with about $30,000 of taxable income who gets talked into draining a $300,000 IRA. Using 2026 brackets, that withdrawal adds roughly $77,000 in federal income tax, before any state tax. The scammer keeps $300,000 tax-free. You owe $77,000 on nothing.
If you’re under 59 1/2, tack on a 10% early-withdrawal penalty. If you’re on Medicare, that one-year income spike can also trigger surcharges on your Part B and Part D premiums two years down the road.
The victims who found out the hard way
AARP has been tracking this for two years, and its examples are hard to read.
Lori Flowers, a 57-year-old oncology account specialist in North Carolina, lost $675,000 to a romance scammer, including funds pulled from a 401(k). Her tax bill: $225,000. She ended up in Chapter 13 bankruptcy, with the IRS first in line to be paid.
Suzanne and Dennis Gomas lost nearly $2 million after their daughter siphoned money from the family business. Their tax bill topped $412,000. They took the IRS to federal court in Florida and lost.
The judge who ruled against them wrote that he was bound to follow the law even where the outcome seemed unjust.
The problem is growing fast. The FBI’s Internet Crime Complaint Center counted $20.9 billion in reported losses in 2025. Victims 60 and older accounted for $7.7 billion of that, a 59% jump in one year. Investment scams alone drained $8.6 billion.
Every dollar pulled from a retirement account is a dollar the IRS still wants its cut of. I’ve written before about the gold-bar and “phantom hacker” cons that empty retirees’ accounts. Now you know the second punch that follows.
Which scams the IRS still lets you deduct
Here’s where it gets strange, and where my CPA training earns its keep.
The 2017 law didn’t kill every theft-loss deduction. It killed the personal ones. Losses from a “transaction entered into for profit” survived. So whether you can deduct your loss depends on why you thought you were sending the money.
In March 2025, the IRS Office of Chief Counsel spelled this out in memo 202511015, walking through five victims:
- Deductible: A victim who was told that his accounts were hacked, and who then moved his money to “protect” it. A victim of a fake crypto investment platform, the so-called pig-butchering scam. A phishing victim whose brokerage account was drained. The IRS said that money was in play for profit, so the loss counts.
- Not deductible: A romance-scam victim who sent money to someone she believed she loved. A parent who paid a fake kidnapping ransom. Those are “personal” losses, and personal losses are now permanently off the table.
The fake-government, “your account was hacked” scam is deductible. The romance scam isn’t. The fake-kidnapping scam isn’t. Same thief, same empty account, wildly different tax bill. As AARP’s Clark Flynt-Barr put it, victims have to be victims of the right type of scam.
Real talk — I’ve made plenty of money mistakes in my life, and I’ve spent decades helping people sidestep the ones they don’t have to make. Sign up for the free Money Talks Newsletter and let my scars save you a few of your own. Free, and worth more than that.
The Ponzi exception
There’s one more carve-out, and it exists because of Bernie Madoff.
After his fraud collapsed in 2008, the IRS issued Revenue Procedure 2009-20, a safe harbor for Ponzi victims. If the promoter is criminally charged, you can generally deduct 95% of your loss, or 75% if you’re chasing recovery from third parties.
You claim it on Form 4684, and the IRS keeps a page on help for Ponzi-scheme victims.
That’s real relief. It’s also relief that flows mostly to people who invested with a licensed crook. The retiree who wired an IRA to a fake Social Security agent gets nothing.
The fix that’s stuck in Congress
Lawmakers know about this. Two bipartisan bills have been floating around.
The Tax Relief for Victims of Crimes, Scams and Disasters Act, introduced in May 2025 as H.R. 3469 and S. 1773, would restore the deduction and let victims amend returns back to 2018. It was left out of the 2025 tax law and still hasn’t moved past committee.
A newer House bill has moved further. The Tax Relief for Fraud Victims Act, H.R. 9500, cleared the Ways and Means Committee 39-0 on July 1.
It would repeal the personal-loss limit, give fraud victims a year after discovering the theft to file refund claims, and let them put stolen retirement withdrawals back into their accounts to recover the tax.
The catch: As introduced, it applies to losses in tax years beginning after Dec. 31, 2025. If you got scammed in 2024 or 2025, you’re still out of luck. And it hasn’t had a House floor vote, let alone a Senate one.
If this bothers you, and it should, call your representative and senators. Cite the bill numbers. Unanimous committee votes don’t pass laws. Floor votes do.
What you can do right now
If you or someone you know has already been hit, don’t just pay the bill. Here’s the order I’d work in.
Figure out which category your scam falls in. If a crook posed as your bank, the government or a tech company and convinced you to “move” or “protect” money, the Chief Counsel memo says that’s a profit-motivated loss. Same if you thought you were investing.
Those are deductible. Get a tax professional who has read memo 202511015 to help you claim it.
Check for the Ponzi safe harbor. If the promoter has been criminally charged, Revenue Procedure 2009-20 may apply.
If you can’t deduct it and can’t pay it, look at an offer in compromise. That’s the IRS program for settling a tax debt for less than you owe when paying would create hardship. There’s a $205 fee, waived for low-income filers, and a pre-qualifier tool on the IRS site.
Low-income taxpayer clinics can help for free.
And if you haven’t been hit, the best defense is the one I’ve repeated for 35 years. Nobody legitimate, not your bank, not Social Security, not the IRS, will ever tell you to move retirement money somewhere “safe.” The moment anyone says that, hang up.
I’ve laid out the Social Security scams most likely to reach you if you want the playbook.
Because under today’s tax code, the thief gets your savings. Then the government gets the rest.
Add a Comment