How the IRS Finds Unreported Income (And What Happens If They Do)

Written by Sam Brotman, J.D., LL.M. (Taxation), MBA — Managing Attorney, Brotman Law  ·  Updated May 2026

How the IRS Finds Unreported Income: The AUR Program

The Automated Underreporter (AUR) program is the IRS's primary tool for identifying unreported income. It is not a team of agents reviewing returns by hand — it is a computerized matching system that runs automatically every year on every filed return.

Here's how the mechanics work. Every entity that pays you — an employer, a bank, a broker, a platform, a client — is required by law to file an information return with the IRS and send you a copy. Your employer files a W-2. A bank paying you interest files a Form 1099-INT. A broker reports stock sales on a Form 1099-B. A platform like Upwork or Etsy files a Form 1099-NEC or Form 1099-K. These filings happen automatically, regardless of whether you report the income on your return.

The IRS receives all of those filings and then compares them, line by line, against your tax return. If you reported $90,000 in freelance income but your clients filed 1099-NECs totaling $110,000, the AUR system flags the $20,000 discrepancy. If you sold stock and the 1099-B shows proceeds your return doesn't reflect, same result. If you won at a casino and the W-2G shows winnings you didn't include, the system catches it.

The result is a CP2000 notice — a proposed change to your return. The CP2000 lays out the discrepancy the IRS found, proposes additional tax, and gives you 60 days to agree, disagree, or provide an explanation. You can read more about that process at our CP2000 notice page.

The scale of the program is worth understanding. The IRS processes more than 3 billion information returns in a typical year. The AUR program generates millions of CP2000 notices annually. This is not targeted enforcement — it is systematic. Most people who receive a CP2000 are not on anyone's radar as a problem case. The computer found a mismatch and generated a letter.

Third-Party Reporting: What Gets Filed Against You

The breadth of third-party reporting is wider than most people realize. The following categories of income are covered by mandatory information return filing — meaning the IRS gets a copy whether you report it or not.

• Wages and salary (W-2): Every employer files a W-2 for every employee. This is the most basic and most complete category of reporting.
• Bank interest (Form 1099-INT): Banks report interest paid over $10. There is no minimum threshold above which they start reporting — the $10 figure is the lower boundary of the requirement.
• Investment income and stock sales (Form 1099-B, 1099-DIV): Brokers report proceeds from securities sales on Form 1099-B and dividends on Form 1099-DIV. Starting with tax years 2011 and forward, brokers also report cost basis, making it easier for the IRS to calculate gain without asking you.
• Freelance and self-employment income (Form 1099-NEC): Any business paying an individual $600 or more in non-employee compensation is required to file a 1099-NEC. This covers independent contractors, consultants, gig workers, and sole proprietors who receive payments from business clients.
• Gig platforms and payment apps (Form 1099-K): Third-party settlement organizations — Venmo, PayPal, Stripe, Cash App, eBay, Etsy, Airbnb, Uber, Lyft, DoorDash — are required to file 1099-Ks. As of 2022, the reporting threshold dropped to $600 per year in aggregate payments, replacing the old $20,000 / 200 transaction threshold. Implementation has been phased and subject to IRS delays, but the direction is clear: more income from these platforms is reportable, not less.
• Real estate transactions (Form 1099-S): The settlement agent files a 1099-S when real property is sold. The IRS receives the gross proceeds figure automatically.
• Rental income reported by property managers: Property management companies that collect and disburse rent are required to file 1099-MISC or 1099-NEC for payments they make. Rental income paid directly to a landlord by a tenant is not covered by a specific information return — but when it runs through a property manager, the reporting is automatic.
• Gambling winnings (Form W-2G): Casinos and other gaming establishments report certain winnings on Form W-2G. The thresholds vary by game — $1,200 for slot machines and bingo, $1,500 for keno, $5,000 for poker tournaments. The casino files the W-2G; the IRS gets the copy.
• Partnership and S-corporation income (Schedule K-1): Partners and S-corp shareholders receive K-1s showing their allocated share of income, deductions, and credits. The IRS receives copies and matches K-1 income against individual returns.
• Foreign financial accounts (FBAR / FATCA / Form 8938): U.S. persons with foreign financial accounts above certain thresholds are required to file an FBAR (FinCEN Form 114) and Form 8938 with their return. Foreign financial institutions are also subject to FATCA reporting requirements, which obligate them to report accounts held by U.S. persons to the IRS directly. Foreign income is not invisible to the IRS — especially since 2010, when FATCA was enacted.

The short version: if money moved through a financial institution, a platform, or a business that paid you, there is a reasonable chance that a form was filed with the IRS. The AUR program looks for all of it.

Cash Income: How the IRS Finds What Isn't on a 1099

Cash income — payments that don't generate an information return — is not automatically invisible to the IRS. In an audit, the IRS has indirect methods to reconstruct income, and those methods are standard tools, not exotic techniques.

The three most common indirect methods are:

Bank deposit analysis. The IRS examines every deposit into every bank account you have — personal and business — and treats unexplained deposits as potential income. If your deposits consistently exceed your reported income, that gap requires an explanation. If you can't explain it, the IRS treats the difference as unreported income. This method is highly effective because most people run cash through a bank at some point.

Net worth analysis. The IRS compares your net worth at the beginning and end of a period. If your assets increased by more than your reported income can account for, the excess is treated as unreported income. This approach is more complex than bank deposit analysis but is particularly useful in cases where assets are held outside the banking system.

Cash expenditure method. The IRS totals your known cash expenditures for a period — living expenses, business expenses, purchases — and compares that total to your reported income. If your expenditures exceed your reported income and you can't explain the difference with loans, gifts, or other non-taxable sources, the IRS treats the gap as unreported income.

These methods typically come up in a field audit — not in the automated AUR process. A business owner facing an IRS audit of a cash-intensive business is the most common situation where these tools get used. But they can also arise from lifestyle audits, where a revenue agent notices that a taxpayer's reported income doesn't plausibly support their apparent standard of living.

The practical takeaway: cash income is taxable under IRC § 61 regardless of whether it generates a 1099. The IRS has tools to find it in an audit. The risk is lower than income covered by information returns — because there's no automatic matching — but it is not zero, and it is not a defense.

How Much Income Can Go Unreported

The practical reality is more nuanced, but not in the direction people hope.

For income covered by information returns — wages, 1099-NEC, 1099-K, 1099-B, W-2G, and the rest — the AUR program catches discrepancies systematically. The question isn't whether the IRS will notice; it's when the CP2000 arrives. Small discrepancies may not trigger a letter in a given year, but the matching runs every year, and the IRS can reach back three years on a standard assessment, six years for substantial understatements (more than 25% of gross income omitted), and indefinitely for fraud.

For income not covered by information returns — cash income, barter, informal transactions — the IRS's detection depends on an audit. Whether an audit happens depends on other risk factors: a large Schedule C loss, unusually high deductions relative to income, a specific red flag like a matched Form 1099-S that doesn't show up on a return, or a referral from another investigation.

The point is that the risk increases with the amount, not that small amounts are legally exempt. A $500 discrepancy in a single year is unlikely to generate a CP2000. A pattern of $500 discrepancies over multiple years, or a $50,000 discrepancy in a single year, is a different situation entirely.

And once the IRS does open an examination, it is not limited to the specific item that triggered it. A field audit initiated by a single discrepancy can expand to the full return and multiple years. That's the risk calculation that matters.

CP2000 vs. a Full Audit: What's the Difference

A CP2000 notice is not an audit. It is a proposed change to your return based on automated matching. The AUR program found a discrepancy; the notice proposes additional tax; you have 60 days to respond.

A full IRS audit is a separate and more involved process. There are three types: correspondence audits (handled by mail, typically narrow in scope), office audits (you come in and bring documents), and field audits (an IRS revenue agent comes to you or your place of business and examines records in person).

The distinction matters for several reasons:

• A CP2000 is limited to the discrepancy the AUR program found. If you received income reported on a 1099-NEC and didn't include it on your return, the CP2000 proposes tax on that specific amount. The IRS is not, at that stage, examining your entire return.
• A field audit is much broader. A revenue agent assigned to your return can ask about any item on it, request documentation going back years, and expand the scope if they find issues beyond the original trigger.
• A CP2000 can lead to an audit. If you respond to a CP2000 by claiming offsetting deductions the IRS can't verify, or if your response doesn't resolve the discrepancy, the matter can escalate to a more thorough examination.
• Patterns matter. Multiple CP2000 notices over several years — or a pattern of underreporting — can elevate your risk of a field audit even if each individual CP2000 is resolved without one.

The practical guidance on CP2000 notices: don't ignore them, don't agree to proposed changes without reviewing whether the proposed tax is correct, and don't volunteer additional information beyond what the notice asks for. You can read a full explanation of the CP2000 response process at our CP2000 notice page.

Civil Penalties for Unreported Income

When the IRS assesses additional tax for unreported income, penalties typically follow. Here is how the civil penalty structure works.

Accuracy-related penalty (IRC § 6662) — 20% of the underpayment. This penalty applies when the underpayment is attributable to negligence, disregard of rules or regulations, or a substantial understatement of income tax. A substantial understatement exists when the understatement exceeds the greater of 10% of the correct tax or $5,000. For transactions lacking economic substance, the rate increases to 40%. The § 6662 penalty is the baseline civil consequence for most unreported income situations.

Civil fraud penalty (IRC § 6663) — 75% of the underpayment. This is the most severe civil consequence. The IRS bears the burden of proving fraud by clear and convincing evidence. Fraud requires intentional wrongdoing — deliberate concealment, filing false returns, or other affirmative acts to deceive. Negligence or sloppy recordkeeping, on its own, does not rise to civil fraud. But the distinction between negligence and fraud is not always clean, and the IRS's assessment of fraud can be challenged in Tax Court.

Failure-to-file penalty (IRC § 6651(a)(1)) — 5% per month, up to 25% of unpaid tax. This applies when a return isn't filed by the due date. If the failure is fraudulent, the rate increases to 15% per month, up to 75% of the tax due.

Failure-to-pay penalty (IRC § 6651(a)(2)) — 0.5% per month, up to 25% of unpaid tax. This accrues on unpaid balances from the due date. The failure-to-file and failure-to-pay penalties can run simultaneously, though they are capped.

Interest. Interest accrues on unpaid tax from the original due date of the return, at the federal short-term rate plus 3%. It is not technically a penalty, but it compounds the balance.

In a typical unreported income case without fraud, you're looking at the original tax, plus the 20% § 6662 accuracy penalty, plus failure-to-pay interest and penalties. The total addition to your bill is material — plan for the assessment to be substantially higher than just the tax owed.

When Unreported Income Becomes Criminal Exposure

The line between a civil tax problem and a criminal one is willfulness. The IRS distinguishes between taxpayers who made mistakes — even significant ones — and taxpayers who deliberately evaded tax. Civil penalties apply in both cases; criminal charges require the latter.

The primary criminal statute is IRC § 7201, which makes it a felony to willfully attempt to evade or defeat any federal tax. The elements the government must prove are: (1) there was a tax deficiency; (2) the defendant made an affirmative act of evasion; and (3) the act was willful. "Willful" in this context means the voluntary, intentional violation of a known legal duty — not negligence, not poor recordkeeping, not optimistic tax positions that turned out to be wrong.

A conviction under § 7201 carries a maximum of 5 years in federal prison and a fine of up to $250,000 for individuals. In practice, sentences in tax evasion cases vary widely based on the amount involved, the defendant's history, and the specific conduct — but federal prison sentences in substantial evasion cases are real outcomes, not theoretical ones.

What tends to push a civil matter toward criminal exposure:

• Large amounts over multiple years, where the pattern indicates deliberate omission rather than mistake
• Affirmative acts of concealment — moving money offshore, using nominees, falsifying records
• Lying to IRS agents or providing false documentation during an audit
• A prior civil penalty for the same type of conduct (evidence of willfulness)
• A referral from another law enforcement agency (DEA, FBI, HSI) where the IRS becomes a secondary investigation

The good news: the IRS Criminal Investigation division opens roughly 2,000 criminal cases per year. The civil enforcement apparatus processes millions of matters. Most unreported income cases — even large ones — stay civil. But staying civil requires not making the problem worse by what you do after the IRS contacts you.

If you are under audit and there is unreported income in your history, coordinate any IRS contact through counsel before you respond. What you say to a revenue agent becomes part of the record. What starts as a civil audit can shift if the agent finds evidence of willful conduct during the examination. You can read more about the criminal-civil distinction at our tax evasion page.

What to Do If You Have Unreported Income

The right path depends on where you are in the process.

If you haven't heard from the IRS yet. An amended return (Form 1040-X) is the most straightforward option for correcting a prior-year return. You pay the tax, the accuracy penalty, and interest — and you avoid the escalation that comes with the IRS finding it first. The IRS does not give formal credit for voluntary disclosure the way it once did, but there is a meaningful practical difference between a taxpayer who came forward and one who was caught.

For taxpayers with unreported foreign income or unreported foreign financial accounts, the IRS Streamlined Filing Compliance Procedures are worth understanding. The Streamlined Domestic Offshore Procedures and the Streamlined Foreign Offshore Procedures both allow eligible taxpayers to correct foreign income and FBAR failures at reduced penalty rates — but eligibility requires that the conduct was non-willful. Using the streamlined program when the conduct was actually willful creates additional exposure, not less. That analysis is not one to do on your own.

If you've received a CP2000 notice. Respond within the 60-day window. Don't agree to proposed changes without confirming the IRS's proposed tax is correct — sometimes the matching is wrong, or there are offsetting deductions the AUR program didn't account for. Don't expand the conversation beyond the specific discrepancy in the notice. And if the amount is significant or if there's a history of similar omissions, talk to a tax attorney before responding.

If you're under a field audit. This is a legal matter, not an accounting one. A revenue agent in the field has authority to expand the scope of the examination, request records going back years, and make referrals if they find evidence of willful conduct. Coordinate document production and all IRS contact through counsel. What you voluntarily hand over, and what you say, shapes the trajectory of the case. See our IRS audit page for more on the audit process specifically.

The short version: the earlier in the process you address an unreported income problem, the more options you have. Once the IRS is in the room, some of those options close.