W2 Verification Code

[BulldogTom]

I had heard this was coming this year.  Guess who has one on their W2?  Me!  Our company uses Paychecks and they have included the verification code on our W2's.   Looks like the long computer generated passwords that you get on some sites.   I missed seeing it, but my spouse picked up on it.

@Medlin Software  Are you putting these on your W2's?

Tom
Modesto, CA

[Medlin Software, Dennis]

IIRC, it was something which a group, including the IRS/SSA and certain stakeholders (big software vendors) came up with.  It is not required for all, but those who get on on their form, can use it on their returns.  I suspect it will not be required of all, since they likely do not want to let us "common" folk in on the algorithm.

https://www.irs.gov/individuals/w-2-verification-code

"The IRS has partnered with certain payroll service providers"

 

[Medlin Software, Dennis]

Just guessing the code is created using some of the data on the form (similar to how one can verify a CC number is not invalid).  This way, the SSA/IRS can decode it.  The code will be useless once the algorithm leaks, which it eventually will.  Unless there is some sort of method where the software vendor has to provide the code to the IRS, and the code can be created in many ways.

It will be interesting to see if this "group: ever makes the code process available to all, or whether this is yet another attempt to block out those not "in the know", so they can pretend their software is "better" because it generates the code.

Or, "he he", it needs to be used by the software companies who put employee data online, and have been hacked  

[SaraEA]

Maybe the numbers are just randomly generated--try hacking that!  Anyone been to an IRS liaison meeting lately that discussed the use of these numbers?  My hunch is that tax pros did not religiously seek and enter these long drawn-out alpha-numeric strings or always enter them correctly, especially when things got busy.  I suspect we are in for a scolding and maybe eventually will be required to enter them or face fines. (The IRS needs money and Congress won't give it to them, so someone has to.)

[Abby Normal]

If we have to start entering them, I'm going to make my scan searchable so I copy/paste the code in. I already make my complex clients scans searchable so I can find things easier, like when they have 6 brokerage accounts I can search for the account number.

[Medlin Software, Dennis]

Any V code on a W2 form can be left off a tax return.

"Taxpayers and tax professionals are urged to enter the verification code when prompted by software, as it can speed the processing of the return and the issuance of the refund. However, omitted and incorrect verification codes will not delay the processing of a tax return."

(Emphasis added)

https://www.irs.gov/individuals/w-2-verification-code

[Lloyd Hudson]

we have been  "cutting and pasting" the verification numbers for at least 2 years. The biggest problem is not overlooking that entry.

[Pacun]

I have been entering that data when available.  It means that I actually saw the W-2 and I didn't e-file with the last paycheck stub.

Are you sure it is an algorithm or simply the payroll companies add that hex number and then they transmit it to the IRS?

I have the feeling that soon it will be mandatory that we enter that information.

Maybe it has something to do with the fact that without a reason, IRS employees cannot search for SS numbers but they could easily search for that number.

[SaraEA]

I believe it has to do with the fact that ID thieves were making up fake W2s to go along with their fake returns.  The verification code is just another data point to authenticate the taxpayer and income/withholding.  CT DRS told us that people were actually registering fake businesses to get state IDs to file fake CT returns and get refunds.  That's what happens when you put the entire registration process online.

[Medlin Software, Dennis]

Had to revisit this after hearing from several of our customers about issues entering the control number into their tax software.

Somewhat rant on...

I found an article which states the Verification code is created with a seed (probably some sort of number), and uses data on the W2.  The seed, with likely certain (and hopefully rotating) data on the actual form, creates the verification code.

(Note, the verification code is still not required by the IRS, and unless they come up with a way for those preparing payroll with a pen to create their own, will never be required.)

It appears the control number field will be part of the calculation, and may become a 5 character, space (or maybe dash), 5 character field.  I am hearing from customers that some tax software (TT, and likely franchise HRB) software has entry issues with the control number.  Blank for control number seems to work (for TT, one says not for HRB franchise).  TT gives an error if the control number is not at least two digits, and states one acceptable format is the 5 space 5. 

If you have a W2 with a verification code, can you share what format the control number is?

Assuming (unlikely, but I will "play" along) the formula and seed can be kept secret, the verification code is still barely more than useless for actual security.

One way to look at the verification code is to compare to a charge card security code.  It is easy to see if the code is inaccurate, but it does not prove accuracy of the actual card number.  While not often said, the charge card security code is never "required" (wise merchants refuse to take a card without it).  Even worse, charge card companies are issuing cards with a security code which will ALWAYS work (all zeroes) since all zeroes was an "old", and still usable way, to tell the card system there is no security code on the card (back when not all cards had them), or the code is unreadable! (Personally, when we get a card with all zeroes entered as the security code, we require a visual of the card, unless we already know the customer.)  The verification code is the same,  will not be required, can and will be cracked, and at best, only proves the key data was unaltered and the person creating the form has the proper seed.

 

[Pacun]

It is a hex number and this is one that I have changed three digits for other three digits 377A-1E2F-B5E4-4768 AND 9cef-7f57-2a9b-631b

 

[Medlin Software, Dennis]

Thanks Pacun, but that looks like the format for the verification box.  That is a publicly known format (box 9).

What I am trying to guess at is for software which is participating in the verification code test, what are they putting in Box d (control number).

I found something which implies TT is accepting 5 digits, a space, then 5 more digits.  This actually makes some sense, as the verification code is created using items from the emplyoee's form, and having a unique (per FEIN) control number, in a known format, would give one more individual piece of data to crunch, along with the seed, to create a verification code for box 9.

I have one third party report of the HRB franchise software requiring something other than blank for a control number, but no verification of what format HRB is asking for.  TT also, according to a third party, gives an error saying at least two digits are needed, when the control number is not blank.

[Pacun]

0031-17023607-0000000228- is the control number and this is the verification number 9cef-7f57-2a9b-631b

[Medlin Software, Dennis]

THANK YOU!

Not exactly what I speculated it would be, but it is not nonsensical either.  Only one sample, but it could be the first two sections are don't want to say in public with the last part being a sequence or employee number (tough to consider the first part a sequence, not enough digits, the middle, could be a sequence number, but the 17+ millionth employee is a bit of a stretch unless there is some sort of online interaction to apply a unique employee sequence for each form per software vendor).

I do not need to see any others, as I do not want to make it easier to crack the formula... since this is a public posting.

Added:  YIKES when I think of people having (well, not really, since it is optional) to type this long of a sequence exactly.  If it turns out to be needed to make the box 9 code system work, then double YIKES.

 

[Medlin Software, Dennis]

But then again, I do not see a viable way (or intent) to make box d and/or box 9 required, so only those who blindly enter what is on a paper form, and those who import or scan the data will be using the verification system.

[jklcpa]

Here's info from a client's W-2 produced by ADP -

• control # 000128 BALT/HYE
• verification code:  bcea-4c7f-24e6-372c

One more W-2 from Paychex -

• control # appears as 2 lines:

1.   0027-0027MP30
2.   0000000017-

• verification code: efb7-f5bd-cdf8-93ad

Is this helpful at all?

[Cathy]

I read the link to IRS talking about the "pilot" program with these new codes.  And, of course, what didn't surprise me in the least was the following:

     " However, omitted and incorrect verification codes will not delay the processing of a tax return."

 

Why should IRS take these codes seriously when, for years (and it's probably still occurring) they have processed returns where a spouse's birth date (including the month, day and year) is incorrect and issued refunds without questioning the returns EVER....  Wonder how many bogus refunds were issued without correct taxpayer dates of birth year after year??One of the most simplest forms of security control but no one at IRS could program their computer systems to recognize incorrect taxpayer birth dates.  Pitiful!  

[Sarypion]

On 1/17/2018 at 5:52 PM, Medlin Software said:

However, omitted and incorrect verification codes will not delay the processing of a tax return.

I can't tell if some characters in the code are lower case L's or number 1's... 

[Medlin Software, Dennis]

On 1/16/2018 at 8:21 AM, Medlin Software said:

Just guessing the code is created using some of the data on the form (similar to how one can verify a CC number is not invalid).  This way, the SSA/IRS can decode it.  The code will be useless once the algorithm leaks, which it eventually will.  Unless there is some sort of method where the software vendor has to provide the code to the IRS, and the code can be created in many ways.

My guess looks pretty accurate...

While possible, I cannot envision the IRS coming up and releasing a "seed", once, or every tax year, and having a shared known seed is not secure.  Given the examples (thank you), I am confident in understanding the process.

[Abby Normal]

The IRS has never been able to get W2s into their system this soon, anyway. That's why matching notices never come out before November, and that's early.

[SaraEA]

Sarypion,  the code can only contain letters A through F.  Anything that looks like l is a one, and 0 is a zero.

[samingeorgia]

I have been entering these codes and have had no issues. Looking at drivers' license info has been interesting this year, to say the least. To address a point made in a post by Cathy, I determined that one of my clients had the birthdays switched between husband and wife, although they were both born in the same year. They either told me wrong or I entered it wrong lo these many years ago and it's carried over every year since.

This year, I realized that the DL expiration dates were inconsistent with what I had on the basic info screen. Ooops!

[Pacun]

I guess the IRS doesn't want to be hard on us and allow us to make mistakes on birthdates. I had a dependent who according to the client was 16 by the end of the tax year but the IRS didn't give the child tax credit to the client. We checked the birth certificate and the IRS was correct. The IRS knows the correct date but it will only give you hard time when you are taking a credit that you are not entitled to based on age.

How about when we enter W-2 and forget to check "spouse" on top? Or how about when we enter a schedule C for a cash spouse (without 1099misc) and we forget to check "spouse". Do we really want to criticize the IRS when we have our own faults? Of course some of you never make mistakes, right?