A tax audit, collection case, or records request does not automatically mean criminal exposure. In many situations, the IRS is pursuing a civil objective: assessing tax, collecting balances, examining returns, or applying penalties. But some tax matters begin to show signs that the government may be looking at more than corrections and civil penalties.
That distinction matters. The IRS’s own internal guidance separates indicators of fraud from affirmative acts that may support a criminal fraud referral, and the Justice Department openly describes a system in which civil and criminal tax tools can be coordinated in parallel. Recent IRS Criminal Investigation reporting also shows that tax crime enforcement remains active, with IRS-CI reporting $10.59 billion in financial crimes identified in FY2025 and saying nearly 64% of its investigative time was devoted to tax crimes. IRS Fraud Handbook IRS Fraud Development Guidance DOJ Tax Division Overview IRS-CI FY2025 Annual Report Release
In this post, you’ll learn 10 warning signs that a tax matter may be moving beyond ordinary civil enforcement, what those signs often mean in practical terms, and why people in this position often start looking for counsel with documented experience in high-stakes tax defense. If you want a broader foundation first, it may help to read our overview of how criminal tax investigations typically unfold, including IRS-CI involvement, subpoena issues, and parallel exposure.
<aside> 💡 Scroll to the bottom for every post in this series.
</aside>
In general terms, civil tax enforcement is about fixing returns, determining liabilities, assessing penalties, and collecting what the government says is owed. Criminal tax enforcement is different. It focuses on alleged willful conduct, such as evasion, false returns, obstruction, concealment, or other intentional acts. The IRS’s Internal Revenue Manual explains that fraud cannot be established without affirmative acts of fraud, and that civil personnel may refer a matter to IRS Criminal Investigation after firm indications of fraud are established and criminal criteria are met. IRM 25.1.1 Overview/Definitions IRM 9.4.1 Investigation Initiation
That does not mean every aggressive audit becomes a criminal case. It does mean certain developments can change the risk profile quickly.
One of the clearest warning signs is a change in the examiner’s focus. Early in a civil audit, questions often center on documentation, calculations, timing, substantiation, and return positions. When the questions begin to center on why something was done, who directed it, who knew about it, or whether records were intentionally changed or omitted, the matter may be moving into fraud-development territory.
The IRS Fraud Handbook identifies classic fraud indicators such as altered documents, unexplained bank deposits, concealment of assets, and substantial differences between reported income and actual resources. When the government’s questions start sounding less like “help us verify this deduction” and more like “help us understand who created this entry and when,” that can be a meaningful shift. IRM 25.1.1 Overview/Definitions
Here’s what this often means: the government may be testing whether the issue looks like a mistake, negligence, recklessness, or deliberate conduct.
The IRS has formal internal procedures for developing potential fraud cases. Its guidance explains that if a case is placed in fraud development status, a plan of action is created to establish and document affirmative acts of fraud, typically involving the compliance employee, a manager, and a Fraud Enforcement Advisor. IRM 25.1.2 Recognizing And Developing Fraud
Taxpayers are not usually told, “your case is now in fraud development.” In fact, IRS guidance says civil personnel are not to discuss consideration of fraud or criminal investigation with the taxpayer during examination or fraud development. IRM 25.1.9 TE/GE
That makes this warning sign indirect. People sometimes notice it through sudden changes in tone, narrower communications, repeated delays, unusual internal coordination, or requests that seem designed to lock down facts rather than move the audit toward resolution.
Requests for bank statements are common in civil tax matters. What can raise concern is the scope and theory behind the request.
The IRS lists fraud indicators including substantial unexplained increases in net worth, personal expenditures that exceed available resources, and bank deposits from unexplained sources substantially exceeding reported income. It also identifies concealment of bank accounts, covering up sources of receipts, and transferring assets to hinder collection as potential affirmative acts. IRM 25.1.1 Overview/Definitions IRM 25.1.8 Field Collection
If the government starts asking for: