When Does an IRS Audit Become a Criminal Investigation?
The IRS does not send you a letter saying your civil audit has become a criminal case. There is no formal notification. No Miranda warning. The agent keeps asking questions, the investigation quietly shifts, and by the time most people realize what happened, they have already provided the evidence used against them.
This page exists because that sequence is preventable. The attorneys at Cumberland Law Group, with offices in Atlanta, GA and across North Carolina in Raleigh, Charlotte, and Durham, represent individuals and business owners at exactly this inflection point: after something has gone wrong in an audit, and before it becomes something irreversible.
What follows is a direct walk-through of how criminal tax investigations begin, how to recognize the warning signs, and why the type of representation you choose determines more than the outcome of an audit.
How IRS Criminal Investigations Actually Start
Most people picture a criminal tax case starting with a dramatic federal raid. The reality is far more procedural — and that’s what makes it dangerous.
The vast majority of IRS criminal referrals originate inside a civil audit. A Revenue Agent conducting a routine examination finds something that crosses a specific threshold: not a math error, not an aggressive deduction, but an “affirmative act of fraud” as defined in IRS Internal Revenue Manual Part 25.1. When that threshold is reached, the agent is required to act.
The formal path looks like this:
- Revenue Agent identifies indicators of fraud during a civil examination
- Agent consults a Fraud Technical Advisor within the IRS
- Agent prepares Form 2797: the Referral Report of Potential Criminal Fraud Cases
- The file is transferred to IRS Criminal Investigation (IRS-CI)
- A Special Agent conducts a “primary investigation” to assess whether criminal fraud occurred
- The Special Agent’s front-line supervisor reviews the preliminary findings
- If approved, the Special Agent in Charge (SAC) authorizes a “subject criminal investigation”
- From that point, CI has full investigative authority: grand jury subpoenas, search warrants, surveillance, third-party interviews
- If CI recommends prosecution, the file goes to the DOJ Tax Division
- The DOJ decides whether to indict
The taxpayer is not notified when step 3 happens. The audit continues to look like a civil examination. Questions keep coming. Document requests keep coming. The agent who filed Form 2797 may still be in the room.
If you have received any IRS letter or notice that feels unusual, or if your audit has taken an unexpected turn, call Cumberland Law Group at (800) 960-5359 for a free consultation before your next IRS communication.
What Triggers a Criminal Referral: Badges of Fraud
The IRS distinguishes between “indicators of fraud” and “affirmative acts of fraud.” The second category is what generates a referral. Courts and IRS examiners refer to these as “badges of fraud,” and they include:
- Consistent underreporting of income across multiple tax years, particularly where third-party records (bank statements, 1099s, payment platform data) show materially higher amounts
- Bank deposits that significantly exceed reported income with no documented explanation
- False statements made during the audit interview
- Two sets of books: one for the IRS, one for actual operations
- Concealment of assets or financial accounts
- Destruction or alteration of records
- Implausible or shifting explanations for the same transaction
A single error, even a large one, typically does not trigger a referral. The Revenue Agent is looking for patterns that suggest intent, not accidents. The difference between a 75% civil fraud penalty under IRC Section 6663 and a criminal prosecution under IRC Section 7201 comes down to whether the IRS can prove willful, intentional conduct.
For a broader overview of how the IRS defines and pursues these cases, see our guides on understanding tax fraud and tax evasion.
The Eggshell Audit: The Situation Most People Don’t Know They’re In
Tax attorneys use the term “eggshell audit” for a specific scenario: the taxpayer knows something is wrong with the return, but the Revenue Agent has not discovered it yet.
The taxpayer is walking on eggshells. Every question is a potential trigger. Every document request could be the one that exposes the problem. And the trap is structural: invoking the Fifth Amendment during what is officially still a civil audit is not available as a practical matter. A taxpayer who suddenly stops answering routine audit questions is broadcasting exactly the kind of behavior that accelerates a criminal referral.
Continuing to answer questions carries the opposite risk. Anything said during a civil audit has no privilege protection and can be used directly in a criminal prosecution. There is no Miranda warning and no formal notification that the evidentiary standard has shifted.
A “reverse eggshell audit” adds another layer. This is when IRS-CI is already running a criminal investigation, but the initial contact with the taxpayer is made to appear as a routine civil examination. The taxpayer responds as if they are in a civil audit; the government is building a criminal case. The questions asked, and the documents produced, become evidence.
Both scenarios require an attorney — not a CPA or enrolled agent — to manage every interaction with the IRS. The reason comes down to privilege. Learn why a tax attorney provides protections that other professionals cannot.
Seven Warning Signs the Audit Has Already Shifted
Most people do not recognize the transition until well after it has occurred. These are the signals that a civil audit has moved into criminal territory — or is close to doing so:
| # | Warning Sign | What It Means |
|---|---|---|
| 1 | The audit goes unexpectedly quiet | After a period of active document requests, the examiner stops following up. This silence often means the file has been referred internally and the civil examination is on hold pending a CI decision. |
| 2 | Questions shift from amounts to intent | The examiner stops asking “what is this expense for” and starts asking “who made this decision” and “what were you aware of at the time.” |
| 3 | Questions about cash, bank deposits, or lifestyle | Questions about property purchases, vehicles, vacations, or expenditures relative to reported income are pre-criminal indicators. The IRS uses the net worth method and bank deposit analysis to reconstruct unreported income. |
| 4 | Two agents appear instead of one | A second agent joining the examination — particularly one who is less forthcoming about their role — is a significant red flag. |
| 5 | Third parties are contacted | Banks, business partners, customers, and employees receiving IRS inquiries about your financial activity means the government is building a record beyond what you provided. |
| 6 | Questions about offshore accounts or cryptocurrency | These are specific enforcement priorities for IRS-CI. Questions in this area during a civil examination signal that CI has likely already been consulted. |
| 7 | A Special Agent appears at your door | IRS Special Agents carry badges, firearms, and pocket commissions. A Revenue Agent does not carry a firearm. If someone identifies themselves as an IRS Special Agent, the investigation is no longer civil. |
Recognize any of these signs? Do not wait. Call Cumberland Law Group at (800) 960-5359 — free consultation, available Mon–Sun 9am–9:30pm. The audit interview is the most consequential moment in the process. Learn how to prepare for and survive an IRS audit here.
Why Your CPA Cannot Protect You
This is the fact most people learn too late.
Communications with a CPA, enrolled agent, bookkeeper, or tax preparer carry no attorney-client privilege. None. When IRS-CI launches a criminal investigation, it can subpoena every email, spreadsheet, work paper, and conversation between you and your accountant. Your tax preparer can be called as a witness and compelled to testify about what you told them when preparing the return.
The person who helped you file the return that is now under criminal scrutiny can become a government witness against you. That is not a hypothetical — it is a routine feature of criminal tax prosecutions.
A tax attorney is different. Communications between a client and their attorney are protected by attorney-client privilege. The IRS cannot subpoena those communications. The attorney cannot be compelled to testify about what the client said. That protection exists from the first conversation and covers everything discussed in the attorney’s representation.
There is a structured workaround called the Kovel doctrine, which allows certain accountant communications to receive attorney-client protection, but only when structured properly:
- The engagement originates from the attorney, not directly from the client
- A written Kovel letter designates the accountant as the attorney’s agent
- All information flows through counsel, not directly to the accountant
- The purpose is legal analysis, not routine return preparation
When structured correctly, the accountant’s forensic work, calculations, and communications can be protected. Without that structure, everything the accountant knows becomes available to the government. This is one of the core reasons why hiring a tax attorney versus a CPA produces fundamentally different outcomes once a case has criminal exposure.
The Conviction Rate Context
IRS-CI is the only federal law enforcement agency with jurisdiction over federal tax crimes. Its FY2025 Annual Report put the conviction rate at 89%. In cases where Bank Secrecy Act data was involved, the conviction rate for adjudicated cases ran at 98% over the three-year period from FY2023 to FY2025.
In FY2025, IRS-CI:
- Identified $10.59 billion in financial crimes — a 15.7% increase from the prior year
- Identified $4.5 billion specifically from tax fraud — a 112% increase from FY2024
- Executed 25% more search warrants than the prior year
- Made 14% more prosecution referrals to the DOJ
- Seized $800 million in assets
- Dedicated approximately 64% of all investigative time to tax crimes
These are not numbers from an agency pulling back. The volume, the digital data seizures (2.35 petabytes in FY2025, up nearly 60% from the prior year), and the prosecution referral increases all point in one direction.
Once a case reaches the prosecution stage, an 89% conviction rate means that the IRS-CI process functions as a filter, not a coin flip. Cases that reach indictment have already been vetted extensively. Early intervention — before Form 2797 is filed, before CI opens a subject investigation — produces a fundamentally different set of options than intervention after prosecution has been recommended.
Why Georgia and North Carolina Clients Face Specific Exposure
IRS-CI maintains field offices in both Atlanta and Charlotte. Those offices are not passive. Atlanta-based CI agents were central to prosecuting the Jack Fisher conservation easement fraud scheme, which resulted in a 25-year prison sentence and implicated investors and professionals across Georgia and the Southeast. The Charlotte field office has prosecuted payroll fraud, ERC fraud, and cryptocurrency schemes involving North Carolina business owners.
The FY2025 report flagged three categories of cases where CI expects to increase activity:
- High-dollar payroll and employment tax schemes
- Pandemic-era benefit program fraud (ERC, PPP)
- Digital asset transactions with inconsistent reporting
Georgia and North Carolina business owners who claimed aggressive ERC credits, participated in payroll-adjacent tax arrangements, or have cryptocurrency activity with inconsistent reporting are in the population most likely to see civil audits with criminal referral potential.
High-income professionals in Atlanta, Charlotte, Raleigh, and Durham who were sold syndicated tax arrangements between 2015 and 2022 face an additional layer of exposure. When promoters are prosecuted, investor files frequently get reviewed as part of the CI investigation. An investor who had no intent to defraud may still find themselves in an eggshell audit when CI begins examining the broader transaction.
If you are a Georgia or North Carolina business owner or professional with any of the above exposure, call (800) 960-5359 now for a free consultation with Cumberland Law Group before your situation escalates.
What Acting Immediately Actually Changes
The options available before a Form 2797 referral is filed are materially different from the options available after CI opens a subject investigation.
| Before a Criminal Referral | After CI Opens a Subject Investigation | |
|---|---|---|
| Document control | An attorney can manage what the civil examination produces, controlling the document record and limiting examiner inquiries | The civil audit is suspended; the evidentiary record is already built |
| Privilege | Attorney-client privilege protects the full assessment of exposure from the first conversation | Anything already said to the Revenue Agent is in the evidentiary record with no privilege |
| Voluntary disclosure | Voluntary disclosure programs may remain available in some circumstances, potentially avoiding criminal prosecution | Voluntary disclosure is no longer available once a subject investigation is open |
| Civil penalty track | Resolution through civil penalties and payment — significant financial cost but no prison exposure — remains accessible | Resolution through payment is no longer an option; the case is in criminal hands |
| Third-party exposure | Attorney can advise on limiting what third parties produce before subpoenas issue | Grand jury subpoenas can compel testimony from third parties without the taxpayer’s knowledge |
| Search warrants | No search warrant authority in civil examination | Search warrants can be executed with minimal notice |
| Cooperation options | Full range of resolution paths remain open | Any cooperation arrangements are managed entirely by the DOJ Tax Division on its terms |
Waiting to see how the audit develops before engaging an attorney is the choice that closes the most options. The audit interview is the most consequential moment in the process. What is said in the first two substantive meetings with an IRS examiner shapes the entire downstream case. Read our full guide on IRS audit defense here.
If you have unfiled tax returns or unpaid back taxes that have not yet been discovered, those are additional time-sensitive issues that an attorney needs to assess before the IRS does.
Schedule Your Free Consultation with Cumberland Law Group
If you are currently under audit, if you have received a request that feels unusual, if an IRS agent has contacted your bank or business associates, or if you are aware of something in your returns that has not yet been discovered: the time to act is before the next conversation with the IRS — not after.
Cumberland Law Group represents individuals and business owners in Georgia and North Carolina across the full spectrum of civil and criminal tax matters. That includes audit defense, eggshell audit management, criminal tax referral prevention, voluntary disclosure, and representation before IRS-CI and the DOJ Tax Division.
We offer free consultations. Our offices:
- Atlanta, GA — 400 Galleria Pkwy #1500
- Raleigh, NC — 421 Fayetteville St Suite 1100
- Charlotte, NC — 6201 Fairview Rd Suite 200
- Durham, NC — 555 S. Mangum Street, Suite 100
The moment you suspect your audit has criminal exposure is the moment attorney-client privilege starts mattering. That protection begins with the first call.
Call (800) 960-5359 for a free consultation, or submit your information online and we will call you back.
This article is for informational purposes only and does not constitute legal advice. Contact Cumberland Law Group directly for guidance specific to your situation.