Scammed? What current law says about your taxes.

Last reviewed July 30, 2026 · Reviewed by Andrew Gordon, JD, CPA

Whether a scam loss is deductible turns on why you sent the money. If you entered the transaction seeking profit — a fake trading platform, a bogus “safeguard” account — IRS Chief Counsel Advice 202511015 says a theft-loss deduction under section 165(c)(2) survives. Purely personal scams, like romance or ransom schemes, generally get no deduction under current law.

The theft-loss deduction: suspended, now permanently

For decades, taxpayers could generally deduct losses from theft. The Tax Cuts and Jobs Act suspended the personal theft-loss deduction except for losses attributable to federally declared disasters. That suspension was originally scheduled to expire, but the One Big Beautiful Bill Act (P.L. 119-21, signed July 4, 2025) made it permanent.

The rule lives in section 165(h)(5) of the Internal Revenue Code: for tax years beginning after 2017, a personal casualty or theft loss is allowed — apart from a narrow offset against personal casualty gains — only to the extent it is attributable to a federally declared disaster, a category the permanent rule extends to certain state-declared disasters. The IRS’s own summary in Tax Topic 515 puts it plainly: individual taxpayers are allowed a theft-loss deduction “if the theft is attributable to a federally declared disaster.” A scam, by definition, is not.

For most individual victims of a purely personal scam, current law offers no deduction for what was stolen.

The investment-scam distinction

In March 2025, the IRS addressed how these rules apply to scam victims in Chief Counsel Advice 202511015. Its conclusion draws a line based on why the victim entered the transaction. Victims of investment scams — people who put money into what they believed was a profit-seeking venture, like a fake trading platform — may still deduct theft losses under section 165(c)(2), because they entered the transaction with a profit motive. Victims of purely personal scams, such as romance scams with no profit motive, generally get no deduction.

“Theft” itself is not the hard part. The IRS has long defined it broadly — any criminal appropriation of another’s property, “including theft by swindling, false pretenses and any other form of guile” (Rev. Rul. 2009-9), so long as the taking is a crime under state law. What decides the case is motive: why did you authorize the transfer? The CCA works through five common scams, and the pattern is easy to see:

The analysis is heavily fact-dependent: how the scheme was pitched, what the victim believed, and how the money moved all matter. Two victims of similar frauds can end up with different tax outcomes. One footnote in the CCA matters to romance-scam victims in particular: if the “partner” steered you into a fraudulent investment, the analysis follows the investment — not the romance — and the deduction may survive.

The pig-butchering pattern

The most common investment scam today follows a script the IRS itself describes. An unsolicited message advertises a crypto opportunity. The victim deposits a small amount; the account balance climbs; a small withdrawal goes through, proving the platform “works.” Confidence built, the victim deposits far more — often retirement money. When they finally try to cash out, withdrawals fail, “support” goes silent, or the site demands fees and phantom taxes to unlock funds, which only deepen the loss. The name is literal: the scheme fattens the victim with fake returns before the slaughter.

The scale is why this page exists. The FBI’s 2024 Internet Crime Report tallied $16.6 billion in reported losses across all internet crime — up 33 percent in a year — with investment fraud the costliest category at $6.57 billion. Complaints referencing cryptocurrency accounted for $9.3 billion of reported losses, a 66 percent increase, and the largest age group among those victims was 60 and over.

How much is deductible — and when

Three limits shape any deductible scam loss, and each comes straight from the CCA and the regulations it applies:

• Basis, not the balance on the screen. The deduction is limited to what you actually put in. The inflated account value a fake platform displayed was never income to you, so it can never be a loss.
• The year of discovery. Under section 165(e), a theft loss is sustained in the year you discover it — not the year the money left.
• No reasonable prospect of recovery. If a genuine claim for reimbursement is still realistically pending at year end, the loss is not yet deductible. What your bank and law enforcement tell you about recovery is part of the record that fixes the year.

A qualifying loss is reported on Form 4684, Section B, and claimed as an itemized deduction. Under Rev. Rul. 2009-9, an investment theft loss is not subject to the $100-per-event and 10-percent-of-AGI floors that apply to personal casualty losses, and it is not a miscellaneous itemized deduction — so the separate suspension of those deductions does not reach it. One caution: the Ponzi-scheme safe harbor in Rev. Proc. 2009-20 usually does not apply to these scams, because it requires a lead figure who has been criminally charged — and most scam operators are never identified.

The retirement-withdrawal double hit

Many scams direct victims to pull money out of retirement accounts. Under current law, those withdrawals remain taxable income even though the money went to a criminal — and early-withdrawal penalties can apply on top: a 10 percent additional tax under section 72(t) for most distributions before age 59½. There is one meaningful distinction in the case law the CCA collects: courts look at whether the victim authorized or benefited from the withdrawal, and where funds were taken entirely without authorization — a hacked account rather than a coerced instruction — they have declined to treat the distribution as the victim’s income.

Our founder has published one case from his practice that shows the whole mechanism at work: a North Carolina woman drawn into an online “task” platform that paid small amounts at first, then required escalating cryptocurrency deposits to unlock earnings. She emptied a 401(k), took credit card advances, and borrowed personally — more than $110,000 lost. The tax result under the rules on this page: ordinary income tax plus the 10 percent early-withdrawal addition on the 401(k) distribution, owed on money a criminal took (Scammed by the Scammer, Then Billed by the IRS, June 2026).

The custodian will also issue a Form 1099-R for the distribution, and the IRS matches those forms against returns. Leaving a coerced withdrawal off a return does not make it disappear — it invites a CP2000 mismatch notice on top of everything else.

What to document now, regardless

Whatever tax treatment ultimately applies in your case, documentation gathered now is what makes any position — or any future relief — possible later. In order:

1. Report to local law enforcement and keep the report number. A theft loss requires a taking that is criminal under state law; a police report is the cleanest contemporaneous evidence.
2. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Include dates, amounts, wallet addresses, transaction hashes, exchange or bank account numbers, and the platform’s URLs. Speed matters: the IC3’s Recovery Asset Team works with financial institutions to try to freeze fraudulent transfers before funds move on.
3. Report to the Federal Trade Commission at ReportFraud.ftc.gov.
4. Preserve every communication with the scammer — messages, emails, screenshots of the platform or app — before accounts and websites vanish.
5. Keep everything bearing on recovery: written responses from your bank, exchange, or law enforcement saying the funds cannot be recovered. Under the discovery-year rule, that record is what establishes when the loss became deductible at all.

What not to do

• Don’t deduct the dashboard number. The loss is your basis — what you sent, less anything returned — never the fictitious balance.
• Don’t report it as a sale. A scam loss is a theft loss claimed on Form 4684, Section B — not a capital loss from selling an asset. How actual sales are taxed is covered in our 2026 crypto tax rates guide.
• Don’t claim the wrong year. The deduction belongs to the year of discovery with no reasonable prospect of recovery — not automatically the year the money left.
• Don’t assume the Ponzi safe harbor applies. It requires a criminally charged lead figure; anonymous scam operations almost never qualify.
• Don’t go quiet with the IRS. If the scam left withdrawals or dispositions unreported, address it deliberately — our guides on unreported crypto and IRS letters explain the current-law options.
• Don’t pay “recovery” fees. Be skeptical of anyone who contacts you promising to retrieve stolen crypto for an upfront charge — report them through the same channels instead.

Pending legislation

H.R. 9500, the Tax Relief for Fraud Victims Act — introduced by Reps. Miller (R-OH-7) and Suozzi (D-NY-3) on June 29, 2026, and ordered reported by the House Ways and Means Committee by a 39–0 vote on July 1, 2026 — would change this landscape by addressing the tax treatment of scam losses and scam-coerced retirement withdrawals. By its title, the bill would repeal the limitation on deductions for personal casualty losses and provide increased relief for theft losses involving fraud, deceit, or misrepresentation. It is not law; nothing on this page changes unless it passes. Our affiliate has taken a position on the bill; its work is described on its section of this website.

Common questions

This page is educational and does not constitute tax or legal advice for your specific situation. For questions about your own filings, consult a qualified tax professional.