No Arrest, No Scammer’s Real Name: Building a Theft-Loss Evidence File

First published October 6, 2026.

Prepared and research checked October 6, 2026. Editorial series date: October 3, 2026. The series date identifies sequence and does not claim earlier publication.

The short version

An unidentified scammer or lack of an arrest does not automatically prevent a theft-loss deduction. The file must still support theft, transaction purpose, basis, discovery, and recovery facts. Original records and a clear account of missing evidence help a professional evaluate those requirements.

You may have a bank statement, months of messages, and a website that has disappeared. You may have reported the scam without hearing back. You may never learn the name of the person who took your money.

Those gaps do not automatically prevent a federal theft-loss deduction. IRS Publication 547 says a theft conviction is unnecessary. What matters is whether the available facts support the legal requirements for your particular loss. A deduction is not guaranteed, and a report number alone does not establish one. 1

The practical task is to connect each record to a question your tax professional must answer. This article explains how to build that connection without treating every screenshot as proof of everything. The companion worksheet (PDF, 7 pages) provides an annotated record map and a completed fictional example.

Federal tax information reviewed October 6, 2026. Educational information, not a determination that a particular loss qualifies. State law and individual facts require professional review.

What the law actually says (primary authority first)

Start with the questions the records must answer

For an individual considering an investment-related theft loss, the analysis generally covers whether a theft occurred under applicable law, whether the relevant transaction was entered into for profit, the amount supported by tax basis, discovery, and potential reimbursement. Section 165 distinguishes business, profit-seeking, and personal losses. Proving theft does not, by itself, establish the right category or deductible amount. 2

The scam-loss deduction framework provides the eligibility overview; this article focuses on the records supporting each question.

The distinction matters in 2026. Congress removed the previous 2025 sunset of the restriction on personal casualty losses and added certain state-declared disasters for years beginning after 2025. An ordinary personal scam loss does not become deductible merely because the calendar moved into 2026. Narrow exceptions, including personal casualty gains, require separate review. 3

If different transfers had different purposes, record each separately. Describe what you believed each payment would accomplish, including personal assistance, a proposed investment, or a demand to release supposed investment funds. Your professional should evaluate the relevant transactions rather than assign one label to the entire relationship. 4

Start a short index with five headings: taking, purpose, amount, discovery, and recovery. Under each heading, identify what you know, which records support it, and what remains uncertain. You can begin with what you already have. A clear gap is more useful than an unsupported conclusion.

What an unidentified scammer changes

IRS Chief Counsel Advice 202511015 discusses an investment-scam example in which the scammer was never identified or charged. The memorandum nevertheless concludes that the described taxpayer had a deductible theft loss. Its facts included an investment purpose and evidence supporting no reasonable prospect of recovery. 4

That example is helpful context, not a blanket IRS approval of similar-looking claims. Chief Counsel Advice cannot be used or cited as precedent. 5 Your file still needs to establish your facts.

Use accurate labels. Write “person using the name Alex” rather than declaring that Alex was the person’s legal name. Identify a receiving account as the recipient shown on the transfer confirmation, not automatically as the scam organizer. Explain which facts you observed and which someone else reported.

A tax professional may need legal help identifying the applicable theft statute and connecting its elements to the evidence. In an online, multistate, or overseas scheme, the governing law may itself need analysis. The file should preserve the locations and sequence of events without assuming that your home state necessarily resolves every legal question.

How it works in practice

Build a record map instead of a screenshot pile

Assign each item an ID, such as E01 or E02. Preserve the original, then use a separate working copy for highlighting or redaction. In the index, record its date, source, storage location, the question it helps answer, and its limitations.

Use the theft-loss documentation checklist to identify gaps while assembling that index.

The following map is an organizing tool, not an IRS-prescribed checklist.

Add a final column in your own file: “Next question.” For example, E08 may be a bank’s refusal to recall a wire. The next question is whether that response addresses only reversal of the wire or also a separate reimbursement claim. Those are different issues.

If the file is being prepared for an examination, Sheepdog Tax Resolution’s guide to IRS audits of theft-loss deductions covers the related audit-response questions.

Write a chronology that another person can follow

A chronology should explain the story without making the reader open every attachment first. For each event, include the date, what happened, the related amount if any, and the evidence ID. State whether the date comes from a timestamp or your recollection. Preserve time zones when they affect the sequence.

Separate these events:

• First contact and the representations made to you.
• Each transfer, including intermediate accounts or wallets you controlled.
• Any money actually returned.
• Withdrawal attempts and requests for additional payments.
• The event or information through which you discovered the loss.
• Reporting, reimbursement requests, and meaningful responses.

Use plain descriptions: “The withdrawal request failed on May 8; the operator demanded another payment on May 9.” Avoid retroactively rewriting every earlier interaction as something you knew was fraudulent at the time.

If reviewing the messages is difficult, work in short sessions. A trusted helper can assist with organization using copies you choose to share. You do not need a polished narrative before asking for tax help.

Keep the loss amount separate from the advertised balance

Prepare a money trail that begins before funds reached the suspected scheme. Record the asset, quantity, date, cost or other basis information, destination, and supporting evidence. Reconcile it to independent bank or exchange records.

For digital assets, retain acquisition and disposition records as well as transaction details. Tax basis may differ from the asset’s value when transferred. Earlier sales or exchanges may create separate reporting obligations. The IRS’s digital-asset guidance identifies purchase, receipt, disposition, valuation, and basis records as important for reporting. 6

Do not calculate a deduction simply by copying a dashboard balance. Separate actual contributions, actual receipts, displayed gains, fees, and assets still controlled by you. Flag apparent duplicates: a bank transfer to your exchange and a later transfer from that exchange may be two steps involving the same funds, not two losses.

Section 165(b) limits a deductible loss by adjusted basis. 2 If a platform claimed that $40,000 had become $95,000, the extra $55,000 is not automatically part of the loss. Income previously reported, distributions received, and related transactions may complicate the calculation; have your professional reconcile them rather than using a universal “deposits minus withdrawals” formula.

The numbers

Fictional dashboard illustration, taken from the example above. These are display claims, not verified contributions or a deduction.

What this means for you

Record discovery and recovery separately

The theft-loss timing rule starts with the year the loss is discovered, which may differ from the year money was sent. 7 It then requires attention to reimbursement prospects. A claim with a reasonable prospect of recovery can defer the portion to which that claim relates until the uncertainty is resolved with reasonable certainty. This is a facts-and-circumstances inquiry, and different portions may require different treatment. 8

Create a recovery register for each possible source: the recipient, bank, exchange, insurer, litigation, or a receivership. Record the amount at issue, status, dated evidence, and unresolved questions. Include claims that may be viable even if nobody has paid yet.

For a calendar-year taxpayer, prepare a dated assessment of the recovery prospects as of December 31. Record the actual preparation date, and separate year-end facts from later developments. If preparing a prior-year file, do not backdate the memo. Say when you wrote it and identify the earlier documents it relies on.

A bank’s inability to reverse a payment does not necessarily answer whether a different party owes reimbursement. An active investigation does not automatically establish a reasonable prospect of financial recovery, either. Conversely, a receiver holding assets or a meaningful pending claim deserves analysis rather than a blanket statement that “the money is gone.”

No agency response is a mandatory document under the ordinary regulatory rules. But silence is not proof that recovery is hopeless. If you have no response, record that fact and develop the other available evidence. Do not abandon rights or sign a release merely to try to create a deduction. Later recoveries can have tax consequences, so keep the file current after filing. 8

Use reporting records for what they actually show

An IC3 complaint documents what you reported and when. It does not certify the facts or determine tax deductibility.

The IC3 FAQ explains that complaints are reviewed and may be forwarded to appropriate agencies. IC3 does not conduct investigations or provide their status. It also says to save or print the complaint at submission because it will not send you a copy later, and to retain original evidence securely because attachments are not accepted. 9

If you already filed but did not save the complaint, mark the missing copy honestly. Preserve whatever submission information you have and ask your professional how to document the gap. Do not invent a report number, reconstruct a complaint as if it were the original, or describe a report as an agency finding.

The ordinary theft-loss rules and the optional Ponzi-loss safe harbor are different routes. The safe harbor has its own qualifying requirements and specified procedural conditions, including a narrow alternative when a lead figure has died. You should not assume it applies to every investment scam, or import its requirements into every ordinary theft-loss claim. 10

What crypto tracing can and cannot add

IC3 identifies addresses, transaction hashes, asset types, amounts, and timestamps as useful cryptocurrency complaint details. 11 Preserve those records with the chain name and your exchange exports so that a reviewer can connect a transfer to your account and chronology.

A tracing report can help explain movements between addresses. Its conclusions should identify assumptions, attribution methods, and limits. A transfer recorded on a blockchain does not, alone, establish why you sent it, the recipient’s legal identity, criminal intent, your tax basis, or whether reimbursement was realistically available. That is why tracing belongs beside the other records.

Do not send more money to unlock supposed proceeds or accept a recovery promise as evidence of a viable claim. IC3 cautions about cryptocurrency recovery services, especially those seeking upfront fees. 11 Independently verify any professional before sharing records or engaging them.

A privacy-safe file you can keep working on

Before sharing your working packet:

• Keep originals separate from annotated and redacted copies.
• Use a case nickname and evidence IDs in the worksheet.
• Exclude Social Security numbers, full account numbers, passwords, authentication codes, private keys, and seed phrases.
• Treat wallet addresses and transaction histories as sensitive financial context even when visible on a public blockchain.
• Check screenshots for unrelated balances, identity documents, and other people’s information.
• Verify the recipient and the secure method before transferring files; restrict access to what the reviewer needs.
• Keep a dated list of missing records and follow-up questions.

The worksheet is for private organization. It does not require uploading anything, connecting a wallet, or contacting anyone. A reviewer may later need more complete records through an agreed secure process.

A useful evidence file makes the supported facts easy to verify and the uncertainties easy to see. You do not need to identify or arrest the scammer yourself. You do need a coherent record that lets your tax professional evaluate the loss without filling gaps with assumptions.

Related reading

Read the federal scam-loss framework.

Read the theft-loss documentation checklist.

Read the digital-asset scam-loss guide.

How Sheepdog Tax can help

I can review the affected tax years, transaction records, purpose evidence, and recovery correspondence with you. To arrange an initial discussion, contact Noah Green, CPA, CFE. Keep sensitive records private until a verified secure sharing method is agreed. The review depends on your facts and the applicable law; no deduction, refund, or recovery is guaranteed.

This article provides general federal tax information, not individualized tax or legal advice.

Sources (primary authority first, then secondary commentary)

1. IRS Publication 547 (2025), Theft and Proof of Loss. Supports the state-law/criminal-intent framework and absence of a conviction requirement. This is the currently available publication reviewed for this article; check the applicable tax-year instructions.
2. 26 U.S.C. §165(a), (b), (c), (e), and (h). Statutory text reproduced by Cornell LII.
3. Public Law 119-21, §70109. Removes the sunset and modifies the disaster exception for taxable years beginning after December 31, 2025.
4. IRS Chief Counsel Advice 202511015, released March 14, 2025, especially pages 2-4 and 8. Its scenarios concern 2024; historical descriptions of the law should not be treated as current-year summaries.
5. IRS Chief Counsel Advice training materials, discussion of §6110(k)(3) and nonprecedential status.
6. IRS Digital Assets, recordkeeping and basis.
7. Treas. Reg. §1.165-8(a)(2), discovery-year rule.
8. Treas. Reg. §1.165-1(d)(2)-(3), reimbursement prospects, portions of losses, and later recoveries.
9. FBI IC3 Frequently Asked Questions, complaint copies, responses, and evidence retention.
10. Revenue Procedure 2009-20, as modified by Revenue Procedure 2011-58; consult the current requirements before electing the safe harbor.
11. FBI IC3 Cryptocurrency guidance, transaction details and recovery-service caution.

Prepared by Noah Green, CPA, CFE.