Is Identity Theft Protection Tax Deductible? IRS Standards, Tax Code Sections & Recent Guidance

Personal identity theft protection expenses are generally not tax deductible. The IRS classifies identity theft protection services as personal expenses that cannot be deducted on individual tax returns. However, businesses can deduct identity theft protection costs as ordinary and necessary business expenses under IRC Section 162, and the value of employer-provided identity theft protection services is non-taxable to employees under IRS Announcements 2015-22 and 2016-02.

Understanding identity theft protection tax treatment matters because over 1.13 million identity theft reports occurred in 2024, and knowing whether you can deduct protection costs affects your tax planning and financial decisions.

Tax Basis for Deducting Identity Theft Protection Expenses

The tax treatment of identity theft protection depends entirely on whether the expense is personal or business-related.

IRC Section 162(a) allows deductions for “all the ordinary and necessary expenses paid or incurred during the taxable year in carrying on any trade or business.” An expense qualifies as “ordinary” when it is customary or usual in a particular type of business, and “necessary” means appropriate and helpful for developing the business.

Personal expenses, by contrast, are not deductible. Under the Tax Cuts and Jobs Act (TCJA), miscellaneous itemized deductions, including expenses related to identity theft protection, were eliminated through 2025 under IRC Section 67(g).

Is Personal Identity Theft Protection Tax Deductible?

Identity theft protection services purchased for personal use are not tax deductible because the IRS classifies them as personal expenses.

Even if identity theft protection services could theoretically qualify under IRC Section 212 for expenses related to producing income or managing investments, the TCJA eliminated such miscellaneous itemized deductions for tax years 2018 through 2025.

Non-Deductible Personal Identity Theft Protection Expenses Include:

• Credit monitoring subscriptions for personal accounts
• Identity theft insurance policies for personal protection
• Identity restoration services for personal identity theft
• Dark web monitoring for personal information
• Credit freeze fees and credit report costs
• Personal fraud alerts and identity protection apps

Is Business Identity Theft Protection Tax Deductible?

Businesses can deduct identity theft protection costs as ordinary and necessary business expenses. IRC Section 162 permits deductions for expenses paid or incurred in carrying on any trade or business, including security measures to protect business information and customer data.

Deductible Business Identity Theft Protection Expenses Include:

• Employee benefit programs providing identity theft protection
• Credit monitoring services for business accounts
• Cybersecurity software and fraud detection systems
• Identity protection services for customers after data breaches
• Business-related identity theft insurance
• Security measures to comply with data protection regulations

To qualify for deduction, the expense must be ordinary (normal and common in the business community), necessary (appropriate and helpful for the business), and actually used for business purposes.

IRS Announcements 2015-22 and 2016-02: Non-Taxable Employee Benefits

In August 2015, the IRS issued Announcement 2015-22, stating that individuals whose personal information may have been compromised in a data breach do not need to include the value of identity protection services in gross income.

Following public comments, the IRS expanded this guidance in Announcement 2016-02 (December 2015), extending non-taxable treatment to identity protection services provided proactively before a data breach occurs.

Key Points of IRS Guidance:

• Employers providing identity protection services to employees do not need to include the value in employees’ gross income or wages
• The value of services does not need to be reported on Form W-2 or Form 1099-MISC
• Identity protection services include credit reporting and monitoring services, identity theft insurance policies, identity restoration services, or similar services
• Cash payments to employees in lieu of identity protection services are taxable and must be included in gross income
• Proceeds received under an identity theft insurance policy are governed by existing insurance tax provisions, not this announcement

Tax Code Sections Governing Identity Theft Protection Deductibility

IRC Section 162: Business Expense Deductions

IRC Section 162(a) allows deductions for ordinary and necessary expenses paid or incurred during the taxable year in carrying on any trade or business.

The Supreme Court held in Welch v. Helvering that “ordinary” means customary or usual in a particular business, while “necessary” means appropriate and helpful, though not essential.

For businesses, identity theft protection expenses qualify when they:

• Protect business information and customer data
• Comply with legal security obligations
• Prevent business losses from identity theft and fraud
• Safeguard business reputation
• Support ordinary business operations

IRC Section 67: Suspended Miscellaneous Itemized Deductions

IRC Section 67(g), enacted through the Tax Cuts and Jobs Act, disallows miscellaneous itemized deductions subject to the 2% floor through 2025.

This suspension eliminates personal deductions for:

• Investment-related expenses
• Tax preparation fees
• Safe deposit box fees
• Professional dues and subscriptions
• Identity theft protection services for personal use

IRC Section 165: Casualty and Theft Losses

While IRC Section 165 allows deductions for casualty and theft losses, the TCJA requires such losses to be “attributable” to a federally declared disaster for tax years 2018 through 2025.

Because federally declared disasters do not give direct rise to data breaches and identity thefts, individual taxpayers cannot currently deduct identity theft losses or related protection expenses under this provision.

Documentation Requirements for Business Deductions

Taxpayers bear the burden of substantiating not only the amount of the deduction but also that the purpose underlying the deduction is ordinary and necessary to operating their trade or business.

Required Documentation:

• Receipts and invoices for identity theft protection services
• Business purpose documentation showing how services protect business operations
• Employment agreements or benefit plan documents for employee services
• Records showing services provided to employees or customers
• Data breach response plans and security policies
• Compliance documentation with data protection regulations
• Written agreements with identity theft protection service providers

Which Tax Forms to Use for Identity Theft Protection Deductions

For Businesses

Schedule C (Form 1040) — Sole proprietors deduct identity theft protection expenses on Schedule C, Line 14 (Employee benefit programs) or Line 26 (Other expenses).

Form 1065 — Partnerships report identity theft protection expenses as employee benefits or other business expenses.

Form 1120/1120-S — Corporations deduct these expenses as employee benefit programs or security expenses.

For Employees Receiving Services

Employees receiving identity theft protection services from employers do not report the value on their tax returns or Form W-2.

Recent IRS Guidance Updates (2024-2025)

The IRS expanded non-taxable treatment to identity theft protection regardless of whether it’s provided by an employer to employees or by a business to customers, and regardless of whether a data breach has occurred.

The IRS clarified that this tax-deductibility does not apply to cash compensation received for identity protection services or proceeds received under an identity theft insurance policy.

Recent developments affecting identity theft protection tax treatment:

• Continued expansion of employer-provided cybersecurity benefits
• Growing recognition of identity theft protection as standard employee benefit
• Increased IRS scrutiny of personal vs. business expense classifications
• Enhanced documentation requirements for business deductions

Tax Treatment by Expense Category

Credit Monitoring Services

Personal: Not deductible Business: Deductible as security expense or employee benefit under IRC Section 162

Identity Theft Insurance

The value of employer-provided identity theft insurance is non-taxable to employees, but insurance proceeds are subject to existing insurance tax provisions.

Personal premiums: Not deductible Business premiums: Deductible under IRC Section 162

Identity Restoration Services

Personal: Not deductible Business: Deductible when provided to employees or customers

Dark Web Monitoring

Personal: Not deductible Business: Deductible as cybersecurity expense

Statute of Limitations for Identity Theft Protection Deductions

Business taxpayers must claim identity theft protection expense deductions within the standard statute of limitations:

• General rule: 3 years from the tax return due date or filing date, whichever is later
• Substantial understatement: 6 years if gross income is understated by more than 25%
• Fraud or no return filed: No statute of limitations

Amended returns claiming additional deductions must be filed within these timeframes.

Common Misconceptions About Identity Theft Protection Tax Deductibility

Misconception: All identity theft protection is tax deductible. Reality: Only business-related identity theft protection expenses qualify for deduction; personal expenses are not deductible.

Misconception: Identity theft victims can deduct protection costs as casualty losses. Reality: The TCJA requires casualty losses to be attributable to federally declared disasters through 2025, eliminating most identity theft loss deductions.

Misconception: Employees must pay taxes on employer-provided identity theft protection. Reality: IRS Announcements 2015-22 and 2016-02 classify employer-provided identity theft protection as non-taxable, non-reportable benefits.

Misconception: Identity theft insurance proceeds are always tax-free. Reality: Insurance proceeds are governed by existing insurance tax provisions, not the identity theft protection guidance.

Practical Guidance for Claiming Identity Theft Protection Deductions

For Business Owners

Establish clear business purpose: Document how identity theft protection services protect business operations, customer data, or employee information.

Maintain detailed records: Keep receipts, service agreements, and business purpose justifications for all identity theft protection expenses.

Separate personal and business expenses: If using services for both personal and business purposes, allocate expenses appropriately and only deduct the business portion.

Consider offering as employee benefit: Providing identity theft protection to employees creates a deductible business expense while offering non-taxable benefit to employees.

For Employees

Understand non-taxable benefits: Employer-provided identity theft protection does not need to be reported as income.

Keep documentation: Maintain records of employer-provided services in case of IRS inquiries.

Don’t claim personal deductions: Personal identity theft protection expenses cannot be deducted on individual tax returns through 2025.

Comparison: Business vs. Personal Identity Theft Protection Tax Treatment

Related Resources and Legal Considerations

Understanding identity theft protection tax treatment requires knowledge of broader consumer protection laws and identity theft liability standards. For comprehensive information on identity theft legal issues, see our guides on:

• Consumer Protection Attorney Who Handles Identity Theft Cases — Learn about legal recourse when identity theft occurs
• Texas Identity Theft Enforcement and Protection Act — State-specific identity theft protections
• Should I Hire a Lawyer for Identity Theft? — When legal representation becomes necessary

Frequently Asked Questions

Is identity theft protection tax deductible?

Personal identity theft protection expenses are not tax deductible. The IRS classifies personal identity theft protection as a non-deductible personal expense, and the Tax Cuts and Jobs Act suspended miscellaneous itemized deductions through 2025. However, businesses can deduct identity theft protection costs as ordinary and necessary business expenses under IRC Section 162.

Can I deduct identity theft protection on my personal tax return?

No. Personal identity theft protection expenses cannot be deducted on individual tax returns through 2025 due to the Tax Cuts and Jobs Act’s suspension of miscellaneous itemized deductions under IRC Section 67(g). This applies to credit monitoring, identity theft insurance, and restoration services purchased for personal use.

What IRS standards apply to business identity theft protection deductions?

Businesses must satisfy IRC Section 162 requirements: the expense must be ordinary (customary in the business community), necessary (appropriate and helpful for the business), paid or incurred during the taxable year, and actually used for business purposes. Businesses must maintain documentation showing the business purpose and substantiate the amount deducted.

Is employer-provided identity theft protection taxable to employees?

No. IRS Announcements 2015-22 and 2016-02 established that employer-provided identity theft protection services are non-taxable, non-reportable benefits regardless of whether a data breach has occurred. The value does not need to be reported on Form W-2 or Form 1099-MISC. However, cash payments to employees in lieu of services are taxable.

What documentation do I need to deduct business identity theft protection expenses?

Businesses need receipts and invoices for services, business purpose documentation showing how services protect business operations, employment agreements or benefit plan documents for employee services, records showing services provided to employees or customers, and compliance documentation with data protection regulations.

Can I deduct identity theft protection as a casualty loss?

No. The Tax Cuts and Jobs Act requires casualty and theft losses under IRC Section 165 to be “attributable” to a federally declared disaster for tax years 2018 through 2025. Because data breaches and identity thefts are not federally declared disasters, individual taxpayers cannot deduct identity theft losses or related protection expenses.

Which tax form should I use to claim business identity theft protection deductions?

Sole proprietors use Schedule C (Form 1040), Line 14 for employee benefit programs or Line 26 for other expenses. Partnerships use Form 1065, and corporations use Form 1120 or 1120-S. The specific line item depends on whether the expense is classified as an employee benefit, security expense, or other business expense.

Disclaimer: This information is for educational purposes only and does not constitute tax or legal advice. Identity theft protection tax deductibility varies by individual circumstances, applicable tax laws, and IRS regulations. Consult official IRS resources, IRS publications, or a qualified tax professional for specific guidance regarding your situation and potential tax deductions.

About the Author

Sarah Klein, JD, is a former consumer rights attorney who spent years helping clients with issues like unfair billing, product disputes, and debt collection practices. At All About Lawyer, she simplifies consumer protection laws so readers can defend their rights and resolve problems with confidence.
Read more about Sarah