The short answer is that an IRS account can be credited for a payment before the underlying payment has been conclusively settled by the financial system. If that credit makes the tax account appear overpaid, the IRS can generate a refund. In a separate investigation, the Treasury Inspector General for Tax Administration documented cases in which that happened before the IRS learned that the original payment had been dishonored.
That explains how the seemingly impossible sequence—bad payment in, real government money out—can occur.
But there is an important limitation.
Federal prosecutors allege that Andrea Shannon, Kent Shannon, Monika Skinger, Sherita Chandler, Saule Moshkanova, Tiffany Nichols and Stacey Rice participated in a scheme that claimed more than $57 million in fraudulent tax refunds and actually received more than $8 million. Prosecutors say they used false individual and trust tax returns plus fictitious financial instruments to make it appear taxes had been paid. (Department of Justice)
The public record does not establish that this group exploited the exact dishonored-payment timing flaw TIGTA documented.
That distinction matters. TIGTA proves the general IRS vulnerability was real. It does not prove how each alleged transaction in this criminal case worked.
What prosecutors actually allege happened
The current case is United States v. Shannon et al., a federal prosecution in Idaho.
According to the superseding-indictment announcement released by the Justice Department on September 3, 2026, the seven defendants and unidentified conspirators allegedly worked together during 2023 and 2024 to prepare and submit false individual and trust tax returns and fictitious financial instruments.
DOJ says the alleged refund claims totaled more than $57 million and that the conspirators received more than $8 million from the IRS. The charges remain allegations, and the defendants are presumed innocent unless proven guilty. (Department of Justice)
The original 2025 charging announcement provides a more useful description of the alleged financial instruments. Prosecutors said the defendants and others sent more than 100 fictitious instruments, including examples described as “checks, money orders, or payment vouchers,” totaling approximately $57 million.
Their alleged purpose was particularly important: DOJ says the instruments were intended to make it appear that taxes had been paid and therefore could be refunded. (Department of Justice)
| Number | What it represents |
|---|---|
| More than 100 | Fictitious financial instruments alleged by prosecutors |
| More than $57 million | Total fraudulent refunds allegedly claimed |
| More than $8 million | Money DOJ says the alleged conspirators actually received |
That means this was not merely a case in which fantastical refund claims were immediately rejected. According to the indictment as summarized by DOJ, real federal money was paid.
The unanswered question is why.
How can a fake payment create a real IRS refund?
The key is to separate payment posting from final payment settlement.
Those are not necessarily the same event.
TIGTA’s 2025 investigation explains that when the IRS receives a payment, information including the payment amount, tax period and date received is entered into the taxpayer’s tax account. The IRS also deposits the underlying payment through the financial system.
Sometimes that underlying payment cannot actually be collected. TIGTA describes paper checks returned unpaid and electronic payments rejected by financial institutions as dishonored payments. (Oversight.gov)
The problem TIGTA documented was that, under certain circumstances, the IRS account could move ahead before the bad-payment information caught up.
1. The IRS posts the payment to the tax account
Suppose a taxpayer’s account shows $10,000 owed.
A purported $100,000 payment is processed and posted.
For accounting purposes, the account can now appear to contain $90,000 more than is required to satisfy the liability.
2. The account appears overpaid
TIGTA defines an overpayment as a situation in which the taxpayer’s payment exceeds the amount owed.
Normally, that is unremarkable. Legitimate taxpayers overpay for many reasons and are entitled to refunds.
The problem arises when the credit producing the apparent overpayment came from money that the government has not actually succeeded in collecting.
3. The IRS generates a refund transaction
TIGTA explains that the IRS generates a refund transaction on the tax account. That transaction must post to the IRS Master File before a request to issue the refund is sent onward. (Oversight.gov)
The IRS Internal Revenue Manual identifies Transaction Code 846, or TC 846, as a refund transaction in these account-processing procedures. Current IRS procedures specifically contain systemic holds designed to prevent TC 846 from generating under certain overpayment conditions until a waiting period expires. (IRS)
4. Treasury sends actual money
The IRS authorizes the refund, but the Treasury Department’s Bureau of the Fiscal Service handles the actual federal disbursement. Treasury says its Kansas City Regional Financial Center disburses IRS tax-refund direct deposits on the IRS’s behalf. (Bureau of the Fiscal Service)
So the money flow can look like this:
Payment submitted → IRS posts payment credit → Tax account appears overpaid → Refund transaction generated → Treasury sends real money → Original payment later fails
That final sequence is not hypothetical. TIGTA documented it.
Important: this is the TIGTA failure mode, not a proven chronology of the Shannon case
There is currently no public IRS account transcript showing that one of the defendants’ alleged instruments posted, generated a refund, and was subsequently reversed in precisely that order.
TIGTA found the IRS could issue the refund before learning the payment was bad
TIGTA’s investigation covered dishonored subsequent payments posted from January 1, 2023 through March 28, 2024.
A subsequent payment, in this context, means a payment made after a tax return had already been filed but the liability had not been fully paid.
During the period examined, TIGTA found that the IRS processed more than 1.5 million dishonored checks submitted as subsequent payments, totaling nearly $4.7 billion. That does not mean $4.7 billion was fraudulent. A payment can fail for innocent reasons, including insufficient funds. (Oversight.gov)
What caught the inspector general’s attention was what sometimes happened after those payments posted.
TIGTA identified 7,765 individual taxpayers whose accounts may have generated approximately $43.7 million in erroneous refunds associated with dishonored payments.
When IRS officials examined 20 of those accounts, they concluded that taxpayers could potentially benefit because of a timing problem: the system generated the refund before the IRS received notice that the underlying payment had been dishonored. (Oversight.gov)
That is the strongest evidence explaining how the core mechanism can work.
Why the timing mattered
A paper check does not necessarily fail instantly.
TIGTA found a significant delay could exist between the IRS receiving and posting a payment and the agency receiving information that the payment had failed.
That creates a dangerous sequence:
IRS tax-account credit first; payment failure information later.
If an apparent overpayment reaches the refund process during that interval, the government can begin refunding money based partly on a credit that will eventually disappear.
This is why a fictitious or worthless payment does not need to somehow become “real money” itself.
It only needs—at least in the documented TIGTA scenario—to temporarily become a valid-looking credit inside the IRS accounting system long enough for that credit to affect refund processing.
No, TIGTA did not prove the IRS paid out $43.7 million
This number needs careful treatment.
TIGTA said the 7,765 taxpayers may have received approximately $43.7 million in erroneous refunds. But the report’s methodology contains an important qualification: investigators identified tax accounts where a refund had been generated after a dishonored payment created an overpayment.
They did not determine that every generated refund was actually issued to the taxpayer. (Oversight.gov)
The report also says there was not a direct one-to-one relationship between the amount of a dishonored payment and the resulting refund because the account’s existing balance influenced how much would be refundable.
The accurate takeaway is therefore:
TIGTA identified about $43.7 million in potentially erroneous refund transactions associated with dishonored payments—not $43.7 million conclusively stolen or even necessarily disbursed.
That distinction becomes even clearer from the IRS’s own review.
The agency examined another 20 accounts to see whether other controls had prevented money from actually leaving the government. In some cases, the IRS stopped the refund before it was sent; in others, taxpayers returned refund checks uncashed.
TIGTA verified those results. IRS management also said some cases likely resulted from ordinary taxpayer mistakes rather than fraud. (Oversight.gov)
There was therefore disagreement over the size of the potential loss.
There was considerably less disagreement over the underlying weakness: a refund could get ahead of notification that the payment creating the apparent overpayment had failed.
Did the $57 million alleged scheme exploit this exact IRS flaw?
We do not know from the public record.
There are several reasons the TIGTA report is highly relevant.
First, the periods overlap. The criminal conspiracy allegedly operated during 2023 and 2024, while TIGTA examined payments posted from January 2023 through March 2024. (Department of Justice)
Second, both involve the same general accounting concept: a payment credit can affect whether a tax account appears to contain a refundable overpayment.
Third, DOJ specifically says checks were among the types of fictitious instruments allegedly submitted.
But important differences remain.
| What is established | What is not established |
|---|---|
| DOJ alleges fictitious instruments were used to make taxes appear paid and refundable. | DOJ has not publicly said all those instruments entered normal bank clearing and were later dishonored. |
| TIGTA independently proved refunds could be generated before notice of a dishonored payment arrived. | No public account transcript links an alleged Shannon-case payment to that exact sequence. |
| The alleged conduct occurred during the period when TIGTA found the control weakness. | Timing overlap does not prove the defendants knew about or deliberately exploited that flaw. |
| Checks were one type of alleged instrument. | The more than 100 instruments were not all necessarily checks. |
| DOJ alleges more than $8 million was actually received. | Current public summaries do not explain the processing history of each successful refund. |
The strongest defensible conclusion is therefore:
TIGTA proves that the IRS had a real mechanism capable of turning an ultimately bad payment into an actual refund. DOJ alleges that this group used fictitious payments to obtain actual refunds. The available evidence does not prove that those two facts describe the same technical pathway.
“Fictitious” does not necessarily mean “dishonored”
This distinction is easy to lose.
The Justice Department describes the alleged instruments as fictitious financial instruments.
TIGTA studied dishonored payments.
Those terms can overlap, but they are not interchangeable.
The current IRS Internal Revenue Manual defines a dishonored check as a check returned unpaid by a bank. Its Dishonored Check File contains remittances returned by Treasury depositaries after payment was refused. The manual explicitly requires IRS managers to ensure that erroneous refunds caused by dishonored checks are identified and stopped. (IRS)
A fictitious check drawn on a nonexistent or unusable source might eventually become a dishonored payment.
But another fabricated instrument might be rejected differently or never follow that ordinary clearing path at all.
Until court records or IRS account data identify what happened to the instruments in this case, it would be an unsupported leap to write that the defendants simply “sent bad checks, waited for refunds, and then let the checks bounce.”
What did prosecutors mean by “payment vouchers”?
DOJ’s 2025 announcement says the alleged instruments included examples such as “checks, money orders, or payment vouchers.” (Department of Justice)
That wording should not be interpreted to mean an ordinary IRS payment voucher is itself money.
For example, Form 1040-V is simply a statement an individual sends with a check or money order for a balance due. The IRS’s current description explicitly calls it a statement accompanying payment. (IRS)
The public charging summaries do not explain exactly what the alleged “payment vouchers” were, how they were formatted or how the IRS processed them.
So there is not enough evidence to conclude that someone could simply mail an ordinary Form 1040-V with an invented number on it and have the IRS treat the form itself as cash.
Why was more than $57 million claimed but only $8 million received?
This is one of the biggest unanswered questions in the case.
DOJ says the alleged conspirators claimed refunds totaling more than $57 million but received more than $8 million.
The public charging summaries do not explain:
- how many refund requests succeeded;
- how many were stopped;
- which instruments produced account credits;
- whether some payments were rejected before a refund could generate;
- whether fraud controls blocked certain returns;
- which defendants received which amounts;
- or why particular claims succeeded while others did not.
It would be tempting to say that IRS controls caught roughly $49 million of the scheme.
The available evidence does not support that conclusion.
The figures are approximate, and the current public materials do not provide a one-to-one transaction ledger linking each alleged instrument to a refund claim and outcome.
The IRS has since added stronger refund holds
The TIGTA report did not end with a diagnosis.
The inspector general recommended that the IRS delay qualifying refunds for two processing cycles to give financial institutions more time to report dishonored payments. IRS management agreed, and Oversight.gov now lists the recommendation as closed. (Oversight.gov)
Current IRS procedures also show systemic refund holds under specific overpayment conditions.
As of the IRS Internal Revenue Manual revision transmitted in August 2026, when a payment is more than $50 and exceeds the balance due—or where duplicate payments of the same amount would cause the second to be refunded—the account receives:
- a two-weekly-cycle hold for electronic payments; or
- a four-weekly-cycle hold for paper checks.
The manual says the refund transaction is prevented from generating until the applicable hold expires. (IRS)
That is important for two reasons.
First, it would be misleading to describe TIGTA’s 2023–24 control weakness as though nothing changed afterward.
Second, the newer safeguards do not prove every possible variation of a fictitious-payment refund scheme is now impossible.
The public record does not establish whether those particular controls would have defeated every transaction alleged in the Shannon case.
What we know, what is alleged and what remains unproven
Verified independently
- IRS payment information can post to a tax account before the agency learns that the underlying payment was dishonored.
- TIGTA documented cases in which refund generation preceded notice of a dishonored payment.
- TIGTA identified 7,765 accounts associated with approximately $43.7 million in potentially erroneous refund transactions during its review period.
- Current IRS procedures contain systemic refund holds designed to give certain payments additional time before a refund transaction generates.
- Treasury’s Bureau of the Fiscal Service disburses IRS tax refunds on behalf of the IRS. (Oversight.gov)
Alleged by federal prosecutors
- Seven currently charged defendants participated in the conspiracy.
- False individual and trust returns were submitted.
- More than 100 fictitious financial instruments were used.
- Those instruments were designed to make taxes appear paid and refundable.
- More than $57 million was claimed.
- More than $8 million was actually received from the IRS. (Department of Justice)
Not established by the public evidence
- That every alleged instrument was a check.
- That the alleged instruments all entered normal bank clearing.
- That they were refunded before subsequently “bouncing.”
- That the defendants knew of or deliberately targeted TIGTA’s specific timing flaw.
- That the TIGTA vulnerability explains every dollar of the alleged $8 million received.
- That today’s refund-hold rules would necessarily have prevented this alleged scheme.
Those unanswered points are not minor technicalities. They determine whether this case can accurately be described as an exploitation of a known IRS timing flaw rather than a different failure that happened to produce a similar result.
Frequently asked questions
Did the IRS really pay out more than $8 million?
Federal prosecutors allege that it did. DOJ says the conspirators received more than $8 million from the IRS. Because the case is pending, that remains an allegation rather than a judicial finding. (Department of Justice)
Were there really $57 million in fake checks?
Not necessarily. DOJ describes more than 100 fictitious financial instruments totaling approximately or more than $57 million, including examples such as checks, money orders and payment vouchers. Calling the entire amount “fake checks” is too narrow. (Department of Justice)
Does the IRS credit a check before it clears?
TIGTA documented circumstances in which the IRS posted payment information to a taxpayer’s account and generated a refund before receiving notice that the payment had been dishonored. That does not mean every check or every type of payment is treated identically. (Oversight.gov)
Did TIGTA say $43.7 million was stolen?
No. TIGTA identified approximately $43.7 million in potentially erroneous refunds associated with the accounts it analyzed. Its methodology did not determine that every generated refund was actually paid to a taxpayer.
Did these defendants use the loophole TIGTA found?
That has not been established publicly. The TIGTA findings demonstrate that such a timing failure existed, but the publicly available criminal-case summaries do not provide the account-level chronology needed to connect the alleged instruments to that exact defect.
Is the IRS still vulnerable in the same way today?
The specific weakness identified by TIGTA prompted a recommendation for delayed refund processing, that recommendation is now marked closed, and current IRS procedures contain two- and four-cycle refund holds for certain excess-payment situations. It would therefore be inaccurate to assume the 2023–24 system remains unchanged. (Oversight.gov)
Who actually sends an IRS refund?
The refund is authorized through IRS processing, while the Treasury Department’s Bureau of the Fiscal Service handles the federal disbursement. (Bureau of the Fiscal Service)
The bottom line
The strange part of the $57 million refund case is not simply that prosecutors say people submitted bogus financial documents.
It is that more than $8 million in actual government money allegedly came back out.
There is now a documented technical explanation for how that type of outcome can occur: the IRS can post a payment credit before receiving definitive information that the underlying payment failed. If the credit produces an apparent overpayment, refund processing can begin before the account is corrected. TIGTA found that this happened and that the timing gap created a genuine risk of fraud and erroneous refunds. (Oversight.gov)
But evidence discipline matters just as much as explaining the vulnerability.
The Shannon prosecution has not publicly established that its allegedly fictitious instruments followed that exact sequence. Until the underlying account records or more detailed court filings show instrument → account credit → refund → payment reversal, the TIGTA flaw should be described as a proven explanation for how such a system failure can happen—not as a proven description of how these defendants allegedly obtained their refunds.
That is the line the available evidence supports.
References and Further Reading
Criminal case and charging allegations
Justice Department — Seven Charged in $57M Tax Refund Fraud Scheme (Sept. 3, 2026) The current DOJ announcement describing the superseding indictment, seven defendants, more than $57 million in alleged refund claims and more than $8 million allegedly received.
Justice Department — Idaho Husband and Wife and Three Others Charged with Conspiracy to Commit Wire Fraud and Related Charges (Sept. 16, 2025) The original charging announcement. It provides the clearest public description of the alleged instruments as checks, money orders or payment vouchers intended to make taxes appear paid and refundable.
IRS Criminal Investigation — Original 2025 Shannon Case Announcement IRS-CI’s authoritative summary of the original indictment and alleged tax-refund method.
IRS refund vulnerability and controls
TIGTA — A Computer Programming Change Is Needed to Delay the Erroneous Issuance of Refunds Based on Dishonored Checks The central technical source. TIGTA documents how payment credits, overpayments, dishonor notifications and refunds could become misaligned.
Oversight.gov — TIGTA Recommendation 2025-IE-R008-1 Shows the recommendation to delay refunds for two processing cycles and its current closed status.
IRS Internal Revenue Manual 21.5.6 — Freeze Codes and Refund Holds Current IRS procedures, revised in August 2026, including systemic refund holds for certain excess-payment situations.
IRS Internal Revenue Manual 3.17.10 — Dishonored Check File and Unidentified Remittance File Defines dishonored checks and describes IRS procedures for identifying and stopping erroneous refunds associated with them.
Payment and refund mechanics
Treasury Bureau of the Fiscal Service — Tax Refund Frequently Asked Questions Confirms the Bureau of the Fiscal Service’s role in disbursing IRS tax refunds.
IRS — About Form 1040-V, Payment Voucher for Individuals Useful for distinguishing an ordinary payment voucher from the actual check or money order it accompanies.
Editorial currency note: This article reflects charging allegations and IRS procedures available as of September 4, 2026. The criminal case is ongoing, and both the charges and IRS processing rules may change. Later indictments, plea agreements, trial evidence or IRS account records could establish more precisely how the alleged refunds were generated.