Every year around tax season, the same fear surfaces in conversations across the country: what if I get audited?
For most people, an audit feels like something that happens randomly — a stroke of bad luck, like being struck by lightning. But that’s not how it works. The IRS doesn’t open returns at random and it doesn’t rely on hunches. It uses automated scoring systems that compare your return against statistical norms for taxpayers in similar income brackets, professions, and geographic areas. When your numbers deviate significantly from those norms, your return gets flagged for closer review.
Understanding what causes that deviation is what separates taxpayers who file with confidence from those who file with anxiety.
How the IRS actually selects returns for audit
The primary tool the IRS uses is called the Discriminant Function System, or DIF. Every return that gets processed is assigned a score based on how far it deviates from statistical patterns — income-to-expense ratios, deduction percentages relative to income, credit claims, business loss trends, and alignment with third-party reporting.
A high DIF score doesn’t mean fraud is suspected. It means variance. Returns with high scores may be pulled for review by a human examiner, who then decides whether an audit is warranted. Most high-scoring returns are reviewed and closed without any action.
The key insight is this: the IRS isn’t looking for guilt. It’s looking for inconsistency. When your return matches third-party data and your deductions are proportional to your income, your score stays low and your return passes through without scrutiny.
Unreported income — the most common trigger by far
The single most frequent cause of IRS correspondence and audit selection is income that appears in third-party records but not on your return.
The IRS receives direct copies of every W-2, 1099-NEC, 1099-K, 1099-INT, 1099-DIV, and 1099-B issued under your Social Security number. When its matching system compares those documents against your return and finds a discrepancy, it flags it automatically — no human review required at that stage.
A forgotten 1099-INT from a small savings account. A freelance payment on a 1099-NEC that didn’t make it onto Schedule C. A cryptocurrency transaction reported by an exchange but missing from Form 8949. These aren’t dramatic omissions. They’re the kind of thing that happens when people file from memory rather than from documents.
The IRS doesn’t discover hidden income through investigation. It discovers it through data matching. If a third party reported it, you need to report it — regardless of how small the amount seems.
Disproportionate business deductions
Business deductions are entirely legitimate. The problem arises when the ratio of expenses to income falls far outside the norm for your industry and income level.
A freelance designer reporting $60,000 in revenue and $55,000 in expenses will draw more scrutiny than the same designer reporting $60,000 in revenue and $18,000 in expenses — not because the deductions are necessarily wrong, but because the pattern deviates from what the DIF system expects to see for that type of business.
The solution isn’t to claim fewer deductions. It’s to make sure every deduction is documented well enough to survive a question. Receipts, invoices, bank records, and a clear business purpose for each expense are what separate deductions that hold up from deductions that get disallowed.
Repeated business losses
The tax code allows business losses, but it also requires a genuine profit motive. If a business reports losses year after year — particularly while the owner has substantial W-2 income that those losses are conveniently offsetting — the IRS may eventually question whether the activity qualifies as a business at all, or whether it should be reclassified as a hobby.
Hobby losses are not deductible. The distinction matters.
The IRS looks at factors like whether the activity is conducted in a businesslike manner, whether the taxpayer depends on it for income, and whether there have been any profitable years. Taxpayers who run genuinely unprofitable businesses can defend their position — but they need records that demonstrate real operational effort, not just a Schedule C with expenses attached to a passion project.
Cryptocurrency reporting gaps
Crypto has become one of the fastest-growing audit risk areas, and the IRS has made clear it is paying attention.
Every Form 1040 now includes a question about digital asset activity. Exchanges are required to report transaction data. The IRS has sent thousands of letters to taxpayers whose exchange records don’t match their returns.
The complexity of crypto reporting creates genuine confusion. Every sale, trade, or exchange of cryptocurrency is a taxable event that requires calculating gain or loss based on cost basis. Crypto-to-crypto trades count. Staking rewards count. Mining income counts. Most tax software handles this if you import your transaction history — but many taxpayers don’t, either because they don’t realize it’s required or because the process feels complicated.
Incomplete crypto reporting is one of the clearest signals to the IRS’s matching system that something was missed.
Large charitable contributions relative to income
Charitable deductions are legitimate and the IRS doesn’t discourage generosity. But contributions that represent an unusually high percentage of your income are compared against statistical averages for your income bracket, and significant deviations get flagged.
The documentation requirements for charitable deductions are also specific. Cash contributions over $250 require written acknowledgment from the organization. Non-cash donations over $500 require Form 8283. Donated property valued over $5,000 generally requires a qualified appraisal. Missing any of these doesn’t mean the donation was fraudulent — but it does mean the deduction won’t survive a question.
Investment reporting errors
Capital gains mismatches are a major driver of correspondence audits. When a brokerage reports proceeds from a stock sale and those proceeds don’t appear on your return, or appear with a different figure, the mismatch triggers an automatic notice.
The more nuanced issue involves cost basis. If your basis is overstated — meaning you claim you paid more for an investment than you actually did — your reported gain is understated. The IRS’s matching system can detect this when basis information is available from brokerage records, which is increasingly the case for accounts held since 2011 or later.
Common basis errors include forgetting that reinvested dividends increase your basis, failing to track basis when transferring assets between brokers, and miscalculating the cost of cryptocurrency purchased at different times and prices.
Foreign income and account reporting
U.S. taxpayers are taxed on worldwide income, regardless of where it’s earned or where it’s held. Foreign wages, rental income, dividends from foreign investments, and gains from foreign accounts all need to be reported on a U.S. return.
Beyond income reporting, certain foreign financial accounts may require separate informational filings — the FBAR for accounts exceeding $10,000 at any point during the year, and Form 8938 for higher thresholds under FATCA. The penalties for failing to file these informational returns can be severe even when no additional tax is owed.
Most foreign reporting issues arise from misunderstanding rather than intentional concealment. But the IRS treats informational compliance seriously regardless of intent.
The home office deduction
The home office deduction is legitimate — but it requires that the space be used regularly and exclusively for business. A desk in a corner of the living room where you also watch television doesn’t qualify. A dedicated room used only for work does.
Beyond the exclusivity requirement, the deduction needs to be calculated correctly. Square footage of the home office divided by total square footage of the home determines the percentage you can apply to rent, utilities, and other home expenses. Overstating that percentage or applying it to expenses that don’t qualify is what creates problems.
What doesn’t automatically increase your risk
Some common beliefs about audit triggers don’t hold up. Filing for an extension does not increase audit probability — it simply moves your filing deadline. High income alone isn’t a trigger, though returns above $500,000 and especially above $1 million are audited at higher rates. Claiming legal deductions doesn’t flag your return — poorly documented deductions do. Being self-employed adds complexity, but complexity alone isn’t what drives selection.
The IRS audits deviation, not success. A profitable, well-documented return is far less likely to attract scrutiny than an unprofitable, poorly documented one.
Frequently asked questions
What is the most common audit trigger? Unreported income from third-party forms — W-2s, 1099s, and brokerage statements that don’t match what’s on the return.
Does being self-employed automatically increase audit risk? Self-employment adds complexity and means more self-reported deductions, which can increase statistical variance. But good documentation and consistent reporting minimize the risk significantly.
Do repeated business losses guarantee an audit? Not automatically. But losses that persist year after year without evidence of a profit motive increase the probability of scrutiny, particularly when they offset significant W-2 income.
Does filing an extension increase audit risk? No. An extension simply moves your filing deadline. It has no effect on audit selection.
How does the IRS know about cryptocurrency transactions? Exchanges report transaction data directly to the IRS. The agency also uses blockchain analytics to identify transactions not reported through exchanges.
The pattern behind most audit triggers
After reviewing years of IRS compliance cases, the pattern is consistent. The returns that attract scrutiny are almost never the ones with the highest income or the most aggressive tax planning. They’re the ones where income doesn’t match third-party records, where deductions are disproportionate to revenue, where documentation is thin, or where year-over-year patterns are erratic and unexplained.
Daniel, a freelance videographer in Colorado, received a CP2000 after his first full year of self-employment. He’d forgotten to include a $3,200 payment from a client who’d issued a 1099-NEC. He’d reported everything else correctly. The notice proposed additional tax of $720. He responded with his records, confirmed the income had genuinely been omitted, paid the adjustment, and that was the end of it.
The IRS wasn’t targeting Daniel. Its system found a number that didn’t match and generated a notice. That’s the whole story behind most audit triggers — not suspicion, not investigation, just data that doesn’t align.
Keep your numbers consistent, document your deductions, and report everything that was reported to the IRS under your Social Security number. That’s not a guarantee against scrutiny, but it’s the closest thing to one that exists.