A 2017 tax law is hurting cybercrime victims — now Congress wants to make it permanent  

The 2017 Tax Cuts and Jobs Act (TCJA) punishes victims of cybercrime. As Congress returns for its 2024 session, these unintended consequences need to be addressed in the pending tax cut extension bills. 

The Washington Post recently reported on the effects of current U.S. tax policy on victims of cybercrimes. In one case, the victim faced a six-figure tax bill for withdrawals from her retirement account stolen by scammers. In another, the victim had to take out a home mortgage to cover taxes on retirement withdrawals and other financial transactions. 

I was a victim of a similar scam and lost over 10 percent of my net worth. My insurance covered only $200 of my loss. Fortunately, my retirement funds are not affected, but I face tax liability on the sale of other investments done to raise cash that the scammers immediately took. 

These cybercrimes are especially pernicious. They not only psychologically coerce people to part with their life savings, they also leave the victims feeling ashamed, guilty and stupid. I had to consult with a psychologist to help me understand how this could have happened to me. Current U.S. tax policy heaps on anxiety, fear and depression. Scam victims must pay taxes on the funds they removed from retirement accounts and on other trades made to raise cash that was effectively stolen at the time of the transaction. This tax provision is not neutral; its effect is to punish victims for their losses.  

Cybercrimes are different from other causality losses like fire or a tree falling through your roof. They involve taxable financial transactions, which Congress recognized in the TCJA by allowing deductions for losses in Ponzi-type thefts. But ordinary cybercrime victims cannot even deduct losses enough to offset the tax liabilities incurred in the scams. 

Before 2017, cybercrime scam losses would have been deductible from federal income taxes as casualty losses. But Section 11044(1) of the TCJA eliminated all deductions for casualty losses for tax years 2018-2025.  

The Washington Post reports that all casualty loss deductions in 2017 totaled $3 billionin 2017. Scoring that over nine years, termination of casualty loss deductions offset only 1.6 percent of the $1.5 trillion total tax reductions of the act. Cybercrime claims alone would be an even smaller percentage, of course. Eliminating financial scams from the act would not materially affect federal revenues but would be a lifeline for many scam victims.  

Legislation is currently pending in the Congress to extend the TCJA and make it permanent beyond 2025. Extending the casualty loss provision would forever continue punishing scam victims. Instead, this is the opportunity to address the unfair and harmful casualty deduction policy for cybercrime victims. Three practical alternative remedies can be considered. 

First, Congress could simply delete the casualty deduction provision from any tax cut extension bill and let it expire at the end of December 2025, allowing taxpayers again to claim an itemized deduction for non-compensated personal casualty and theft losses. 

Second, lawmakers could amend Section 11044(1) to allow a deduction for cybercrime scam victims up to the amount of tax liability incurred from the related financial transactions. 

Third, they could retroactively either repeal Section 11044(1) or amend it to allow offsetting deductions to allow deductions for losses and taxes incurred both between 2017 and 2025 and in the future.  

While each of these alternatives would correct the unintended consequences of Section 11044(1), this third strategy is the fairest remedy because it would both protect future scam victims from piling taxes on top of scam losses and restore deductibility for scam victims caught in the 2017-2025 dead zone. 

Whichever option it chooses, Congress must address the unintended, unfair and harmful consequences of this legislation. 

Douglas Brook is a research scholar of public policy at Duke University.