Identity Theft Protection As An Employee Benefit: Tax Treatment And Plan Design
Employers can offer identity protection services to employees without adding their value to wages, but the rule is narrower than most people assume. Here is what it covers, what it leaves out, and how to design the benefit.
What To Weigh.
General information, not legal or tax advice. Check the cited sources before you act.
Identity Theft Protection Benefit
The overview of the benefit and how employees use it.
Pre-Tax Or After-Tax Premiums
How payroll deductions for voluntary benefits are taxed.
Plan Cybersecurity
The vendor and data safeguards that apply to benefit plans.
What The IRS Has Said.
In Announcement 2015-22 the IRS said it would not treat identity protection services provided after a data breach as income to the people affected. Announcement 2016-02 extended that position to services provided before a breach occurs.
Under Announcement 2016-02, the IRS will not assert that an individual must include the value of identity protection services in gross income, or that an employer must count that value in employees’ gross income and wages. The IRS also will not assert that the amounts must be reported on an information return such as Form W-2 or Form 1099-MISC. Any further guidance on the taxability of these benefits would apply prospectively.
What The Announcement Does Not Cover.
The announcement does not apply to cash received in place of identity protection services. If you offer a cash allowance employees can spend on anything, the exclusion does not reach the cash.
It also does not cover proceeds from an identity theft insurance policy. The tax treatment of insurance proceeds is governed by existing law, so the monitoring and restoration services and the insurance reimbursement should be treated as separate pieces when you review a vendor’s package.
Employer-Paid, Employee-Paid, Or Both.
An employer can pay for a basic level of protection for every employee and let employees buy up to family coverage or richer limits through payroll deduction. The employer-paid piece falls within the announcement. For employee-paid coverage, the employee usually pays with after-tax dollars through payroll deduction, because this kind of program is not among the benefits a cafeteria plan can offer on a pre-tax basis. Our guide on voluntary benefit premiums walks through the tax treatment.
Whether the arrangement is an ERISA plan depends on how it is set up. Voluntary programs that meet the Department of Labor safe harbor are outside ERISA, and the safe harbor limits what the employer can do. Review it before you add an employer contribution or an employer endorsement.
What To Ask A Vendor.
Ask what is included: credit and dark-web monitoring, alerts, restoration support, and any insurance reimbursement. Ask whether restoration means a case manager who does the work with the member or a checklist the member works alone.
Ask who is covered, because some programs reach spouses and dependents and some cover only the employee. Ask about reimbursement limits and exclusions, how enrollment and payroll file feeds work, and how the vendor handles the personal data it will hold, including Social Security numbers.
Where To Begin.
Decide whether the benefit is employer-paid, employee-paid, or a mix, and document that choice. Compare at least two vendors on included services, family coverage, limits and the quality of restoration help.
Add the vendor to your vendor review. A benefit that stores employee identity data should meet the same security standard as your other benefit vendors.
Communicate it as a protection, not an insurance policy. Employees should know what the service does and does not do before they rely on it.
Common Misreadings.
The IRS announcements are a position on assertion, not a statute. They are useful and widely relied on, but they say future guidance would apply prospectively, so keep an eye on them.
A cash stipend is not identity protection for tax purposes. If the benefit is a dollar amount, check that it buys the service and is not paid to the employee.
Protection services do not prevent identity theft. They detect it, alert the member and help with recovery. Say so in your communication.
Related Voluntary Benefit Guides.
ERISA Voluntary Benefit Safe Harbor
When a voluntary program stays outside ERISA.
Voluntary Benefits Payroll Calculator
Model payroll deductions for voluntary benefits.
Legal Plan Benefit
A companion benefit employees often pair with identity protection.
Laws And Sources
Internal Revenue Bulletin 2016-3: Contains IRS Announcement 2016-02 on identity protection services before a breach.
29 CFR 2510.3-1: The Department of Labor definition of an employee welfare benefit plan, including the voluntary program safe harbor.
26 U.S.C. 125: Cafeteria plans and the benefits they can offer.
General information, not legal or tax advice. Check the cited sources before you act.
Quick Answers.
Short replies on this page’s topic, each tied to a fuller guide.
Is employer-paid identity theft protection taxable to employees?
Under IRS Announcement 2016-02, the IRS will not assert that employees must include the value of identity protection services in income, or that the employer must report it on Form W-2, whether the services come before or after a breach.
Does the exclusion cover a cash stipend?
No. The announcement does not apply to cash received in place of identity protection services.
What about proceeds from identity theft insurance?
The announcement does not cover them. Their tax treatment is governed by existing law, so review the insurance piece separately from the monitoring and restoration services.
Can employees pay for it before tax through payroll?
Generally not. Identity protection is not among the benefits a cafeteria plan can offer, so employee-paid coverage is usually deducted after tax.
Is an identity theft program an ERISA plan?
It depends on the facts. A voluntary, employee-paid program that fits the Department of Labor safe harbor is outside ERISA, but employer contributions or endorsement can change that.
More On Voluntary Benefits.
Accident Insurance
A voluntary benefit that pays cash after an injury.
Critical Illness Insurance
A lump sum after a covered diagnosis.
Hospital Indemnity Insurance
A fixed payment for a hospital stay.
Employee Assistance Programs
Counseling and support for employees.
Hiring A Vendor With Strong Cybersecurity
What to look for in a benefit vendor.
Vendors And Breach Readiness
Planning for a breach involving benefit data.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.