TL;DR: A fake EIN confirmation letter is either a genuine IRS CP 575 or Letter 147C edited after the IRS produced it, or a document built from a template to claim an EIN the IRS never assigned to that entity. Fraudsters favor it because the IRS issues the original CP 575 once and will not duplicate it, and because the number is cheap: TIGTA reported in July 2025 that nine Social Security numbers were used to obtain 10,271 EINs. Visual review fails because a competent fake carries the right letterhead, the right notice number, and the wrong history.
One Original, Endless Copies
An EIN confirmation letter asserts that the IRS assigned a specific nine-digit number to a specific legal entity on a specific date. A fake letter pairs a real EIN with an entity that does not own it, or a real-looking entity with an EIN that was never issued or belongs to someone else. The IRS states on its CP575 notice page that the original series "cannot be duplicated or recreated," so a reviewer cannot ask the issuer for a fresh copy. And the number is easy to get. According to the Treasury Inspector General for Tax Administration's July 2025 audit, the IRS issued more than 8.2 million EINs in fiscal year 2024, 87 percent through an online system rated at the lowest identity assurance level. Fraudsters do not forge the number; they forge the entity around it, which is why shell company red flags and EIN letter review belong in the same workflow.
Edited-after-creation fakes start with a real notice issued to one entity and change the name, address, EIN, or date, so the letterhead and boilerplate are authentic. Template-generated fakes start from a blank. A 2025 indictment in the Southern District of New York, United States v. Anand et al., quotes one conspirator asking another for "a blank EIN doc" so the account-opening packet would be ready before the bank asked.
What a Real CP 575 or 147C Actually Contains
The IRS generates a CP 575 when it approves the application. It carries a notice number with a letter suffix (the IRS calls the series CP 575 A through J), a date of notice, the EIN, and the entity's legal name and mailing address exactly as entered on Form SS-4, followed by the federal returns the entity is expected to file. Online applicants receive it as a PDF; mail and fax applicants receive paper, and every template in circulation came from one of those channels.
Letter 147C, EIN Previously Assigned, is the replacement. The IRS issues it only after an authorized person calls the Business and Specialty Tax Line and passes identity verification, delivering it by fax or mail; there is no email channel and no public lookup. The IRS now also offers a digital CP575 through Business Tax Account, which its EIN guidance lists alongside the entity transcript and the 147C as the three accepted ways to confirm an EIN.
Tells That Still Work, and the Ones That Don't
Letterhead, fonts, and the Cincinnati address tell a reviewer nothing, because every real CP 575 becomes a template the moment its recipient emails it to a bank. The tells that survive connect the letter to something outside itself. The IRS instructs applicants to form the entity with the state before applying, so a notice dated before formation needs an explanation. IRS systems accept only letters, numbers, hyphens, and ampersands in a business name, so a legal name containing a period or apostrophe is inconsistent with the system that supposedly printed it. Filing requirements should fit the entity type; a sole proprietor's notice should not list Form 1120.
None of these rows catches a competent edited-after-creation fake on its own. If the source notice belonged to a real LLC formed in the same state in the same month, the only field that moved is the one the reviewer cannot check by looking.
Cross-Checks Outside the Document
The IRS TIN Matching Program is the closest thing to an issuer check. The program is open only to payers that have filed Forms 1099 in the last two years, and only for accounts with reportable payments. It handles up to 25 name/TIN pairs interactively, or 100,000 in bulk within 24 hours. It returns a match code, not the entity's name; a newly issued EIN can take up to two weeks to pass, and a clean match proves only that someone obtained an EIN under that name, not that the applicant is that someone.
State registries fill part of the gap. The Secretary of State filing confirms the entity exists, when it was formed, and under what exact name, which exposes a real EIN attached to the wrong company. It does not verify the EIN, because states do not check federal tax IDs at formation. The Federal Reserve's November 2025 note on synthetic business fraud describes the pattern: register online with a state, apply online for an EIN, then open accounts. Both government records will be genuine, so the EIN letter and the certificate of incorporation beside it have to be read together and x-rayed separately.
The strongest check is the packet. The EIN, legal name, and address on the CP 575 should agree with the W-9, the formation document, and any Form 941 in the file. Agreement everywhere except the one document the reviewer is holding is the edited-fake signature; agreement everywhere in a packet produced the same afternoon is the template signature, and a sound KYB program treats that uniformity as a question.
How Detection Actually Works
Detection that holds up reads the file's story before it reads the page, through six classes of signal.
Production method asks how the bytes were made. A CP 575 downloaded from the IRS online application carries the fingerprint of the IRS document pipeline; a file that last passed through a desktop PDF editor or an image-to-PDF converter carries a different one. Edited-after-creation is a distinct finding from generated-from-scratch, because a genuine IRS file may sit underneath a later save and the case note should say which fields changed. Timestamp trail asks whether creation, modification, and upload dates cohere with the notice date. A letter dated 2021, created in September 2026, and uploaded the hour the application was submitted needs a benign story; re-saves and scans create noise, so the trail is evidence, not a rule.
Issuer matching asks whether the claimed producer matches the document's structure: an IRS notice assembled in consumer software was not assembled by the IRS. Consistency is the cross-check section above, run against the file. Model artifacts asks whether generative tooling left traces a standard viewer does not show, including the structural absences of screenshots and image-only PDFs, which is how KYB document fraud detection separates a photographed notice from a fabricated one. Recycled patterns asks whether this template, this EIN, or this exact notice has appeared before across the portfolio. One reviewer looking at one file will not see the fifth copy.
What to Do With a Suspect EIN Letter
A flagged letter is not yet a rejected applicant. Any of the tells above is enough to hold the application and request a confirmation the applicant can obtain without the original: a 147C faxed during a call to the IRS, an entity transcript, or the digital CP575 from Business Tax Account. A business that cannot produce any of them has told the reviewer something.
The break-test is to confirm the EIN outside the applicant's control: TIN Matching for eligible payers, the Secretary of State record and W-9 for everyone else. Escalate when the document and the registers disagree and the applicant cannot restore agreement, and write the finding the way a SAR narrative needs it: which letter, which field, which independent record it failed to match. "The EIN letter looked off" is not a basis. "The notice was modified after the IRS generated it and the legal name does not match the state filing" is.
Break-test the control itself. Check a document in the Watchdoc playground with a native CP 575 PDF, clean or disputed, and compare the x-ray to what the reviewer recorded. The first file is free, no email required.
Where Sphinx Fits
Watchdoc runs six checks (production method, timestamp trail, issuer matching, consistency, model artifacts, and recycled patterns) and returns a verdict with the manipulation highlighted. Published figures: 94.3% correct verdict, 2.8x more forgeries caught, clean files clearing in under 28 seconds, 1 million documents processed, $0.45 per document with no seats and no platform fee. The Watchdoc playground is the same x-ray, free to try. The companion checklist in this series covers fake financial statements.
Frequently Asked Questions
Can a business get a copy of its CP 575 from the IRS?
No. The IRS states that the original CP 575 series cannot be duplicated or recreated. A business that has lost it can request Letter 147C by phone, request an entity transcript, or download a digital CP575 through Business Tax Account, all of which banks accept as EIN confirmation.
How can a bank verify an EIN?
Payers that file Forms 1099 can use the IRS TIN Matching Program to confirm that a name and EIN combination matches IRS records, 25 at a time interactively or 100,000 in bulk within 24 hours. Others compare the letter against the Secretary of State filing and the W-9 and ask the applicant for a 147C or entity transcript.
Does a valid EIN prove the business is legitimate?
No. An EIN can be obtained online in minutes, and TIGTA's July 2025 audit found nine Social Security numbers used to obtain 10,271 EINs between 2018 and 2023. A valid EIN proves that someone registered that name with the IRS, not that the applicant controls the entity or that the business operates.
What is the difference between a CP 575 and a 147C letter?
A CP 575 is the original notice the IRS issues once when it assigns an EIN, and it lists the entity's filing requirements. Letter 147C is the replacement verification the IRS sends by fax or mail after an authorized person calls and passes identity checks. Both are accepted as proof of the same EIN; neither is available by email or public lookup.
.png)
