Here is the uncomfortable truth about the IRS private debt collection program: a stranger calling about your IRS debt might be legitimate. That makes the old rule, "the IRS never calls," less useful. You need a better rule, and the program provides one. A legitimate private collector can be verified against documents you already have.

The background on why these agencies exist is in the private debt collection program. This page is the verification checklist.

Step 1: did the IRS tell you first?

The program is built so the IRS speaks first. IRM 5.1.12.18.3 says the IRS sends Notice CP40, Overdue Account Sent to Private Collection Agency, to individuals (CP140 to businesses) together with Publication 4518, before the agency's own contact. The IRS private debt collection page says the same: the IRS will first send a CP40 notice, and the agency will then send its initial contact letter.

If you have never received a CP40 and someone claims to be a private collector, slow down. Do not give information or money. Check whether the account was actually assigned, using the steps below.

Also make sure there is actually an IRS debt. If you do not owe the IRS, there is nothing to assign.

Step 2: match the taxpayer authentication number

This is the core of verification. IRM 5.1.12.18.3 says letters from both the IRS and the agency contain a taxpayer authentication number used to confirm your identity and verify that the agency caller is legitimate. Publication 4518 says the agency's letter will include the same unique number that appears on the IRS letter, and that the agency employee will use it to verify identity.

The IRS page describes it as a two-way exchange: you and the agency each share portions of the number. Keep both letters in a safe place, as Publication 4518 advises, and compare the numbers before discussing anything else.

Step 3: confirm the agency is on the IRS list

The IRS private debt collection page tells you to validate that the caller represents one of the listed agencies. As of the page's last review on August 21, 2026, the list is CBE Group Inc. (800-910-5837), Coast Professional, Inc. (888-928-0510), and ConServe (844-853-4875).

Do not call back a number the caller gives you. Look the agency up on the IRS page and call that number. If the name on your letter does not match an agency on the IRS list, treat the contact as suspect.

Step 4: check your IRS records

The IRS page also suggests checking the assignment through your IRS tax record. Your account transcript reflects the assignment. IRM 5.1.12.18.4 describes the transaction code the IRS uses to show an account is assigned to a private agency, a separate code when the IRS recalls the account, and another when the agency returns it.

If your transcript shows no assignment, or shows that the account was recalled or returned, a caller claiming to be your current private collector has a problem.

Step 5: follow the money

Payment instructions are the easiest test of all. Publication 4518 says to make all payments to the IRS. Electronic options include IRS Direct Pay, Direct Debit, the Electronic Federal Tax Payment System, and debit or credit card payments through a payment processor, which charges a fee. Checks and money orders are payable to the United States Treasury, with your name, Social Security number and tax year written on them.

If a caller asks you to pay the agency itself, a third party, or anyone other than the IRS, that conflicts with the IRS's own written instructions for this program. Stop and verify through the IRS before paying anything.

Step 6: listen for prohibited conduct

Legitimate agencies operate under rules. IRC 6306(b)(2) prohibits them from doing anything an IRS employee is prohibited from doing in similar work. IRC 6306(g) applies the Fair Debt Collection Practices Act, and Publication 4518 says its provisions prohibit agencies from threatening or intimidating taxpayers. The IRS page puts it in capital letters: they will NOT threaten you.

Publication 4518 also says private agencies cannot take enforcement action, such as filing a notice of federal tax lien or issuing a levy. A caller threatening arrest, immediate seizure or a levy from the agency is describing powers private collectors do not have. Those boundaries are explained in what private collectors can and cannot do.

Red flags measured against the program's own rules

Each common scam line conflicts with something written into the statute or the IRS's guidance:

  • "Pay us directly." Publication 4518 says to make all payments to the IRS.
  • "We will levy your account or file a lien today." Publication 4518 says agencies cannot take enforcement action such as filing a lien or issuing a levy.
  • "You will be arrested." IRC 6306(g) applies the Fair Debt Collection Practices Act, which Publication 4518 says prohibits threatening or intimidating taxpayers.
  • "You never got a letter because this is urgent." The IRS sends Notice CP40 first, and the agency sends its own letter before calling, according to IRM 5.1.12.18.3.
  • "We cannot give you the authentication number." A legitimate agency's letter carries the same number as your IRS letter.

Any one of those is reason enough to hang up and verify through the IRS.

What a legitimate agency may ask you

A real agency will ask questions. IRC 6306(b)(1)(C) allows it to obtain financial information the IRS specifies, so questions about income and expenses are not by themselves a warning sign. Publication 4518 says confidentiality requirements and restrictions required by law will be strictly enforced and that agencies are held to the same standards of service and taxpayer rights protection as IRS employees.

If you believe you already paid the balance, Publication 4518 says to work with the agency employee to identify the payment that was not applied and provide the payment details, so the application can be researched. And if you would rather not share financial information with a contractor at all, you can ask in writing to have the account returned to the IRS.

Reporting misconduct or a scam

Publication 4518 directs complaints about a private collection agency, allegations of agency employee misconduct, and scams to the Treasury Inspector General for Tax Administration hotline at 1-800-366-4484, or tigta.gov. It says threats, assaults or attempted assaults by an agency employee should be reported to TIGTA's Office of Investigations or the same hotline.

If the problem with the IRS account itself is causing hardship, Publication 4518 lists the Taxpayer Advocate Service at 1-877-777-4778.

If you believe a scammer obtained your personal information in the process, treat it as a potential identity theft problem as well. The firm's main site has a guide to IRS identity theft.

After you verify

Verification is the start, not the finish. Once you have confirmed the agency is legitimate, decide whether to work with it or ask for the account to be returned to the IRS in writing. If you work with it, keep a simple log: the date of each call, the name of the person you spoke with, what was agreed, and each payment you make to the IRS with its confirmation number. If anything later goes wrong, that record is what lets the IRS, the Taxpayer Advocate Service or TIGTA sort it out quickly.

A one-minute verification script

When the phone rings, you can run this from memory:

  • Did I receive an IRS Notice CP40? If not, I will check with the IRS first.
  • What is the agency's name? Is it on the IRS list?
  • Can you confirm the portion of my taxpayer authentication number from my letters?
  • I will call your agency back at the number published by the IRS.
  • Any payment goes to the IRS, payable to the United States Treasury.

A real agency will not object to any of that. A scammer will. Verification costs you a few minutes. Skipping it can cost you the money and your identity. The program's safeguards only work when you use them.