Tax Form Detection

Tax form detection is an opt-in scan feature that flags documents containing well-known U.S. tax forms. When enabled, PII Crawler emits a US Tax Form finding (one per detected form) on top of the usual PII findings, so reviewers can spot tax records mixed in with other documents during a sweep of a shared drive or mailbox.

Why this is off by default

The detector compares every scanned file against the bundled form templates. That extra work is small per file but measurable across a directory of millions of files, and most scans are not tax related. Form detection is therefore a per-scan toggle that defaults to off. Turn it on for HR drives, accounting share folders, or before-tax-season audits, and leave it off everywhere else.

What gets detected

The detector ships with the following IRS templates baked into the binary, so the feature works fully offline:

• Form 1040 (U.S. Individual Income Tax Return)
• Form 1040 Schedules 1, 2, and 3
• Form W-2 (Wage and Tax Statement)
• Form W-4 (Employee's Withholding Certificate)
• Form W-9 (Request for Taxpayer Identification Number)
• Form 1099-NEC (Nonemployee Compensation)
• Form 1099-MISC (Miscellaneous Information)
• Form 1099-INT (Interest Income)
• Form 1099-DIV (Dividends and Distributions)
• Form 1099-R (Distributions From Pensions, Annuities, Retirement or Profit-Sharing Plans)
• Form 1099-K (Payment Card and Third Party Network Transactions)
• Form 1099-G (Certain Government Payments)
• Form 1099-A (Acquisition or Abandonment of Secured Property)
• Form 1099-B (Proceeds From Broker and Barter Exchange Transactions)
• Form 1099-C (Cancellation of Debt)
• Form 1099-LTC (Long-Term Care and Accelerated Death Benefits)
• Form 1099-OID (Original Issue Discount)
• Form 1099-PATR (Taxable Distributions Received From Cooperatives)
• Form 1099-Q (Payments From Qualified Education Programs)
• Form 1099-S (Proceeds From Real Estate Transactions)
• Form 1099-SA (Distributions From an HSA, Archer MSA, or Medicare Advantage MSA)
• Form W-2G (Certain Gambling Winnings)
• Form W-4P (Withholding Certificate for Periodic Pension or Annuity Payments)
• Form W-4R (Withholding Certificate for Nonperiodic Payments and Eligible Rollover Distributions)

These are the forms that carry somebody's Social Security number and earnings and get mailed out every January, which is what makes a copy of one sitting on a shared drive worth knowing about.

Multiple pages of the same form collapse to a single finding, so a scanned multi-page 1040 is reported once as IRS Form 1040. So do the different copies of the same form and the different years of it: an employee's Copy B and the employer's Copy D of a 2024 W-2 in one file are one IRS Form W-2 finding.

Telling one form from its neighbours

Every form in the 1099 family is printed from the same wording: the payer and recipient address blocks, the copy headers, the Privacy Act notice. Only the numbered boxes differ, so a form is identified by the wording that no other bundled form uses. A document has to contain enough of a form's own boxes to be reported as that form, which is why a 1099-MISC is reported as a 1099-MISC and not also as the fifteen other 1099s it shares its layout with.

The same rule is what keeps a form the tool does not know about from being reported as one it does: a 1099-CAP, a 1098-E or a Form 5498 has the family's shared wording and none of a bundled form's boxes, so it produces no finding rather than the wrong one.

A form that names another form is not that form either. A payroll memo explaining who receives a W-2 and who receives a 1099-NEC contains neither.

How it works

Each document's text is compared against every template's distinctive wording, including the labels of fillable fields like name: or address:. A document that contains enough of a template is reported as that form, so a filled-in or lightly edited copy still matches.

The IRS revises its forms, and a revision that renumbers a box changes the wording the detector is looking for. Where the IRS publishes more than one revision in circulation, more than one is bundled, and a revision that is not bundled is still recognised: a 2024 W-2 and a 2024 1099-MISC are both reported by templates built from the 2026 and 2025 forms.

Several of the 1099 family are now continuous use — the IRS prints one revision with no year on the face and reissues it only when a box changes. For those, one revision is bundled, and the year-dated revisions that preceded it are still recognised: a 2015 1099-Q is reported by a template built from the 2025 one.

The exception is the W-4P, whose face page was redesigned twice in four years. Three revisions of it are bundled, which is what makes the 2022, 2023 and 2024 forms recognisable as well as the current one.

What the finding points at

A US Tax Form finding is a statement about the document, not about a span of text inside it: the evidence for "this is a 1040" is spread across the whole page. So the finding is recorded at the start of the file and carries the form's name as its term, rather than a quoted value the way an SSN or an email address does.

That matters for remediation. Redaction masks the text a finding names, and a form finding names none — the form's printed wording is the IRS's, not the taxpayer's. So redacting a tax form masks the SSNs, names, addresses and account numbers found on it and leaves the form itself legible, which is what makes the redacted copy still recognisable as a 1040. A file where the form is the only finding has nothing to mask and is reported that way.

Enabling it

Tax form detection lives in the Detection section of the new-scan form, alongside the PII type picker, terms lists, and proximity groups. Toggle "Tax form detection is enabled" before starting the scan. Findings show up in the matches view under the US Tax Form type (slug us-tax-forms), and contribute to the scan's risk-weighted summary.