Answers · bookkeeping
How can a small business owner check that the payroll taxes withheld from employees' pay were actually deposited with the IRS by their payroll service provider or bookkeeper, and what happens if they weren't?
Last updated
TL;DR: Check the IRS's records yourself instead of relying on reports from whoever handles payroll. The IRS is plain about who is on the hook: the employer stays responsible for depositing and paying federal employment taxes even when it forwards the money to a payroll service provider, is liable for all taxes, penalties and interest if the provider doesn't pay, and may be held personally liable for certain unpaid federal taxes. Its advice is to make sure the provider deposits through EFTPS, register on EFTPS with your own PIN, check payments periodically, and treat the first missed or late payment as a red flag. EFTPS shows 16 months of payment history. Keep the IRS address of record as your own, not the provider's, so notices reach you. Payments alone aren't enough: in a federal case sentenced in April 2025, a payroll company charged clients their full tax but filed returns understating what they owed and paid only the lower amount, so also compare the tax reported on each quarterly Form 941 with your own payroll register.
What should I check, step by step?
1. Enroll on EFTPS under your business's EIN and get your own PIN (EFTPS.gov or 800-555-4477). The Taxpayer Advocate Service says EFTPS automatically issues Inquiry PINs to clients of payroll service providers; if you never got that letter, register yourself.
- After each payroll, check that a federal tax deposit appears in EFTPS for the right amount and on time. The first missed or late deposit is the IRS's red flag, not something to wait out.
- Each quarter, compare the tax on the Form 941 that was filed (a copy from the provider, and the transcript in your IRS Business Tax Account if you can register) with the withheld income tax and Social Security and Medicare shown in your own payroll register. A return that reports less than you were charged is a warning sign even if every deposit matches the return.
- Confirm your IRS address of record is your own business address. You can check it with the IRS Business and Specialty Tax Line at 800-829-4933. If it was changed without your authorization, tell the IRS straight away.
- Open every IRS notice yourself. A late-payment notice explained away as the IRS being slow or misapplying a payment is exactly what clients in a 2026 sentencing case were told.
- If the person running payroll is an employee rather than a provider, apply the same check: someone other than them looks at EFTPS and the 941 transcript.
- Keep your own dated record of what was due and what you saw deposited each period, outside the payroll system, so a gap is visible without asking the person who made it.
- If you find unpaid deposits, contact the IRS quickly using the number on the notice or 800-829-4933, and talk to a tax professional before paying anything twice.
Is a small business still liable if its payroll provider doesn't pay the payroll taxes to the IRS?
The IRS's Outsourcing payroll duties page (reviewed March 4, 2026) says the employer is ultimately responsible for the deposit and payment of federal tax liabilities, even when it forwards the tax amounts to a third party; if the third party fails to pay, the IRS may assess penalties and interest on the employer's account, the employer is liable for all taxes, penalties and interest due, and it may also be held personally liable for certain unpaid federal taxes. The page also notes there have been prosecutions of people who, posing as payroll service providers, stole funds meant for employment taxes.
- The Internal Revenue Manual says the same in its section on third-party payer arrangements: a payroll service provider is not liable for the employer's employment taxes, and using one does not relieve the employer of its obligations. The Taxpayer Advocate Service adds that when a provider goes out of business or misuses client funds, the employers may end up paying the tax twice: once to the provider and again to the IRS with interest and penalties.
- Withheld income tax and the employee share of Social Security and Medicare are trust fund taxes. Under the Trust Fund Recovery Penalty, the IRS can assess the unpaid amount personally against any responsible person who willfully fails to collect or pay them, and its TFRP page (updated October 11, 2026) lists payroll service providers and responsible parties at the client employer among the people who can be responsible.
How do payroll providers hide that they didn't pay a client's payroll taxes?
In the case the Justice Department announced in April 2025, a Florida payroll company charged clients their full tax liabilities but filed employment tax returns that substantially under-reported them and kept the difference: for one 2021 quarter, about $219,000 collected from a client, a return claiming about $32,000, and about $190,000 kept. The owner was sentenced to 50 months and ordered to pay over $22.4 million in restitution. Checking that each deposit matches the return wouldn't catch that; comparing the return with your own payroll register would.
- In a Missouri case sentenced in September 2026, the founder of a payroll company that had taken payroll tax money from clients stopped paying the IRS on their behalf in 2016. According to local reporting, clients were given fake documents showing payments had been made, and when late-payment notices arrived they were told the IRS was slow processing payments or had misapplied them.
- The Taxpayer Advocate Service warns that a dishonest third party might change your address of record with the IRS to its own, so you don't see notices about problems on your account. The law now requires the IRS to confirm an address change at both the new and the former address.
How can an employer check its own federal payroll tax deposits with the IRS?
EFTPS is the Treasury's free payment system. The IRS says employers should make sure their provider uses it, register for their own PIN, and use it to verify payments; registered employers get online access to 16 months of payment history and can make payments the provider isn't making.
- The IRS Business Tax Account (page updated October 16, 2026) lets a sole proprietor, partnership, S corporation or C corporation official view the account balance, payment history, tax transcripts and IRS notices. It isn't yet available for LLCs that file as sole proprietors on Schedule C or F, so those businesses rely on EFTPS, transcripts requested another way, and the phone line.
- If you were defrauded by a third-party payroll preparer, the Taxpayer Advocate Service says to tell the IRS at first contact, ask about an offer in compromise (an Effective Tax Administration offer gets special consideration for victims of such preparers), and ask the revenue officer not to assert the Trust Fund Recovery Penalty.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Verify the Rightshold ledger my mirror-ledger entries are written to. After every payroll I seal what our own payroll register says was due in federal payroll tax and what I saw deposited in EFTPS, and I want to confirm the record is intact before my accountant compares it with the quarterly Form 941.”
{
"tool": "ledger_verify",
"arguments": {}
}- Free, no key (MCP toolset=ledger). It recomputes every payload, leaf and block hash, Merkle root, chain link and signature on Rightshold's ledger.
- The mirror ledger is a REST API with an API key you hold: POST /v1/mirror-ledgers opens one under a neutral label, and POST /v1/mirror-ledgers/{id}/entries seals an entry. There's no payroll-tax entry type, so seal each pay period as a payment entry: invoice_ref set to your own pay-period reference (for example PAYROLL-2026-11-20), amount_cents for the federal tax due per your payroll register, plus your own fields such as funded_to_provider_cents, eftps_seen_cents, eftps_checked_on and checked_by_ref.
- GET /v1/mirror-entries/{id} is free and needs no account, so your accountant can line the sealed amounts up against the 941 and EFTPS history without your login.
- Entries can't be edited or deleted; a correction is a new adjustment or dispute_note entry. Content with names, emails, addresses or tax ids is refused, so don't put your EIN or employees' details in it.
Rightshold doesn't connect to EFTPS, the IRS, your payroll provider or your bank, and it can't see whether a deposit was made or detect payroll tax fraud. A mirror entry proves what you sealed and when; the comparison with EFTPS and the 941 is a step you or your accountant run. IRS guidance is as published on the pages cited, checked November 11, 2026; case details are from a Justice Department release and local news reporting. Not legal, tax or accounting advice; talk to a tax professional about your situation.
What are the sources?
- IRS: Outsourcing payroll duties (employer remains liable; EFTPS PIN; 16 months of history; address of record)
- IRS: Internal Revenue Manual 5.1.24, Third-Party Payer Arrangements for Employment Taxes
- IRS: Employment taxes and the Trust Fund Recovery Penalty (TFRP)
- Taxpayer Advocate Service: Third Party Arrangements for Employment Taxes (Inquiry PINs, address changes, victims of third-party preparers)
- IRS: Business Tax Account (who can register; payment history, transcripts, notices)
- U.S. Department of Justice: Payroll Services Company Owner Sentenced to Prison (April 24, 2025)
- Jefferson City News Tribune: payroll company owner sentenced (September 11, 2026)
Related
- How to spot a ghost employee on your small business payroll
- How long to keep small business records, and whether scanned receipts count
- How to keep a copy of your business books that your bookkeeper can't edit
- How to spot signs someone is hiding theft in your bank reconciliation
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'
