Former North Carolina Restaurant Employees Face Surprise Tax Bills After Alleged Identity Theft Scheme

HUNTERSVILLE, N.C. — Two former employees of a Firebirds Wood Fired Grill in Huntersville, North Carolina, are facing significant, unexpected tax liabilities after their Social Security numbers were allegedly used by undocumented workers to gain employment at the restaurant long after they had resigned. The incidents, which came to light as the former employees prepared their tax returns, have triggered a police investigation and highlighted severe breakdowns in employment verification and data security protocols.

One of the victims, Evan Donovan, reported to police in February that his personal information was being used illegally. According to a report by WSOC-TV, Donovan, who left his job at the restaurant in July of the previous year, discovered a W-2 form indicating he had earned an additional $20,000 from the establishment. This income was reported to the Internal Revenue Service under his Social Security number, making him liable for the associated taxes.

A second former employee, a woman who worked at the same location from January to November 2025, made a similar discovery. When accessing the restaurant’s employee computer system, she found that a current employee was actively using her name and Social Security number. In both cases, while the core identity information was stolen, other details such as contact information, addresses, and bank account data were changed, ensuring paychecks were routed to the individuals actually performing the work.

This situation is a compliance catastrophe that illustrates the severe risks of lax internal controls for both individuals and the business itself. For the former employees, it's a personal financial crisis. For the business, it signals a complete failure of its obligation to protect sensitive employee data and properly verify its workforce. We have seen how easily these issues spiral, creating legal and financial nightmares that far exceed the cost of proper oversight. C&S Finance Group LLC helps clients establish rigorous tax preparation and compliance protocols to prevent these exact scenarios; you can learn more at csfinancegroup.com.

Employment-related identity theft creates a complex and burdensome situation for victims. The IRS and Social Security Administration initially operate based on the information they receive from employers. This means that until the record is corrected, the legitimate owner of the Social Security number is held responsible for taxes on all reported income. Victims often first learn of the fraud when they receive an IRS notice, such as a CP2000, which flags a discrepancy between income reported by employers and income reported on a tax return. Other warning signs include an e-file rejection because a return has already been filed under their SSN or receiving a notice about income from an employer they never worked for.

Under North Carolina's Identity Theft Protection Act, businesses have a clear legal obligation to safeguard the personal information of their employees, including Social Security numbers. The statute mandates that employers implement reasonable measures to protect this data, such as encrypting SSNs transmitted online, prohibiting their use on employee ID cards, and ensuring they are not mailed on documents unless required by state or federal law. The law also requires employers to educate staff responsible for personnel records about these obligations. The allegations against the Huntersville restaurant suggest a potential violation of these state-level mandates.

From our perspective, the potential liability for the employer here is immense, extending far beyond regulatory fines. Reputational damage, civil lawsuits from the victims whose identities were compromised, and intense scrutiny from federal agencies like the IRS and the Department of Homeland Security are all but guaranteed. We advise our clients that the cost of implementing strong I-9 verification and data security protocols is minuscule compared to the cost of cleaning up a disaster like this. It's not just about avoiding penalties; it's about fundamental business integrity and risk management.

For individuals who suspect they are victims, federal agencies recommend a multi-step recovery process. The first step is to file a report with local law enforcement, as Donovan did. Victims should also file a report with the Federal Trade Commission at IdentityTheft.gov, which provides a personalized recovery plan and an official Identity Theft Report. This document is crucial for disputing fraudulent activity with creditors and other institutions. Furthermore, victims must contact the Social Security Administration to review and correct their earnings records, which is essential for ensuring future benefits are calculated correctly. Finally, placing a credit freeze with the three major bureaus—Equifax, Experian, and TransUnion—is a critical defensive measure to prevent perpetrators from opening new lines of credit in the victim's name.

The police investigation into the incidents at the Firebirds Wood Fired Grill is ongoing. The outcome will likely have significant consequences for the restaurant and could serve as a stark warning to other businesses about the critical importance of stringent hiring practices, I-9 compliance, and the secure handling of sensitive employee data.