CP40: What It Means When a Private Collection Agency Contacts You
By Forrest Baumhover, CFP®, EA · Last verified August 23, 2026
CP40 means the IRS handed your account to a private company — and that single fact makes it one of the easiest genuine IRS notices to mistake for a scam, and one of the easiest scams to mistake for the real thing.
What the notice actually says
CP40 tells a taxpayer exactly one thing: the IRS has assigned their unpaid tax account balance to a private collection agency (PCA) operating under a contract with the Treasury Department. The notice names the specific agency, gives its phone number and mailing address, and includes a Taxpayer Authentication Number — a code that exists for one purpose, to let the taxpayer and the PCA verify each other before either side treats a phone call as legitimate. (For where CP40 sits among the rest of the collection stream, see the IRS Notice Library.)
CP40 is not the only letter that arrives. The assigned PCA sends its own confirming letter shortly after, restating the same authentication number and the same balance. That two-letter, shared-number handshake is a deliberate anti-fraud design — the IRS's own CP40 explainer describes it as the way a taxpayer confirms a caller claiming to be the assigned agency actually is.
What actually triggered it
The IRS does not choose to outsource collection — it is required to. IRC §6306 directs the Treasury Secretary to enter into qualified tax collection contracts with private parties to work "inactive tax receivables": balances the IRS's own staff has stopped actively pursuing, typically because the account has aged without an assigned revenue officer or without recent contact. Three agencies currently hold those contracts — CBE Group Inc. (800-910-5837), Coast Professional, Inc. (888-928-0510), and ConServe (844-853-4875) — a list confirmed directly on the IRS's private debt collection program page rather than assumed, since the roster of contracted agencies has changed in past years.
Not every aged balance qualifies. §6306 excludes accounts belonging to a deceased taxpayer, someone under 18, or someone in a designated combat zone; identity theft victims; recipients of SSI or SSDI; taxpayers whose adjusted gross income doesn't exceed 200% of the applicable federal poverty level; accounts currently under examination, in litigation or criminal investigation, or already subject to a levy; accounts with a pending or active offer in compromise or installment agreement; and accounts carrying open appeal rights or an innocent spouse claim. The FAQ page adds one more: accounts in a presidentially declared disaster area. A CP40 for a client who fits any of those categories is worth a second look — the exclusion may have been missed, or may have arisen after the assignment already happened, which is itself grounds to have the account recalled.
What happens if you don't engage
CP40 carries no statutory response deadline of its own — it is an assignment notice, not an enforcement notice, and it does not start a countdown the way CP504's 30-day levy warning does. What doesn't pause is everything CP40 doesn't control: interest and any failure-to-pay penalty continue accruing on the balance under the normal rules regardless of who is asking for it.
A taxpayer isn't obligated to work with the assigned PCA at all. Telling the agency orally that you intend to deal with the IRS directly triggers a 60-day hold on the account; if nothing is resolved with the IRS in that window, PCA collection activity can resume. A written "no contact" request goes further and can move the account back to the IRS outright — the Taxpayer Advocate Service publishes a sample letter for exactly this purpose.
What a private collection agency can and cannot do
A PCA can verify identity against the Taxpayer Authentication Number, discuss the balance, and set up an installment agreement running up to seven years or the collection statute expiration date (CSED), whichever is shorter, if the taxpayer can't pay in full — the PCA's own program guidance states that cap as "within seven years or the collection expiration date." What it cannot do is where the real leverage sits: a PCA cannot file a Notice of Federal Tax Lien, levy a bank account, garnish wages, issue a summons, report the debt to credit agencies, or decide an offer in compromise — those all remain IRS-only actions, confirmed directly against the IRS's PDC FAQ page.
Payment is the sharpest line. Every legitimate channel routes to the United States Treasury, never to the agency: IRS Direct Pay, EFTPS, a debit or credit card through the IRS's own payment page, or a check or money order made payable literally to "United States Treasury" — even a preauthorized direct debit the PCA helps set up still drafts a check payable to the Treasury, not to the company. A PCA that asks for payment made out to itself, or by prepaid debit card, gift card, cryptocurrency, or wire transfer, has already disqualified itself.
The practitioner's actual next step
Pull the account transcript before doing anything else. A CP40 is generated off the balance the IRS has on record at the moment of assignment, and a payment applied late, an amended return still processing, or an abatement in progress can all leave the PCA quoting a number that's already wrong.
If the balance is confirmed and the client can pay in full, there's no reason to route it through the PCA at all — paying the IRS directly closes the account faster. If they can't, the PCA can offer an installment agreement up to seven years or the CSED — never longer than the IRS itself could otherwise collect — and sizing that proposal against IRM 5.14 with The Federal Tax Desk's IA Payment Calculator before the client's first call gives them a number to negotiate toward instead of accepting whatever the agency proposes. If the client falls into one of the §6306 exclusion categories, disputes the underlying liability, or simply doesn't want to deal with a third party, a written request returns the account to the IRS — and Publication 5 covers formal appeal rights if the liability itself is in dispute.
What CP40 gets confused with — and why the distinction matters
CP40 has the same core job as CP53E: both are genuine IRS correspondence that look, on first read, exactly like what a scam warning trains people to fear. CP53E asks for banking information; CP40 tells a taxpayer to expect a call from a company that isn't the IRS. The generic advice "the IRS will never call you" is true of the IRS itself, but CP40 is one of the few legitimate situations where a non-IRS company calling about a tax debt is not automatically a scam — which means the usual shortcut doesn't apply here, and the specific verification steps matter more than they would on almost any other notice.
Those steps are concrete, not a feeling. A legitimate contact traces back to one of exactly three named agencies — CBE Group, Coast Professional, or ConServe — never a company outside that list. It follows CP40 and its own confirming letter; a PCA does not cold-call an account that never received IRS correspondence first. It produces the Taxpayer Authentication Number on request and expects the taxpayer to do the same. And the Taxpayer Advocate Service is explicit that it will never ask for payment on a gift card, prepaid debit card, wire transfer, or in cryptocurrency, and never asks for payment made out to itself. A caller who skips the authentication number, isn't one of the three named agencies, or asks for payment in any of those forms is not a rogue employee of a legitimate PCA — they're impersonating the program entirely, and the response is the same as for any other IRS-impersonation scam: don't pay, and verify independently using the number printed on the taxpayer's own CP40, not anything the caller provides.