What triggers a sales tax audit for an online store?

State tax authorities don’t audit randomly as their primary strategy. They use data to identify likely non-compliance and target audits where they expect to find it. For ecommerce sellers, several specific data sources consistently put sellers on a state’s radar.

1099-K data from Amazon and other marketplaces

Amazon, eBay, Etsy, and other platforms file 1099-K forms with the IRS for sellers above the reporting threshold. The IRS shares taxpayer data with state revenue agencies, and states increasingly have their own marketplace reporting requirements as well.

States can match 1099-K data against their own seller registries. A seller showing $500K in Amazon sales in a state who isn’t registered in that state appears on the mismatch list. That mismatch generates a nexus questionnaire or direct audit notice.

This is the most systematic audit trigger for ecommerce sellers at scale. It doesn’t require a complaint, a competitor tip, or manual investigation, it’s automated matching.

Nexus questionnaires

A nexus questionnaire is a document a state sends to a business asking whether it has nexus there and, if so, whether it’s registered. Receiving one means the state already suspects you have nexus, from marketplace data, from an interstate information request, or from their own analysis of your business activity.

Answering a nexus questionnaire obligates you to disclose your nexus accurately. Inaccurate responses create additional liability. More importantly: receiving a questionnaire typically closes the VDA window. If you receive one, respond carefully and consider consulting a sales tax professional before answering.

Cross-state information sharing

States share taxpayer information with each other through audit programs and mutual agreements. If you’re audited in Ohio and Ohio discovers you also have nexus in Indiana and Michigan, that information can be shared. States also share data through programs like the Streamlined Sales Tax program and the Multistate Tax Commission.

A seller getting clean in one state through a VDA while leaving other states unaddressed may find that the VDA state’s compliance records trigger inquiry from neighboring states.

Filed return discrepancies

For sellers who are registered and filing, audits can be triggered by anomalies in the returns themselves:

• Large swings in taxable sales between periods without a clear business explanation
• Consistently low taxable percentage of gross sales (suggesting miscategorized exempt sales)
• Exemption certificate claims that appear disproportionate to the business type
• Sales that match known taxable categories but are filed as exempt

Returns software errors, product miscodes, wrong rate applications, or incorrect local jurisdiction assignments, can surface in return-matching programs.

Purchase audits (B2B)

States conduct purchase audits of large companies, which can identify their suppliers. If a state audits a large retailer and finds they were purchasing from you without sales tax being collected, that information can flow back to your file. B2B sellers who issued certificates for exempt sales are particularly exposed here.

What doesn’t usually trigger audits

Sellers below the threshold aren’t typically targeted. A very small ecommerce operation with $30,000 in annual sales across all channels is unlikely to be audit-targeted: the collection cost exceeds the expected recovery.

Sellers who are registered and filing correctly (even if their returns show modest taxable sales) are lower priority than unregistered sellers who appear to have significant in-state sales.

The risk reduction from being in compliance

The most effective audit risk reduction is being registered and filing accurately. A registered, compliant seller who gets selected for audit has clean records to show. An unregistered seller who gets selected has both the back-tax liability and the audit response costs to manage, and no VDA protection available at that point.

Related: I haven’t been collecting sales tax — what do I do now? | Can a VDA protect me from penalties?