The rising risk of IOSS number misuse

The Import One-Stop Shop was designed to modernise EU e-commerce VAT collection. Over five years in, a growing wave of number misuse, unpaid VAT disputes, and regulatory gaps is creating real headaches for European businesses.

What is IOSS and how does it work?

Introduced on 1 July 2021 as part of the EU’s VAT e-commerce package, the IOSS is a voluntary simplification scheme that allows sellers to collect VAT at the point of sale on goods imported into the EU with a value not exceeding EUR 150. Instead of the consumer paying import VAT at the border, the seller charges the applicable VAT rate of the consumer’s Member State at checkout, declares it via a single monthly IOSS return and remits it through one Member State of identification. At customs, the IOSS number on the declaration signals that VAT has already been paid, and the goods are released for free circulation without further VAT charges. In other words, less friction at the border, a better customer experience and a level playing field between EU and non-EU sellers.

The problem

The very simplicity that makes the IOSS attractive has also made it vulnerable. The European Commission’s VAT Expert Group has identified three core problems¹:

The IOSS number is just a number. Because it is shared across multiple stakeholders in the supply chain, it gets exposed and can be hijacked by fraudulent actors seeking to benefit from the VAT exemption at import without ever paying the VAT.

Platforms lack visibility over the distribution chain. Often the platform acting as deemed supplier has no oversight of customs formalities, which are handled by actors not connected to the platform, making cross-checking data difficult.

Physical checks are impractical. The number of low-value parcels has increased exponentially year on year, making meaningful physical controls impossible to scale.

According to the European Court of Auditors (ECA), IOSS abuse takes multiple forms: unregistered traders fraudulently using legitimate IOSS numbers, large consignments artificially split into multiple smaller ones to stay below the EUR 150 threshold, and goods deliberately undervalued in IOSS returns².

And the most striking part: there is no way to verify who an IOSS number actually belongs to—only whether the number is valid. In practice, this means that a valid IOSS number can be used by unauthorised parties to import goods with a VAT exemption, and customs authorities have no electronic means to confirm whether the person presenting the number is its legitimate holder. When Member State authorities eventually detect discrepancies between the volumes imported under an IOSS number and the VAT declared on monthly returns, the registered holder may face demands for unpaid VAT, even where they neither authorised the imports nor submitted the customs declarations.

What makes this particularly concerning is that when discrepancies are detected, neither the Tax Administration nor other authorities can determine who in the supply chain acted incorrectly—or whether the IOSS number was misused by a third party altogether. In practice, tax authorities have also sought to recover unpaid VAT from logistics operators, customs declarants and other supply chain actors who may have handled the IOSS number in their role, even though, under EU guidance, these parties are not required to verify the accuracy or legitimacy of the IOSS number presented to them. This raises fundamental questions about where liability should fall when the number is misused without the knowledge of the parties involved.

Facing an IOSS dispute? Here is what you should do

If your business has received a VAT assessment linked to IOSS number misuse, you are not alone and you are not without options. The good news is that these allegations can be investigated and challenged.

At PwC we have hands-on experience helping European businesses navigate exactly these situations. Our team has worked with clients across multiple Member States to gather, cross-reference and analyse the fragmented data that typically underpins these cases. That data is rarely in one place: customs declarations sit with national authorities, IOSS VAT returns are filed in the Member State of identification, and transaction records are scattered across logistics partners, marketplaces and freight forwarders.

What makes IOSS disputes particularly complex is that the regime places the burden of proof on the registered holder of the number. That means it is up to your business to demonstrate that the consignments in question were not yours. Building that defence requires matching import data against your actual sales activity and identifying the discrepancies — shipments of products you do not sell, to destinations where you have no customers, or in volumes that bear no relation to your genuine trade. When presented clearly to tax authorities, whether through early engagement or formal appeal, this kind of evidence-based analysis can and does resolve assessments.

What’s coming next?

The VAT in the Digital Age (ViDA) package was adopted by the EU Council in March 2025. As part of its Pillar 3 on Single VAT Registration, measures to secure the IOSS number are set to take effect from 1 March 2028. The European Commission is working on two options to tackle number misuse:

Verifiable digital credentials for secure transmission of IOSS numbers and supply chain data

A pre-submission token model linking each consignment to pre-lodged customs data, using tokens to match shipments with the seller’s or marketplace’s IOSS number. In parallel, the EU Customs Reform is set to remove the EUR 150 duty-free import threshold, which will further close the loopholes that enable IOSS-related fraud.

While these reforms are welcome, these will take time to materialise.

Whether your company has received a VAT assessment linked to IOSS number misuse, is a logistics operator or customs declarant facing unexpected VAT liability, or simply wants to understand how the evolving regulatory framework may affect your business, we encourage you to get in touch. Our PwC team combines deep VAT expertise with cross-border experience to guide you from initial assessment through to resolution, regardless of your role in the supply chain.

¹ European Commission, Report on the Application of the VAT E-commerce Package 2024, 14 July 2025, available at the VAT One Stop Shop portal, accessed 28 August 2026.

² European Court of Auditors (ECA), Special Report 08/2025: Value Added Tax Fraud on Imports, 2025, s. 12.