What Triggers a Sales Tax Audit? 14 Red Flags for Ecommerce Businesses

Have you ever wondered what actually puts a business on a state’s audit list?

In most cases, it starts with a pattern that a state’s automated system flagged long before a formal notice was ever sent.

States are no longer waiting for businesses to report their own errors. They are actively cross-referencing marketplace data, payment processor reports, and third-party filings to identify sellers who may owe unpaid sales tax.

For ecommerce sellers managing multiple channels, fulfillment networks, and exemption certificates across many states, the audit risk is higher than ever.

Find out exactly which behaviors put ecommerce businesses on a state’s radar below.

The 14 Sales Tax Audit Red Flags

1. Crossing Economic Nexus Thresholds Without Registering

After the 2018 South Dakota v. Wayfair ruling, every state with a sales tax established economic nexus thresholds for remote sellers.

Most states use $100,000 in annual sales or 200 transactions as the trigger for registration, though that is shifting. In 2026, more states are moving toward a revenue-only threshold. Illinois already made that move on January 1, 2026, dropping the transaction count entirely.

States like New Jersey and Virginia still use both measures, but the trend is clearly toward revenue alone.

The problem?

Fast-growing ecommerce businesses often cross these thresholds mid-year without a system in place to catch it. By the next filing period, months of unregistered taxable activity have already accumulated. States are actively using marketplace data and 1099-K reports to find these gaps.

For instance, the CDTFA conducted permit checks from 2024 to 2025 that resulted in 14,855 new taxpayer registrations, businesses that were already selling into California but had not yet registered.

If you have crossed a state’s threshold without registering, you are already visible. The question is when the formal notice follows.

2. FBA or Third-Party Fulfillment Creating Undetected Physical Nexus

When Amazon FBA stores your inventory in a state’s warehouse, you have physical nexus there regardless of how little you sell directly into that state.

Many sellers believe that marketplace facilitator laws cover this obligation. They do not. Those laws govern tax collection only on platform sales. Nexus registration in the states where your inventory sits is an entirely separate obligation.

Amazon’s fulfillment network can distribute your inventory across warehouses in a dozen states based on logistics efficiency, creating nexus obligations you never intentionally created.

What to do:

• Pull your FBA inventory placement reports regularly
• Map every state currently holding your stock
• Register in those states if you have not already done so

3. Multi-Channel Selling With Incomplete Reporting

If you sell on more than one platform, say Amazon, Shopify, or Etsy, here is something you need to know. Each of those channels generates taxable sales.

And in a growing number of states, each of those platforms is also sending your sales data directly to state tax departments. That means states may already have a fuller picture of what you are earning than what your returns actually show.

When your returns only reflect one or two of those channels, the discrepancy is not difficult for states to identify. Automated matching systems compare platform-reported figures against filed returns, and gaps stand out quickly.

This is especially common among sellers who started on marketplaces and later launched their own direct-to-consumer storefronts.

4. Affiliate or Influencer Payments Creating Agency Nexus

Paying commission-based affiliates or influencers in a state can establish agency nexus there, even with no physical office or warehouse. Some states trigger this at just $10,000 in referral-generated sales annually.

States known for enforcing affiliate nexus aggressively:

• California
• New York
• Illinois
• North Carolina
• Rhode Island

An ecommerce seller with even a modest affiliate program may have unknowingly created nexus obligations in multiple states.

5. Consistently Late, Missing, or Incorrectly Frequent Tax Filings

Filing late once is an oversight. Filing late repeatedly is a pattern, and states are built to act on patterns. Late or missing returns push businesses higher in audit selection queues because they signal broader compliance issues worth examining.

Filing frequency is also a trigger that often goes unnoticed. States assign monthly, quarterly, or annual schedules based on liability levels. A growing business still filing annually when its volume warrants monthly filings creates a visible mismatch between reported sales and expected output.

Review your assigned filing frequency whenever your business grows significantly. Treat filing deadlines the same way you treat payroll, non-negotiable.

6. A Sudden, Unexplained Drop in Taxable Sales

Your returns do not get read in isolation. States compare them against your own filing history and against what similar businesses in your industry typically report. When something does not add up, their automated systems flag it automatically.

A big drop in your taxable sales from one period to the next, with no matching drop in gross revenue, is exactly the kind of thing that catches their attention.

A sudden drop can indicate:

• Genuine business decline
• Over-applied exemptions
• Reclassified taxable sales
• Underreported revenue

If your business had a legitimate reason for a dip, document it. A well-documented explanation can stop an inquiry before it becomes a full audit.

7. An Unusually Large First Filing

A large first sales tax return raises an obvious question for auditors: if this is your first filing period, why is the liability so high?

States interpret this as evidence of taxable activity that predates registration — meaning back taxes, penalties, and interest may be owed for the period before the business formally registered.

This is one of the most common situations among sellers who register after receiving a state inquiry letter or after learning about nexus requirements for the first time.

8. Inaccurate Product Taxability Classification

Here is something that catches a lot of ecommerce sellers off guard. Sales tax does not work the same way for every product in every state. What is fully taxable in one state can be completely exempt in another. 

And the categories where this gets confusing are exactly the ones most common in ecommerce stores.

Here are some of the biggest ones to watch:

• Digital goods and SaaS
• Clothing and apparel
• Health and beauty products
• Food and grocery items
• AI-powered software tools

A single product misclassified as exempt across five states, sold hundreds of times over two years, adds up to significant audit exposure. States cross-reference reported exempt sales against the product types a business sells, and when the numbers do not match, it becomes a target.

States currently expanding their sales tax base to include more digital goods: Illinois, Louisiana, Texas, Washington, and Georgia. Worth noting: Maryland already has one of the broadest digital goods tax laws in the country, dating back to 2021.

If you are selling digital products into Maryland and have not been collecting tax, that is not a new obligation. It is an overdue one.

9. Data Mismatches Between Your Filings and Third-Party Reports

This is one of the most significant audit triggers in the current enforcement environment and the one most ecommerce sellers are least prepared for.

Payment processors like Stripe, PayPal, and Shopify Payments file 1099-K forms with state tax agencies, reporting your gross receipts. States then compare those figures directly against what you reported on your sales tax returns. And this matters more than ever in 2026.

The IRS reporting threshold for 1099-Ks has been moving toward $600, which means nearly every dollar your business collects is now visible to the state. The days of smaller sellers flying under the radar on this one are essentially over.

Here is what that looks like in practice:

• 1099-K reports: $800,000 in gross receipts
• Sales tax return reports: $350,000 in taxable sales
• State question: Where is the remaining $450,000?

Without documentation showing that the difference represents returns, refunds, exempt sales, or non-taxable transactions, it looks like unreported taxable revenue. Reconciling your 1099-K data against your returns every filing period is non-negotiable.

10. Marketplace-Reported Sales vs. What You Actually Filed

Here is something many multi-channel sellers are not aware of. It is not just your payment processor sending data to the state. Platforms like Amazon, Walmart, and eBay also send your gross sales figures directly to state revenue agencies. 

So if what those platforms reported does not match what you filed on your return, the state sees that gap. And that gap is reason enough for them to take a closer look.

Many ecommerce sellers do not realize how much of their platform activity is flowing to state revenue agencies through these direct data-sharing arrangements. Understanding what each marketplace reports on your behalf and building that into your reconciliation process is essential for multi-channel sellers.

11. Failure to Report Use Tax on Business Purchases

Let us talk about use tax for a moment, because this one trips up a lot of sellers. Think of it like a tab that does not go away just because no one handed you a bill. When you buy something from an out-of-state vendor who does not charge you sales tax, the tax does not disappear.

You are actually supposed to report it and pay it yourself. That is use tax, and most businesses quietly skip it without realizing the exposure they are building up.

The most common items that trigger this obligation for ecommerce sellers:

• SaaS subscriptions and software licenses
• Equipment and supplies purchased online
• Digital tools from out-of-state vendors
• Marketing services and design assets

Auditors specifically check purchase records for this gap. When a business shows significant out-of-state procurement but little to no use tax remitted, it is an immediate exposure area.

12. A Disproportionately High Ratio of Exempt Sales

States do not just take your exempt sales at face value. They compare your numbers against what is typical for a business like yours. If you are a direct-to-consumer seller and your exempt ratio is way above what similar businesses report, that inconsistency gets picked up automatically. 

Their systems are built to catch exactly that kind of outlier.

What auditors look for in these cases:

• Valid exemption certificates on file for every exempt sale
• Exemption reasons that match the product type and buyer category
• Consistent application of exemption rules across the audit period

An inflated exempt ratio with incomplete or missing certificate documentation is one of the most common findings in a full audit.

13. Expired, Invalid, Missing, or Misused Exemption Certificates

Exemption certificates are among the first things auditors examine and among the most common places they find problems.

A certificate can be invalidated for any of the following reasons:

• It is expired (Florida and New Mexico require periodic renewal)
• It is missing required fields: date, signature, buyer registration number, or stated reason for exemption
• It uses the wrong state’s form
• The goods were purchased tax-free under a resale certificate but used internally

Each invalidated certificate shifts the uncollected tax liability back to the seller, not the buyer. One missing certificate on a high-volume exempt customer can represent a significant assessment on its own.

14. Anonymous Tips, Competitor Complaints, or Inter-State Data Sharing

Not all audit triggers come from a seller’s filing history. States also receive tips from:

• Competitors who believe you are not collecting the same sales tax they are required to collect
• Former employees who are aware of compliance gaps
• Customers who noticed they were not charged tax when they expected to be

Beyond individual tips, inter-state data sharing is a growing enforcement mechanism. Through programs like the Multistate Tax Commission Joint Audit Program and the Streamlined Sales Tax Governing Board, member states actively share leads about businesses with potential compliance gaps. A nexus issue identified in one state can directly produce an audit notice in another.

The most effective protection against this type of trigger is having nothing to find.

See how TaxHero helped an ecommerce brand resolve a multi-state sales tax audit with a $53,914.90 liability, saving $11,405.90 after the case was closed.

What Happens After a Sales Tax Audit Trigger Is Identified

You Receive a Formal Audit Notice Outlining the Audit Period and Records Required

Once a trigger is flagged, the state sends a formal audit notification letter specifying the audit period and a full list of records required. The audit period starts from when the compliance issue began, not from when the notice was sent.

Records typically requested include:

• General ledger and journal entries
• Sales and purchase invoices
• Exemption and resale certificates
• Financial statements and federal and state tax returns
• Bank statements and shipping documentation

Start gathering these immediately. Some records may be off-site, managed by other departments, or require additional time to retrieve.

The State Auditor Reviews Your Transactions Using Sampling Methods to Assess Liability

Good news: Auditors do not sit down and comb through every single transaction on record. What they do instead is select a smaller, representative group of your transactions, review those closely, and apply what they find across your full audit period. 

That process is called sampling, and the method they use to select that group can significantly change your final liability number.

Organized and accessible records give you more ability to discuss which approach is applied and whether it fairly reflects your actual activity. Businesses with incomplete records often have less favorable sampling outcomes because auditors fill gaps with assumptions.

Penalties and Interest Begin Accumulating From the Point of Non-Compliance, Not the Audit Date

This surprises most sellers. Tax liability begins from the moment a nexus obligation exists or a filing deadline is missed, often years before the notice arrives. Interest compounds throughout the audit process as well.

By the time a final assessment is issued, the original tax owed may be only a fraction of the total due when penalties and accumulated interest are included.

How to Protect Yourself Before a Sales Tax Audit Notice Arrives

The best time to address audit exposure is before a state finds it. These three steps cover the areas where most ecommerce sellers carry the most risk, and where early action makes the biggest difference.

Conduct Regular Nexus Reviews and Reconcile Your 1099-Ks Against Every Filed Return

Review your sales activity by state every quarter. Confirm you are registered everywhere you have crossed economic nexus thresholds, including states where your FBA inventory sits. Every gap between what your payment processor reported and what you filed needs to be documented and explained.

Keep Exemption Certificates Valid, Complete, and on File for Every Tax-Free Sale

Do not wait until an audit notice arrives to find out a certificate expired six months ago. Build a system that tracks expiration dates and sends you a reminder before anything lapses. Check every certificate for required fields at the time of the sale, not after the fact. 

And remember, one invalid certificate on a high-volume exempt customer can mean a significant tax assessment coming straight back to you.

Work With a Sales Tax Professional Who Understands Multi-State Rules

Sales tax compliance across multiple states requires expertise in rules that differ by jurisdiction and change regularly. A tax advisor with multi-state experience can identify exposure before states do, maintain defensible filings, and represent your business if an audit occurs.

Is Your Ecommerce Business Showing These Red Flags?

The 14 triggers in this blog are not worst-case scenarios. They are the specific patterns that state revenue agencies are actively built to detect. Some of them may be present in your business right now.

The businesses that get audited are not always the most non-compliant. They are often simply the ones whose data became visible to a state system at the wrong moment. 

The difference between a clean record and a formal audit notice is frequently just time, and whether you find the exposure before the state does.

Concerned about your audit exposure? TaxHero can review your sales tax risk before a state contacts you first. Our CEO, a licensed CPA, personally handles audit representation, risk analysis, and compliance for ecommerce sellers across the US. 

FAQs

What do states look for in a sales tax audit?

States look for discrepancies between filed returns and third-party data from payment processors, marketplaces, and federal filings. Auditors also examine exemption certificate validity, nexus compliance, the correct application of tax rates, and whether use tax was self-reported on applicable purchases.

How does a state decide which businesses to audit?

Most states use automated scoring systems that compare returns against industry benchmarks, historical filing patterns, and third-party reports. Statistical outliers, sudden sales drops, high exempt ratios, large first filings, and 1099-K mismatches are flagged for review. Tips from competitors or customers can also initiate a targeted inquiry.

Can I get audited even if I use a marketplace like Amazon?

Yes. Marketplace facilitator laws require platforms like Amazon to collect and remit sales tax on your behalf in most states, but they do not eliminate your nexus registration obligations, particularly in states where Amazon FBA is storing your inventory. Sales through your own direct channels remain your full compliance responsibility.

What happens if I missed filing sales tax returns in multiple states?

Missing filings accumulate penalties and interest from the original due date in each state. If discovered in an audit, back taxes, compounding interest, and penalties are assessed for every unfiled period.

How long does a sales tax audit typically take?

It varies by scope and complexity. A desk audit for a single state can be resolved in a few months. A multi-state field audit can take six months to over a year. The Illinois audit TaxHero ran six months from initiation in February 2025 to final resolution in August 2025.