"is there anything else that I am missing?"

TCJA of 2017.

"The Impact of the Tax Cuts and Jobs Act on Casualty and Theft Losses

According to the IRS's publication 547 "Casualties, Disasters, and Thefts," "Personal casualty and theft losses of an individual sustained in a tax year beginning after 2017 are deductible only to the extent they're attributable to a federally declared disaster."3 By extension, this means human activities, such as terrorist attacks, theft and vandalism that are not declared federal emergencies by the President are also not covered."

Under what condition would the theft be deductible. in other words. It doesn't seem, for instance, that the money was "rolled" into a bogus investment.

You say the thief withdrew the money from her IRA, so what happened to the money

Where is Paul Harvey when you really need him to tell us the rest of the story?

Why do you consider this income?  Because it's shown on a piece of paper?  But we know that the Internal Revenue Code of 1986 enacts a tax on income, not on pieces of paper.  

Let's say I'm walking down the street and see IronMan, who owes me $100 for a used anvil I sold him last week.  He pulls out his wallet and starts to hand me a Benjamin.  But a thief runs by and yanks it out of our hands just as the transaction is about to be completed.  Do I have income? Do I have a deduction?  Does he still owe me some money?  

There's going to be a 1099-R for $500,000.

Unfortunately, the client is elderly and a smooth talking scammer got her on the telephone and was able to connect remotely to her computer.  He told her that her computer had been infected with a virus and that he was from her bank and was trying to protect her account.  He managed to talk her into logging into various accounts including her IRA account and proceeded to transfer a large portion of her financial accounts to overseas accounts.  The majority of it was drawn from her IRA.  Really cleaned her out!  The banks and financial institutions aren't offering much if any help.

She has income because she withdrew money from her IRA.  That money was immediately stolen.  Obviously if she had money stolen from her checking account there would be no income, but this was a distribution from her IRA.  If for example, you withdrew $10,000 from your IRA and invested it in ABC stock and the stock immediately went belly up, you would still have to report the IRA distribution.

TCJA is exactly what I am worried about and hoping there is some sort of work around.

The client is already utterly heart broken that she allowed herself to be ripped off like that.  Worse yet, the amount stolen represents the bulk of her retirement savings. 

If she does receive a 1099R, why not report it and then use a negative other income amount to back it off?  Then add a nice statement to the return (that probably won't get read by the IRS on the first pass) saying the 1099R was generated but the taxpayer never received the funds due to some scumbag.  If there is anyone deserving to get COVID and suffer a long and painful death from it, I think these are the people.

First it was " the scammer was able to gain control of her computer and withdrew almost $500,000 from her IRA."

Now it's "she withdrew money from her IRA."

Just get your stories straight before running it by IRS.  

You asked about reporting this for 2021. Is there still time to report it under the CFPB 60-day rule?

https://www.dwt.com/blogs/financial-services-law-advisor/2021/06/cfpb-unauthorized-transfer-consumer...