For educational purposes only — not tax, legal, or financial advice. Tax laws change frequently. Consult a qualified CPA, Enrolled Agent, or tax attorney for your specific situation.

    Skip to main content
    TaxKilnUS tax guidance
    Back to home

    Tax Identity Theft

    File Form 14039 (Identity Theft Affidavit) with the IRS immediately. File your legitimate return on paper. Place a fraud alert on your credit reports with all three bureaus. Report the theft to the FTC at IdentityTheft.gov. Request an IP PIN from the IRS for future protection. Resolution typically takes 120 to 180 days, but can take longer in complex cases.

    TaxKiln Editorial · Last reviewed:

    Tax-related identity theft happens when someone uses your Social Security number to file a fraudulent tax return and claim a refund in your name. You typically discover it when you try to e-file your legitimate return and it is rejected because a return has already been filed under your SSN, or when you receive an IRS notice about income you did not earn. The IRS received over 1.1 million identity theft reports in 2023 and processed over $5.7 billion in fraudulent refund claims. If this has happened to you, your legitimate refund will be delayed, but you will receive it. This guide walks through exactly what to do, in what order, and how to protect yourself going forward.

    Key mechanics

    How tax identity theft works and how you discover it

    Tax identity theft occurs when a criminal obtains your Social Security number (SSN) and uses it to file a fraudulent tax return claiming a refund. The fraudster typically files early in the tax season, before you file your legitimate return, using fabricated income and withholding information designed to generate a large refund. The refund is directed to a bank account, prepaid debit card, or address controlled by the thief.

    You may discover the theft in several ways. The most common is when your electronically filed return is rejected because the IRS has already accepted a return with your SSN for that tax year. You may also receive an IRS notice (CP01A, Letter 5071C, or Letter 4883C) asking you to verify your identity because the IRS detected suspicious activity. Other indicators include: receiving a tax transcript you did not request, receiving a notice that an online account was created in your name, receiving a W-2 or 1099 from an employer you do not recognise, or receiving a notice that you owe additional tax or your refund was offset for a debt you do not recognise.

    Tax identity theft is distinct from general identity theft (credit card fraud, loan fraud, etc.) because it specifically involves the IRS and tax returns. However, if someone has your SSN, they may be committing both types of fraud simultaneously. Your response should address both the tax and financial dimensions.

    Tax identity theft occurs when someone files a fraudulent return using your SSN. You typically discover it when your return is rejected or you receive an IRS notice about suspicious activity. (IRM 25.23.1 (Identity Protection Program Overview); IRS Publication 5027 (Identity Theft Information for Taxpayers))

    Form 14039 and the IRS identity theft resolution process

    Form 14039 (Identity Theft Affidavit) is the primary document for reporting tax identity theft to the IRS. You should file this form if your e-filed return was rejected because a return was already filed under your SSN, or if the IRS instructs you to file it. You do not need to file Form 14039 if the IRS sent you Letter 5071C or 4883C (identity verification letters); instead, follow the instructions in those letters to verify your identity online or by phone.

    When you file Form 14039, include a copy of a government-issued photo ID (driver's licence or passport), a copy of a document showing your SSN (Social Security card, W-2, or 1099), and your completed Form 14039. If you are filing because your e-filed return was rejected, also file a paper return (Form 1040) by mail. Write "Identity Theft Victim" at the top of the return and attach Form 14039. Mail everything to the IRS address for your state as listed in the Form 1040 instructions.

    The IRS will assign your case to the Identity Protection Specialized Unit (IPSU). The IPSU will investigate the fraudulent return, remove it from your account, and process your legitimate return. This process typically takes 120 to 180 days, but complex cases or cases involving multiple tax years can take longer. During this period, you can check the status of your case by calling the IRS Identity Protection Specialized Unit at 800-908-4490. Once resolved, the IRS will send you a CP01A notice with an Identity Protection PIN (IP PIN) for future filing.

    If you have been impacted by a data breach at a specific company, the IRS may send you a CP01E notice with an IP PIN even before you experience identity theft. This is a proactive measure, and you should use the IP PIN on all future returns.

    File Form 14039 with supporting ID documents and a paper tax return. The IRS Identity Protection Specialized Unit handles resolution, which typically takes 120 to 180 days. (IRM 25.23.2 (Taxpayer Identity Theft Case Processing); IRM 25.23.4 (Identity Theft Victim Assistance))

    IP PINs: proactive protection for every taxpayer

    An Identity Protection PIN (IP PIN) is a six-digit number that the IRS issues to taxpayers to prevent fraudulent returns from being filed under their SSN. When you have an IP PIN, any tax return filed with your SSN must include the correct IP PIN or it will be rejected. This effectively blocks fraudsters from filing under your SSN even if they have all your other personal information.

    Since January 2021, any taxpayer can opt into the IP PIN programme. You do not need to be a prior identity theft victim. You can request an IP PIN through the IRS Online Account at IRS.gov (requires identity verification through ID.me), by filing Form 15227 (Application for an Identity Protection Personal Identification Number) if you cannot verify online and your income is $79,000 or less ($158,000 married filing jointly), or by scheduling an in-person appointment at a local IRS Taxpayer Assistance Center.

    Once enrolled, you will receive a new IP PIN every year, typically in December or January. You must use the current year's IP PIN when filing your return. If you lose or forget your IP PIN, you can retrieve it through your IRS Online Account or by calling the IRS. Do not share your IP PIN with anyone other than your tax preparer when filing your return. The IRS will never call, email, or text you to request your IP PIN.

    Important: the IP PIN programme is per-individual, not per-household. Each person whose SSN appears on a tax return (you, your spouse, and your dependents) should have their own IP PIN for maximum protection. You can request IP PINs for your dependents through the same channels.

    Any taxpayer can request a free IP PIN that blocks fraudulent returns from being filed under their SSN. A new PIN is issued annually and must be included on every tax return. (IRC Section 6109(e) (IP PIN authority); IRM 25.23.10 (Identity Protection PIN Program); IRS.gov/IPPIN)

    Action steps

    1. 1

      Respond to IRS identity verification letters immediately

      If you received Letter 5071C, Letter 4883C, or Letter 6331C, follow the instructions to verify your identity. For 5071C, go to the IRS Identity Verification Service at idverify.irs.gov or call the number on the letter. For 4883C, call the number on the letter with your prior-year return, current-year return (if filed), and supporting documents. Do not ignore these letters; the IRS will not process your return until your identity is verified.

    2. 2

      File Form 14039 and a paper tax return

      Complete Form 14039 (available at IRS.gov). Attach a copy of your government-issued photo ID and a document showing your SSN. If your e-filed return was rejected, prepare a paper Form 1040, write 'Identity Theft Victim' at the top, and attach Form 14039. Mail everything to the IRS. Keep copies of everything you send.

    3. 3

      Place a fraud alert and consider a credit freeze

      Contact one of the three credit bureaus (Equifax: 800-525-6285, Experian: 888-397-3742, TransUnion: 800-680-7289) to place an initial fraud alert. The bureau you contact is required to notify the other two. An initial fraud alert lasts one year. If you are a confirmed identity theft victim, you can place an extended fraud alert lasting seven years. For stronger protection, place a credit freeze with all three bureaus, which prevents anyone from opening new credit in your name until you lift the freeze.

    4. 4

      Report to the FTC and file a police report

      Report the identity theft to the Federal Trade Commission at IdentityTheft.gov. The FTC will generate a personalised recovery plan and an Identity Theft Report that you can use with creditors and the police. File a police report with your local police department. While local police may not investigate tax identity theft directly, the police report strengthens your case with the IRS, credit bureaus, and any financial institutions affected.

    5. 5

      Request an IP PIN for future protection

      After your identity theft case is resolved, the IRS should automatically send you an IP PIN (notice CP01A). If you do not receive one, request it through your IRS Online Account at IRS.gov/IPPIN. Enrol every member of your household who has an SSN. Use the IP PIN on every future tax return. Keep the PIN in a secure location and do not share it except with your trusted tax preparer.

    6. 6

      Check your state tax returns as well

      Many states have their own identity theft reporting processes. If someone filed a fraudulent federal return under your SSN, they may have filed a fraudulent state return as well. Contact your state's department of revenue or taxation to inquire about filings under your SSN. Most states accept Form 14039 or have their own identity theft affidavit. File your legitimate state return on paper with a note about the identity theft.

    State variance

    California

    The Franchise Tax Board has a dedicated identity theft unit. File FTB Form 3552 (Identity Theft Affidavit) in addition to the federal Form 14039. California also has a data breach notification law (Cal. Civ. Code Section 1798.82) that may entitle you to notification and services if your data was compromised in a breach.

    New York

    New York requires businesses to notify residents of data breaches under the SHIELD Act. Report state tax identity theft to the New York Department of Taxation and Finance by calling 518-457-5181. New York issues its own security codes for identity theft victims, separate from the federal IP PIN.

    Florida

    Florida has historically been one of the highest-volume states for tax identity theft. Florida does not have a state income tax, so state tax identity theft is not a concern, but federal returns with Florida addresses are subject to enhanced IRS scrutiny for identity theft indicators.

    Texas

    Texas has no state income tax. Tax identity theft in Texas is a federal issue only. Texas has strong identity theft criminal penalties under Penal Code Section 32.51.

    Frequently asked questions

    What happens if I miss the April 15 tax deadline?+
    If you owe tax, the IRS charges two separate penalties: failure to file (5% of unpaid tax per month, max 25% under IRC §6651(a)(1)) and failure to pay (0.5% per month, max 25%). File Form 4868 for an automatic 6-month extension — but the extension only extends the FILING deadline, not the PAYMENT deadline. Interest accrues from April 15 regardless. If you have a clean 3-year history, you may qualify for First Time Abatement (FTA) to waive the failure-to-file penalty.
    Do I need a CPA or can I file my own taxes?+
    Most self-employed people with straightforward Schedule C income can file using tax software (TurboTax, FreeTaxUSA, TaxAct). Consider a CPA or Enrolled Agent (EA) if you have: an S-Corp election, multi-state filing, rental property with cost segregation, your first year of self-employment (to set up correctly), or an IRS notice. EAs are federally licensed and often less expensive than CPAs. The IRS Volunteer Income Tax Assistance (VITA) program offers free help for incomes under $67,000.
    How do quarterly estimated tax payments work?+
    Self-employed people must pay estimated tax quarterly (April 15, June 15, September 15, January 15) if they expect to owe $1,000 or more. The safe harbor under IRC §6654 is paying at least 100% of prior-year tax (110% if AGI exceeded $150,000). Use Form 1040-ES or pay via IRS Direct Pay or EFTPS. Missing payments triggers an underpayment penalty calculated per quarter — even if you pay everything at filing time.
    Will I still get my refund if someone filed a fraudulent return under my SSN?+
    Yes. Once the IRS resolves your identity theft case and processes your legitimate return, you will receive your correct refund. The IRS will also pay you interest on the delayed refund from the original due date of your return. The process takes time (typically 120 to 180 days), but you are entitled to every dollar of your legitimate refund. Do not let frustration with the delay prevent you from filing Form 14039 and your paper return.
    Can I e-file in future years after being an identity theft victim?+
    Yes. Once the IRS issues you an IP PIN, you can e-file normally by including the IP PIN on your return. The IP PIN acts as a second authentication factor that prevents fraudulent returns. You will receive a new IP PIN each year. If your tax software asks for the IP PIN, enter it in the designated field. If you file on paper, write the IP PIN in the space provided on the form.
    What if the identity thief used my SSN to get a job, not just to file a tax return?+
    Employment-related identity theft (where someone uses your SSN to obtain employment) creates additional complications. The employer will issue a W-2 or 1099 to the IRS under your SSN for income you did not earn. When you file your return, the IRS computer will flag a mismatch between the income reported to them and the income on your return. File Form 14039, and also contact the Social Security Administration (800-772-1213) to ensure the fraudulent earnings do not appear on your Social Security record, which could affect your future benefits. You may also need to contact the employer to request a corrected W-2.
    Should I pay for identity theft monitoring services?+
    Credit monitoring services can be helpful but are not necessary for resolving tax identity theft. The most effective protection is a credit freeze with all three bureaus (free by law) and an IP PIN with the IRS (also free). If your information was compromised in a data breach, the breached company may offer free monitoring for a period. The FTC's IdentityTheft.gov provides free recovery tools and monitoring guidance. If you choose to pay for monitoring, understand that it alerts you to suspicious activity after the fact; it does not prevent identity theft. A credit freeze is stronger protection than monitoring.

    Last reviewed: