Tax identity theft is not a minor inconvenience. It creates a dispute with the IRS that can take nearly two years to resolve, delay your refund, and leave a trail of incorrect records on your tax account. If it has happened to you, you need to act fast and understand exactly what you are dealing with.
This post covers how tax identity theft works, the signs that you may already be a victim, the exact steps to take when you discover it, and how the IRS handles these cases from start to finish.
The Two Main Types of IRS Tax Identity Theft
Tax identity theft takes two distinct forms. Knowing which one you are dealing with changes how you respond.
Refund Fraud: Someone Files a Return in Your Name
This is the most common type. A thief uses your Social Security number and basic personal information to file a fraudulent tax return before you do, often early in the filing season. The return claims a large refund, which gets deposited into a bank account the thief controls. When you file your legitimate return, the IRS rejects it as a duplicate because a return under your SSN was already processed.
You never see the money. The thief does. And now you are the one who has to prove you are the real taxpayer.
Employment Identity Theft: Someone Uses Your SSN to Work
In this version, someone uses your Social Security number to get a job, either with a fake ID or because your information was sold on the dark web. Their employer withholds taxes and reports wages to the IRS under your SSN. At the end of the year, that income shows up on your tax record even though you never earned it.
This often surfaces as a CP2000 notice from the IRS asking why you did not report income from an employer you have never heard of, or as a W-2 arriving in the mail from a company you never worked for. The IRS may assess additional tax on wages you never received.
Signs You May Be a Victim
- The IRS rejects your e-filed return because a return using your SSN was already submitted for the same tax year.
- You receive a W-2 or 1099 from an employer or payer you have no relationship with.
- You receive an IRS CP2000 notice proposing additional tax for income you do not recognize.
- You receive an IRS notice about a tax return you did not file.
- Your IRS online account shows records you do not recognize, such as estimated tax payments you never made or a different filing status.
- You receive a notice that an IRS Online Account was created in your name, or that your account information was changed.
- The Social Security Administration notifies you of unexpected earnings reported under your number.
Any one of these is enough to act. Do not wait to confirm multiple signs before moving forward.
What to Do Immediately When You Discover Tax Identity Theft
- File Form 14039, Identity Theft Affidavit. This is the official declaration that your SSN was used fraudulently. Complete it, attach it to your paper tax return (or to the rejected return if you already tried to e-file), and mail it to the IRS. This triggers the identity theft resolution process and flags your account for review by the IRS Identity Theft Victim Assistance unit.
- Report the theft to the FTC at IdentityTheft.gov. The Federal Trade Commission maintains a dedicated identity theft portal. Filing a report there creates an official recovery plan and generates documentation you will need when dealing with creditors, employers, and other agencies.
- File a police report. Not every local department will investigate tax fraud, but having a report on file strengthens your documentation and may be required by some financial institutions if the theft has spread to other accounts.
- Continue to file your correct return. Even while the dispute is pending, you are still legally required to file. Do not skip filing because the IRS rejected your return or because a dispute is open. File on paper if the e-file system rejects your SSN, and include your Form 14039 if you have not already submitted it.
- Place a fraud alert or credit freeze with the credit bureaus. Tax identity theft often accompanies broader identity theft. Contact Equifax, Experian, and TransUnion to protect your credit while you address the tax account.
How the IRS Processes Tax Identity Theft Cases
Once you submit Form 14039, the IRS assigns your case to its Identity Theft Victim Assistance (IDTVA) unit. This is a specialized team within the IRS that handles nothing but identity theft cases.
The IRS will send you an acknowledgment letter confirming that your case is under review. At that point, your account is marked with an identity theft indicator, which prevents new fraudulent returns from being processed against your SSN while the investigation is open.
The IRS will work to verify which return is legitimate and which is fraudulent. If your refund was stolen, you will eventually receive the correct refund after the case resolves, but it will not come quickly. If the fraud involved false income being reported under your SSN, the IRS will work to remove those records from your account.
Throughout the resolution period, the IRS may send you additional IRS notices. If you receive a notice during this time, do not ignore it. Respond to each one and reference your open identity theft case number.
The realistic timeline for full resolution is 18 to 24 months. Cases involving employment identity theft can take longer because the IRS must coordinate with employers and the Social Security Administration to correct wage records. Do not expect a quick fix. Plan your finances accordingly if a refund was part of your budget.
What Happens to Your Refund vs. What Happens With False Income
If a thief stole your refund by filing first, the IRS will eventually reissue your correct refund after verifying your identity and resolving the case. You will not be penalized for the fraud. However, any interest that accrues during the resolution period is not typically paid to you because the delay is not considered the IRS’s fault once you are in the identity theft process.
If the issue is false income reported in your name, the outcome is different. The IRS must remove those erroneous wage records from your account before your correct tax liability can be calculated. Until that happens, you may receive notices proposing tax you do not owe. Document every response you send. Request transcripts regularly to track changes to your account.
The IRS Identity Protection PIN
The Identity Protection PIN, called an IP PIN, is a six-digit number assigned to taxpayers who qualify. It must be included on your federal return each year. Without the correct IP PIN, the IRS will reject any return filed using your SSN, including a fraudulent one.
This is the most effective tool available to prevent refund fraud from happening in the first place.
Originally, IP PINs were only issued to confirmed identity theft victims. As of 2021, any taxpayer can opt in voluntarily, regardless of whether they have experienced identity theft. This is a significant change that most people do not know about.
To get one, go to IRS.gov and use the Get an IP PIN tool. You will need to verify your identity through ID.me, the IRS’s third-party identity verification service. Once you opt in, you receive a new IP PIN every January via your IRS online account. You must use the current year’s PIN when filing.
One important note: if you lose your IP PIN, retrieving it requires going back through the IRS verification process. Keep a secure record of it every year.
If you were already an identity theft victim, the IRS will assign you an IP PIN automatically as part of your case resolution. You do not need to opt in separately.
Common Scams That Lead to Tax Identity Theft
- Phishing emails and text messages. Fraudsters send IRS-branded messages claiming your account is under review or that you owe an immediate payment. Clicking the link captures your SSN, login credentials, or financial information. The IRS does not initiate contact by email or text message.
- Data breaches at employers, insurers, and government agencies. Your SSN is stored in databases you cannot control. Major breaches have exposed tens of millions of records. If you receive a breach notification, take it seriously and consider opting into an IP PIN proactively.
- Social Security number theft through physical mail or document theft. Thieves target W-2 forms, Social Security statements, and tax returns from unsecured mailboxes or trash. Use a locked mailbox during tax season and shred all tax documents before disposal.
- Fake tax preparers. Unscrupulous preparers collect your SSN and financial information, file returns with inflated refunds deposited to their accounts, and disappear. Use only credentialed tax professionals.
What a Tax Professional Can and Cannot Do for You
A tax professional with a valid Power of Attorney can communicate with the IRS on your behalf, respond to notices, request transcripts, and advocate for your case with the IDTVA unit. This can reduce the burden on you significantly during a process that spans nearly two years.
What a professional cannot do is complete the identity verification steps that the IRS requires from you directly. The Form 14039 must be signed by you. If the IRS requires you to verify your identity in person at a Taxpayer Assistance Center, you must appear. If you need to verify through ID.me to retrieve your IP PIN, that step belongs to you.
A good tax professional handles the IRS communication and strategy. You handle the identity verification steps that the IRS mandates from the actual taxpayer.
IRS Tax Identity Theft Response Steps
| Action | Purpose | Who Does It | Timeline |
|---|---|---|---|
| File Form 14039 Identity Theft Affidavit | Officially alerts the IRS and triggers case assignment to IDTVA unit | Taxpayer (must be signed by you) | Immediately upon discovery |
| Report to FTC at IdentityTheft.gov | Creates federal documentation and a recovery plan | Taxpayer | Same day |
| File a police report | Provides local documentation for financial institutions | Taxpayer | Within a few days |
| File your correct tax return on paper | Preserves your filing obligation and establishes your legitimate return | Taxpayer with tax professional | By tax deadline (extension if needed) |
| Respond to IRS notices during resolution | Keeps your case active and prevents default assessments | Tax professional with POA | Within the deadline on each notice |
| Obtain IP PIN after case resolution | Prevents future fraudulent returns from being filed under your SSN | Taxpayer (via IRS.gov) | After case closes, then annually |
| IRS IDTVA case resolution | Corrects your tax account, removes fraudulent records, reissues any stolen refund | IRS Identity Theft Victim Assistance unit | 18 to 24 months from case opening |
Get Help From a Tax Professional Who Knows This Process
Tax identity theft is not something to manage on your own, especially when you are already dealing with incorrect IRS records, delayed refunds, or notices you do not understand. Luisa N. Victoria is a Federally Authorized Enrolled Agent who represents taxpayers before the IRS. She can file the necessary forms on your behalf, communicate with the IRS throughout the resolution process, and make sure your tax account is corrected accurately. If you have discovered tax identity theft or received a notice that does not match your records, get a clear picture of where your case stands before more time passes.