Tax identity theft is not a minor inconvenience. It creates a dispute with the IRS that can take nearly two years to resolve, delay your refund, and leave a trail of incorrect records on your tax account. If it has happened to you, you need to act fast and understand exactly what you are dealing with.

This post covers how tax identity theft works, the signs that you may already be a victim, the exact steps to take when you discover it, and how the IRS handles these cases from start to finish.

The Two Main Types of IRS Tax Identity Theft

Tax identity theft takes two distinct forms. Knowing which one you are dealing with changes how you respond.

Refund Fraud: Someone Files a Return in Your Name

This is the most common type. A thief uses your Social Security number and basic personal information to file a fraudulent tax return before you do, often early in the filing season. The return claims a large refund, which gets deposited into a bank account the thief controls. When you file your legitimate return, the IRS rejects it as a duplicate because a return under your SSN was already processed.

You never see the money. The thief does. And now you are the one who has to prove you are the real taxpayer.

Employment Identity Theft: Someone Uses Your SSN to Work

In this version, someone uses your Social Security number to get a job, either with a fake ID or because your information was sold on the dark web. Their employer withholds taxes and reports wages to the IRS under your SSN. At the end of the year, that income shows up on your tax record even though you never earned it.

This often surfaces as a CP2000 notice from the IRS asking why you did not report income from an employer you have never heard of, or as a W-2 arriving in the mail from a company you never worked for. The IRS may assess additional tax on wages you never received.

Signs You May Be a Victim

• The IRS rejects your e-filed return because a return using your SSN was already submitted for the same tax year.
• You receive a W-2 or 1099 from an employer or payer you have no relationship with.
• You receive an IRS CP2000 notice proposing additional tax for income you do not recognize.
• You receive an IRS notice about a tax return you did not file.
• Your IRS online account shows records you do not recognize, such as estimated tax payments you never made or a different filing status.
• You receive a notice that an IRS Online Account was created in your name, or that your account information was changed.
• The Social Security Administration notifies you of unexpected earnings reported under your number.

Any one of these is enough to act. Do not wait to confirm multiple signs before moving forward.

What to Do Immediately When You Discover Tax Identity Theft

1. File Form 14039, Identity Theft Affidavit. This is the official declaration that your SSN was used fraudulently. Complete it, attach it to your paper tax return (or to the rejected return if you already tried to e-file), and mail it to the IRS. This triggers the identity theft resolution process and flags your account for review by the IRS Identity Theft Victim Assistance unit.
2. Report the theft to the FTC at IdentityTheft.gov. The Federal Trade Commission maintains a dedicated identity theft portal. Filing a report there creates an official recovery plan and generates documentation you will need when dealing with creditors, employers, and other agencies.
3. File a police report. Not every local department will investigate tax fraud, but having a report on file strengthens your documentation and may be required by some financial institutions if the theft has spread to other accounts.
4. Continue to file your correct return. Even while the dispute is pending, you are still legally required to file. Do not skip filing because the IRS rejected your return or because a dispute is open. File on paper if the e-file system rejects your SSN, and include your Form 14039 if you have not already submitted it.
5. Place a fraud alert or credit freeze with the credit bureaus. Tax identity theft often accompanies broader identity theft. Contact Equifax, Experian, and TransUnion to protect your credit while you address the tax account.

How the IRS Processes Tax Identity Theft Cases

Once you submit Form 14039, the IRS assigns your case to its Identity Theft Victim Assistance (IDTVA) unit. This is a specialized team within the IRS that handles nothing but identity theft cases.

The IRS will send you an acknowledgment letter confirming that your case is under review. At that point, your account is marked with an identity theft indicator, which prevents new fraudulent returns from being processed against your SSN while the investigation is open.

The IRS will work to verify which return is legitimate and which is fraudulent. If your refund was stolen, you will eventually receive the correct refund after the case resolves, but it will not come quickly. If the fraud involved false income being reported under your SSN, the IRS will work to remove those records from your account.

Throughout the resolution period, the IRS may send you additional IRS notices. If you receive a notice during this time, do not ignore it. Respond to each one and reference your open identity theft case number.

The realistic timeline for full resolution is 18 to 24 months. Cases involving employment identity theft can take longer because the IRS must coordinate with employers and the Social Security Administration to correct wage records. Do not expect a quick fix. Plan your finances accordingly if a refund was part of your budget.

What Happens to Your Refund vs. What Happens With False Income

If a thief stole your refund by filing first, the IRS will eventually reissue your correct refund after verifying your identity and resolving the case. You will not be penalized for the fraud. However, any interest that accrues during the resolution period is not typically paid to you because the delay is not considered the IRS’s fault once you are in the identity theft process.

If the issue is false income reported in your name, the outcome is different. The IRS must remove those erroneous wage records from your account before your correct tax liability can be calculated. Until that happens, you may receive notices proposing tax you do not owe. Document every response you send. Request transcripts regularly to track changes to your account.

The IRS Identity Protection PIN

The Identity Protection PIN, called an IP PIN, is a six-digit number assigned to taxpayers who qualify. It must be included on your federal return each year. Without the correct IP PIN, the IRS will reject any return filed using your SSN, including a fraudulent one.

This is the most effective tool available to prevent refund fraud from happening in the first place.

Originally, IP PINs were only issued to confirmed identity theft victims. As of 2021, any taxpayer can opt in voluntarily, regardless of whether they have experienced identity theft. This is a significant change that most people do not know about.

To get one, go to IRS.gov and use the Get an IP PIN tool. You will need to verify your identity through ID.me, the IRS’s third-party identity verification service. Once you opt in, you receive a new IP PIN every January via your IRS online account. You must use the current year’s PIN when filing.

One important note: if you lose your IP PIN, retrieving it requires going back through the IRS verification process. Keep a secure record of it every year.

If you were already an identity theft victim, the IRS will assign you an IP PIN automatically as part of your case resolution. You do not need to opt in separately.

Common Scams That Lead to Tax Identity Theft

• Phishing emails and text messages. Fraudsters send IRS-branded messages claiming your account is under review or that you owe an immediate payment. Clicking the link captures your SSN, login credentials, or financial information. The IRS does not initiate contact by email or text message.
• Data breaches at employers, insurers, and government agencies. Your SSN is stored in databases you cannot control. Major breaches have exposed tens of millions of records. If you receive a breach notification, take it seriously and consider opting into an IP PIN proactively.
• Social Security number theft through physical mail or document theft. Thieves target W-2 forms, Social Security statements, and tax returns from unsecured mailboxes or trash. Use a locked mailbox during tax season and shred all tax documents before disposal.
• Fake tax preparers. Unscrupulous preparers collect your SSN and financial information, file returns with inflated refunds deposited to their accounts, and disappear. Use only credentialed tax professionals.

What a Tax Professional Can and Cannot Do for You

A tax professional with a valid Power of Attorney can communicate with the IRS on your behalf, respond to notices, request transcripts, and advocate for your case with the IDTVA unit. This can reduce the burden on you significantly during a process that spans nearly two years.

What a professional cannot do is complete the identity verification steps that the IRS requires from you directly. The Form 14039 must be signed by you. If the IRS requires you to verify your identity in person at a Taxpayer Assistance Center, you must appear. If you need to verify through ID.me to retrieve your IP PIN, that step belongs to you.

A good tax professional handles the IRS communication and strategy. You handle the identity verification steps that the IRS mandates from the actual taxpayer.

IRS Tax Identity Theft Response Steps

Get Help From a Tax Professional Who Knows This Process

Tax identity theft is not something to manage on your own, especially when you are already dealing with incorrect IRS records, delayed refunds, or notices you do not understand. Luisa N. Victoria is a Federally Authorized Enrolled Agent who represents taxpayers before the IRS. She can file the necessary forms on your behalf, communicate with the IRS throughout the resolution process, and make sure your tax account is corrected accurately. If you have discovered tax identity theft or received a notice that does not match your records, get a clear picture of where your case stands before more time passes.

Book My Strategy Session

You opened an envelope from the IRS and the words “proposed changes” jumped off the page. Your stomach dropped. Take a breath. A CP2000 notice is not a criminal notice. It is not a final bill. The IRS has not assessed anything against you yet.

But here is what you need to understand right now: this notice has a hard deadline, usually 60 days from the date printed on the letter. Miss it, and the proposed amount becomes an automatic assessment. After that, penalties and interest start stacking, and the IRS moves toward collection.

This is serious. You need to respond correctly and on time. This post will walk you through exactly what a CP2000 is, how to read it, and what your options are.

What Is a CP2000 Notice?

A CP2000 is generated by the IRS Automated Underreporter (AUR) program. Every year, banks, brokerages, employers, and other payers send the IRS copies of every 1099, W-2, and financial information return they issue. The IRS then runs a matching program, comparing those third-party reports against what appeared on your filed tax return.

When the income on your return does not match what was reported to the IRS, the system flags it. The result is a CP2000: a computer-generated letter proposing additional tax, penalties, and interest based on the discrepancy.

The IRS sends millions of these notices every year. You are not being singled out, and you are not under criminal investigation. This is an automated process. That said, the dollar amounts proposed can be significant, especially if the notice involves unreported investment income, freelance earnings, or retirement distributions.

How to Read Your CP2000 Notice

The CP2000 is organized into several distinct sections. Understanding what each section says prevents you from making a costly mistake.

The Proposed Changes Section

This is the core of the notice. It lists the income items the IRS says were reported to them by third parties but do not appear on your return. Each line shows the payer, the type of income, and the amount the IRS received from that payer.

Read this section carefully. The IRS is not always right. Brokers, employers, and financial institutions make reporting errors. The income listed may have already been included in your return under a different line or entry.

The Tax, Penalty, and Interest Amounts

Below the proposed changes, the notice shows the IRS’s calculation of what you would owe if the changes are accepted. This typically includes:

• Additional tax on the unreported income
• A 20% accuracy-related penalty in many cases
• Interest calculated from the original due date of your return

This is the proposed amount, not a final bill. You have the right to dispute it.

Your Three Response Options

The CP2000 presents three paths. Choosing the wrong one, or choosing nothing, will cost you.

Common Reasons the IRS Sends CP2000 Notices

These are the income types that generate CP2000 notices most often.

1099-B Stock Sales With Missing or Incorrect Cost Basis

This is one of the most frequent causes. You sold stock or mutual fund shares. The broker reported the gross proceeds to the IRS on a 1099-B. If the cost basis was missing or not reported correctly, your return may show a gain that does not match the broker’s report. The IRS proposes tax on the full proceeds as if your cost basis were zero. That is almost never correct.

1099-NEC Freelance or Self-Employment Income

A client paid you $2,400 to build their website and filed a 1099-NEC. If that income did not appear on your Schedule C, the IRS flags it. Even if you had expenses that would wipe out the tax, the matching program only sees the income.

1099-R Retirement Distributions

An early withdrawal or a taxable rollover that was not properly reported triggers the AUR program frequently. Rollovers done incorrectly or reported on the wrong line of Form 1040 are common sources of CP2000 notices.

1099-INT and 1099-DIV Interest and Dividends

Small amounts of bank interest or dividends get overlooked at tax time. If the financial institution filed a 1099-INT or 1099-DIV and the income did not appear on your return, expect a notice.

A Forgotten W-2 From a Second Job

You worked two jobs during the year. You filed using only one W-2. The employer from the second job filed their W-2 with the IRS. The AUR program catches it immediately.

Before You Respond: Verify Whether the IRS Is Correct

This is the most important step, and most people skip it. Do not agree to a CP2000 before you verify the discrepancy is real.

Here is how to do that.

Pull Your Original Return

Get a copy of the exact return that was filed for the year shown on the notice. Look at every income line: wages, interest, dividends, capital gains, other income, Schedule C, Schedule D. You need to see precisely what was reported and where.

Match Each Item on the CP2000 Against Your Records

Go line by line through the proposed changes. For each 1099 or W-2 the IRS says is missing, check whether that income was included in your return under a different entry or combined with another figure. Sometimes income is reported correctly but under a slightly different format, and the AUR program flags it as missing.

Check Cost Basis for Investment Sales

If the notice involves a 1099-B, pull the original brokerage statements for that year. Find the actual purchase price and date for every security sold. If the broker failed to report cost basis to the IRS (common for older shares), you are responsible for proving your basis with trade confirmations or account statements.

A capital gain that looks like $18,000 of taxable income might actually be $1,200 once correct cost basis is applied. You must document that and send it to the IRS with your response.

Look for Reporting Errors by the Payer

Payers make mistakes. A 1099 may have been issued with the wrong dollar amount, or the same income may have been reported twice under different taxpayer identification numbers. If a payer’s 1099 is wrong, you may need to contact the payer and request a corrected form before responding to the IRS.

What Happens If You Ignore a CP2000

Ignoring this notice is the worst possible decision. Here is what follows.

If you do not respond by the deadline, the IRS treats the proposed changes as accepted. The tax is assessed automatically. Once assessed, the IRS adds a failure-to-pay penalty of 0.5% per month, plus interest at the federal short-term rate plus 3%. That balance grows every month.

After assessment, the IRS sends a CP2501, then a CP3219A statutory notice of deficiency. At that stage you have 90 days to petition the Tax Court, or the assessment becomes final with no further appeal rights through that channel. Once it is final, the IRS can file a federal tax lien, levy your bank accounts, and garnish your wages.

None of that is inevitable. All of it is avoidable if you respond correctly and on time.

The 60-Day Deadline and How to Get More Time

The response deadline on a CP2000 is printed at the top of the notice. It is typically 60 days from the date of the letter. Do not count from the day you received it. Count from the date printed on the notice itself.

If you need more time to gather records, you can call the IRS at the number on the notice and request a 30-day extension before the deadline passes. Extensions are not guaranteed, but the IRS routinely grants them to taxpayers who call proactively. Do not wait until the day before the deadline to make that call.

If a tax professional is handling your response, they can request the extension on your behalf and ensure the response package is complete before it is submitted.

When You Should Get Professional Help

Some CP2000 notices are straightforward. You forgot one small 1099-INT for $84 in bank interest. You agree, pay the $20 in tax and interest, and move on.

Most are not that simple. If your notice involves:

• Investment sales with missing cost basis
• Self-employment income where expenses reduce what you owe
• Retirement distributions with complicated tax treatment
• Multiple income items across different payers
• A proposed balance over $1,000
• Any item you cannot clearly identify or verify

…then you need representation before you respond. A wrong response locks you into a position that is difficult and expensive to undo.

Luisa N. Victoria is a Federally Authorized Enrolled Agent with unlimited representation rights before the IRS. She handles CP2000 responses, audits, and tax resolution for individuals and small businesses in all 50 states. Her practice is built specifically for situations like this one.

Learn more about how she handles IRS notices and audits on the Audit Representation page, or book a strategy session directly below.

Book My Strategy Session