To file Form 14039-B for EIN identity theft, download the Business Identity Theft Affidavit from the IRS website, complete it with your entity information and the details of the suspected fraud, attach the identity-verification documents required for your entity type, and submit the package by mail or fax to the IRS. The form is the IRS’s formal channel for reporting that someone has used your Employer Identification Number to file a fraudulent return or otherwise misuse your business identity, and submitting it opens an investigation into your account.1Internal Revenue Service. Form 14039-B – Business Identity Theft Affidavit
When to File Form 14039-B
File the affidavit if you have concrete evidence that your EIN has been compromised. The most common triggers are an IRS Letter 5263C or 6042C asking you to verify a return nobody at your business filed, or an e-file rejection stating that a return for the same EIN and tax period has already been accepted.2Internal Revenue Service. Understanding Your Letter 5263C, 6042C, or 6217C If your legitimate return is rejected as a duplicate, paper-file it and report the theft.
You can also file after non-tax warning signs: bills for credit lines you never opened, unfamiliar charges on your business credit report, unexplained bank withdrawals, or expected mail that stops arriving.3Internal Revenue Service. Tax Practitioner Guide to Business Identity Theft The form has a box for businesses that experienced a data breach but haven’t yet seen fraudulent activity, so you don’t have to wait for a fake return to appear before reporting.
Completing the Affidavit
Form 14039-B is a PDF on the IRS website. Incomplete submissions delay processing, so gather everything before you start typing.1Internal Revenue Service. Form 14039-B – Business Identity Theft Affidavit
Entity and Tax Period Information
You’ll enter the business’s legal name, EIN, and current mailing address. Identify the specific tax years or periods affected and the tax form involved (Form 1120 for a corporation, Form 1065 for a partnership, and so on). Select the reason you’re filing: a fraudulent return has already been identified, the IRS notified you of one, or your business experienced a data breach without confirmed fraud yet. Choosing the right category helps the IRS prioritize the case.
Authorized Representative
The form asks for the name and contact information of the person authorized to act for the entity during the investigation. That person signs under penalties of perjury, so pick someone with actual authority and knowledge of the situation, not a delegate.
Supporting Documents by Entity Type
The IRS requires different verification documents depending on how the business is organized.1Internal Revenue Service. Form 14039-B – Business Identity Theft Affidavit
Sole proprietors must attach two items: a government-issued photo ID bearing your signature (passport, driver’s license, or similar) and a document supporting business operations, such as a utility bill, invoice, or mortgage receipt.
Corporations, partnerships, LLCs, exempt organizations, estates, and trusts submit one or more of the following: articles of incorporation, articles of organization, trust or estate documents, or a statement on corporate letterhead signed by an officer or director confirming the authorized representative’s authority to act for the entity. Important detail: the officer signing that letter cannot be the same person named as the authorized representative on the form.
All supporting documents should be legible photocopies. If you filed a police report about the theft, note that on the form. It isn’t required, but it gives the investigator useful context.
Where to Send the Completed Form
Submission depends on whether the IRS contacted you first.
If you received an IRS notice about the fraudulent activity, attach Form 14039-B to the back of that notice and return it to the address printed on the notice, or fax it to the number on the notice if one appears there.
If you’re reporting the theft on your own initiative, mail the form to Internal Revenue Service, Ogden, UT 84201, or fax it toll-free to 855-807-5720.1Internal Revenue Service. Form 14039-B – Business Identity Theft Affidavit For mail submissions, use a delivery method with tracking confirmation.
What Happens After You Submit
The IRS states that identity theft cases are generally resolved within 120 days, but backlogs have stretched real-world timelines much further. The agency’s own site has acknowledged average resolution times exceeding 600 days because of a sharp rise in identity theft case inventory.4Internal Revenue Service. How IRS ID Theft Victim Assistance Works Do not submit duplicate forms and do not call to check on your case status while you wait. The IRS says both actions add further delay.
During the investigation, the IRS reconciles your Business Master File and strips out fraudulent entries tied to your EIN. Keep meeting your legitimate tax obligations throughout the process. Missing payments or filings generates separate penalties that won’t be waived because you’re a theft victim. When the case closes, the IRS sends written notification confirming the adjustments made to your account.
State Tax Agencies
Filing Form 14039-B addresses federal tax accounts only. It does not touch your state tax file. If your business operates in a state with an income tax, contact that state’s revenue department separately. The Federation of Tax Administrators maintains a directory of state-specific reporting contacts.5Federation of Tax Administrators. Report a Data Breach for Businesses If the theft involved stolen W-2 or SSN data for your employees, also email the IRS at Dataloss@irs.gov.
Steps to Take in Parallel
The IRS investigation handles the tax side and nothing else. Your business credit profile, bank accounts, and vendor relationships need separate protection, and these steps should run at the same time as the affidavit, not after it.
Close any accounts that were tampered with or opened without authorization. Reconcile every recent statement for transactions you don’t recognize. Contact your bank’s fraud department to flag the compromised EIN.3Internal Revenue Service. Tax Practitioner Guide to Business Identity Theft
Place a fraud alert on your credit reports by contacting any one of the three major credit bureaus; that bureau is required to notify the other two. You can also request a credit freeze from each bureau directly. The IRS recommends monitoring credit reports for suspicious activity at least every 12 months going forward.3Internal Revenue Service. Tax Practitioner Guide to Business Identity Theft The three bureaus’ fraud lines:
- Equifax: 800-525-6285
- Experian: 888-397-3742
- TransUnion: 800-916-8800
You can also report the theft to the Federal Trade Commission at ReportFraud.ftc.gov or through IdentityTheft.gov, the federal government’s centralized reporting and recovery resource.