How Can Tax Identity Theft Occur? Methods, Signs, and Prevention

Tax identity theft can occur in several ways: a scammer tricks you into handing over personal information, a data breach at an employer or vendor exposes your Social Security number, someone steals your mail or paper records, a dishonest tax preparer misuses what you gave them, or a fraud ring stitches your SSN into a fabricated identity. In every version, the criminal’s goal is the same — file a fake return under your name and grab the refund before you do. Most victims first find out when their own e-filed return is rejected because the IRS already accepted one using their Social Security number.¹ Cleaning it up has taken victims an average of about 22 months, with the legitimate refund frozen the whole time.²

Phishing, Smishing, and Impersonation

Fraudulent emails, texts, and phone calls are the most direct route. Scammers pose as IRS agents, tax software companies, or banks, and their messages manufacture urgency: a problem with your account, a threat of legal action, an unclaimed refund waiting for you to verify. The IRS does not initiate contact by email or text to request personal information or account verification.³

Modern phishing messages often include QR codes or links that lead to a convincing replica of an IRS or tax-software login page. Enter your credentials and the thief has everything needed to file in your name. Some links go further and install malware that captures financial data stored on your device.³ Caller-ID spoofing can make a phone call appear to come from an IRS office. When the real IRS needs something from you, it sends a letter.

Data Breaches at Employers, Payroll Vendors, and Financial Institutions

Many victims never interact with the thief. Criminals hack into the systems of employers, payroll processors, health insurers, and banks to steal bulk records. A single breach can expose millions of Social Security numbers alongside names, addresses, and income figures. Once that data reaches underground markets, fraud rings buy it in batches and file hundreds of fake returns before anyone notices.

Individual precautions like strong passwords and two-factor authentication on your own accounts cannot prevent a breach at your employer’s payroll vendor. You are only as secure as the weakest organization holding your data. That is why watching for warning signs and locking your account down with an IRS Identity Protection PIN matter so much: they act as a second line of defense when prevention at the source fails.

Stolen Mail and Paper Records

Old-fashioned theft still works. Employers must furnish W-2s to employees by early February, and financial institutions send 1099s on a similar schedule.⁴ Residential mailboxes become a target from late January through April. One intercepted envelope hands a thief your full name, address, Social Security number, and exact earnings for the year.

Dumpster diving through discarded financial records and the theft of wallets and purses are still common. A stolen Social Security card paired with a driver’s license is enough to pass basic identity checks when filing electronically. These methods bypass digital security entirely, which is why shredding paper records and using a locked mailbox or P.O. box during tax season matters as much as any cybersecurity measure.

Dishonest Tax Return Preparers

The person you hire to do your taxes already has everything a thief would need: Social Security number, income, filing status, bank routing numbers. Most preparers are honest. The ones who aren’t can do serious damage. The IRS warns about “ghost” preparers who complete a return but refuse to sign it or include their Preparer Tax Identification Number (PTIN).⁵ The missing signature is the biggest red flag.

Warning signs of a dishonest preparer include:

No PTIN on the return. Every paid preparer is required to have a current PTIN and include it in the paid-preparer section of any return they complete.⁶
Asking you to sign a blank return. No legitimate preparer needs your signature before the return is finished.
Promising unusually large refunds. Ghost preparers inflate refunds by inventing deductions or claiming credits you don’t qualify for, then disappear after filing.⁵
Directing part of the refund to their own account. Some preparers secretly alter the direct-deposit routing so a portion of the refund goes to them.

You remain legally responsible for everything on a return filed under your name, even if a preparer fabricated the numbers without your knowledge. Many people only learn about the fraud when an audit notice arrives months later.

Theft of a Child’s or Dependent’s SSN

Children are attractive targets because their Social Security numbers have no filing history and nobody is monitoring them. A criminal uses the child’s SSN to file a fraudulent return claiming fabricated income and pockets the refund. Parents often discover it years later, when they try to claim their child as a dependent and the return is rejected because someone else already used that SSN.⁷ Parents and legal guardians can request an Identity Protection PIN for their dependents, which blocks anyone else from filing under that child’s SSN.⁸

Business EIN Theft

Individuals are not the only targets. Criminals steal or fabricate Employer Identification Numbers to file fraudulent business returns, often to claim refundable business credits. Sometimes the aim is to generate fake W-2s under a real business’s EIN, which then feeds individual identity theft for the fictitious employees listed on those forms. Signs that a business’s EIN has been compromised include IRS notices about employees the business never hired, unexpected activity on a dormant or closed account, or a return being accepted as an “amended” filing when the business never submitted an original.⁹

Synthetic Identity Fraud

A newer method blends a real Social Security number with a fabricated name, date of birth, and address. Because the resulting identity does not belong to any real individual, nobody is monitoring credit reports or watching for suspicious filings, and criminals get a long runway to build a fake paper trail before filing fraudulent returns.

Artificial intelligence has made this worse. Fraud rings use AI tools to generate tax documents and pay stubs that mimic the formatting of genuine IRS forms, including current deduction categories and reporting rules. Automated validation systems that rely on pattern matching struggle to flag these fabricated documents because they look consistent with real filings. Synthetic identity fraud can go undetected for years, and when it surfaces, the real person attached to that stolen SSN inherits the problem.

Warning Signs You’ve Been Targeted

Tax identity theft is usually invisible until you try to file or an unexpected notice arrives. Watch for these signs:

Your e-filed return is rejected because a return was already filed using your Social Security number.¹
An IRS letter reports wages from an employer you have never worked for.
You receive a balance-due or collection notice, or a refund offset, for tax you don’t recognize.
A tax transcript arrives in the mail that you never requested.
You get a confirmation for a tax-software account you didn’t create, or a notice that your existing account was accessed or disabled without your involvement.¹
You receive an EIN assignment letter for a business you never applied for.¹

Any of these should prompt immediate action. The sooner you report it, the faster the IRS can place a protective marker on your account.

What to Do If You’re a Victim

File IRS Form 14039, the Identity Theft Affidavit. You can complete it online at irs.gov or through the FTC’s IdentityTheft.gov portal, which transfers the form to the IRS electronically. You can also print the form and mail or fax it.¹ One exception: if you have already received an IRS identity-verification letter such as Letter 5071C or Letter 4883C, follow the instructions in that letter instead of filing Form 14039.

Once the IRS verifies your claim, it removes the fraudulent return from your account and generally places a permanent identity-theft marker that triggers an annual Identity Protection PIN for future filings.¹ Expect a long wait. The Taxpayer Advocate Service has reported that identity-theft cases take an average of about 22 months to resolve, and refunds are held until the case closes.² While the case is open, you can still file your legitimate return on paper. The IRS will hold the refund until the investigation ends, but filing establishes your claim.

How to Prevent It

The single most effective step is requesting an Identity Protection PIN from the IRS. An IP PIN is a six-digit number known only to you and the IRS that must appear on your federal return before the IRS will accept it. Without the correct PIN, a fraudulent return filed under your Social Security number is automatically rejected.⁸

Anyone with a Social Security number or ITIN can enroll, and parents can request one for their dependents. The fastest way is through your IRS online account. If you can’t verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can apply using Form 15227. Otherwise, you can schedule an in-person appointment at a Taxpayer Assistance Center.⁸ The PIN changes every year and is typically available in your online account starting in mid-January.

A few habits round out the defense. File your return as early as possible so a thief cannot beat you to it. Use a locked mailbox during tax season. Shred anything with your Social Security number on it. Never respond to unsolicited emails or texts asking for personal information. No single step makes you invulnerable, but an IP PIN combined with early filing closes the most common attack path entirely.

1
Internal Revenue Service. When to File an Identity Theft Affidavit
2
Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds
3
Internal Revenue Service. Dirty Dozen Tax Scams for 2026
4
Internal Revenue Service. Topic No. 752, Filing Forms W-2 and W-3
5
Internal Revenue Service. Be Informed, Not Fooled by Ghost Preparers and Tax Credit Scams
6
Internal Revenue Service. Frequently Asked Questions – Do I Need a PTIN
7
Internal Revenue Service. Identity Theft Dependents
8
Internal Revenue Service. Get an Identity Protection PIN
9
Internal Revenue Service. Tax Practitioner Guide to Business Identity Theft