Tax Identity Theft: Methods, Warning Signs, and Resolution

Tax identity theft happens when someone uses your Social Security number to file a fraudulent tax return in your name and claim your refund before you file. You usually find out one of two ways: your e-filed return is rejected as a duplicate, or the IRS sends a notice asking you to verify a return you didn’t submit. The response depends on which of those happens first, and moving quickly matters because resolution now averages close to two years.1Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds

How the Scheme Works

The thief doesn’t touch your bank account. They file a return under your Social Security number, invent income and withholdings that produce a refund, and collect it. The window they exploit is the gap between when the IRS begins accepting returns in January and when most people actually file. Once a return is processed under your SSN, the IRS system treats it as yours, and your real return comes back rejected as a duplicate.

The same pattern hits businesses through their Employer Identification Number. Signs for a business include e-file rejections citing a duplicate EIN, unexpected IRS transcripts or notices, and denied extension requests.2Internal Revenue Service. Identity Theft Information for Businesses

Warning Signs Your Identity Was Used

The clearest signal is an e-file rejection saying a return has already been filed under your Social Security number. Someone got there first.

The IRS may also reach you before you file. The Taxpayer Protection Program flags suspicious returns and sends a CP5071 series notice asking you to verify your identity and confirm whether the return in question is yours.3Internal Revenue Service. Understanding Your CP5071 Series Notice If you didn’t file the return the notice describes, the notice itself is your evidence that a fraudulent one exists.

Other red flags:

  • A CP2000 notice showing income from an employer you’ve never worked for. Third-party income reported to the IRS doesn’t match what you reported because someone is using your SSN for work.4Internal Revenue Service. Understanding Your CP2000 Series Notice
  • A collection notice or balance due for a tax year you never filed.
  • Notification that an IRS online account was created in your name when you didn’t create one.
  • A W-2 or 1099 in the mail from a company you’ve never worked for.

How Thieves Get Your Information

Phishing is the most common route. Fake emails and websites imitate IRS login pages or tax software portals and ask you to enter your Social Security number and filing credentials. The forgeries have gotten good, matching real IRS formatting closely.

Phone-based scams work the other direction. Callers pose as IRS agents, spoof caller ID to show a plausible number, and demand payment or “verification” of your identity under threat of arrest. The real IRS almost never opens contact by phone and never demands payment by gift card or wire transfer.

Data breaches at companies that hold customer records feed bulk Social Security numbers, dates of birth, and addresses into the market. Stolen mail supplies W-2s and 1099s, which contain everything a thief needs to file as you.

What To Do When You Discover It

The IRS treats two situations differently, and doing the wrong one slows your case down.5Internal Revenue Service. IRS Identity Theft Victim Assistance – How It Works

If the IRS Contacted You First

Follow the instructions on the notice. If you received a CP5071 series letter or another verification request, respond through the channel it specifies, either online or by phone. Do not file Form 14039. The IRS has already flagged the return; submitting a duplicate affidavit only creates delay.

If Your E-File Was Rejected

You’ll take several steps in parallel:

  • Complete your return on paper, attach Form 14039, Identity Theft Affidavit, to the back of it, and mail the package to the IRS filing address for your state.6Internal Revenue Service. Form 14039 – Identity Theft Affidavit
  • File a report at IdentityTheft.gov. The FTC generates a recovery plan tailored to your situation.5Internal Revenue Service. IRS Identity Theft Victim Assistance – How It Works
  • Contact your state tax agency. The IRS recommends checking separately, because state reporting steps vary.

If you need to submit Form 14039 without a return (for instance, you already filed successfully but got a suspicious notice), fax it to 855-807-5720 with a cover sheet marked “Confidential,” or mail it to the IRS in Fresno, CA 93725.6Internal Revenue Service. Form 14039 – Identity Theft Affidavit Don’t submit duplicates and don’t call to check on your case; both slow things down rather than speed them up.

Employment-Related Tax Identity Theft

This variant deserves its own handling. Instead of filing a fake return, someone uses your Social Security number to get hired. Their employer reports those wages under your number, and the IRS then expects you to pay tax on income you never earned.7Internal Revenue Service. Employment-Related Identity Theft

Do not include the fraudulent income on your return, and do not file an amended return to account for it. If you receive a CP2000 notice about wages that aren’t yours, respond using the phone or fax number printed on the notice and explain that the income isn’t yours.7Internal Revenue Service. Employment-Related Identity Theft

The IRS sends a CP01E notice when it detects someone using your Social Security number for work. The notice confirms the IRS has flagged your account and placed an identity theft indicator on it. You don’t need to file Form 14039 in this situation because the IRS has already documented the issue.8Internal Revenue Service. Understanding Your CP01E Notice

Employment fraud also distorts your Social Security earnings record, which can affect future benefits. Contact the Social Security Administration to review and correct your record, and allow several weeks for updates to post.7Internal Revenue Service. Employment-Related Identity Theft

How Long Resolution Takes

The IRS’s stated goal is 120 days. The real number in 2024 was about 675 days, close to two years.1Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds Any refund you’re owed is frozen for the duration.

The backlog explains the wait. At the end of fiscal year 2024, the IRS held more than 470,000 identity theft cases in its inventory and closed only about 228,000 during the year.9Taxpayer Advocate Service. Annual Report to Congress 2024 – Identity Theft If waiting creates real financial hardship, contact the Taxpayer Advocate Service, which can sometimes push a case forward.

Protecting Your Credit

Tax identity theft means your Social Security number is out there, so it may already be feeding other kinds of fraud. Two tools lock that down.

Fraud Alerts

An initial fraud alert lasts one year and requires businesses to verify your identity before opening new accounts. You only need to contact one of the three major credit bureaus; that bureau must notify the other two by law. If you’ve already filed an FTC report at IdentityTheft.gov or a police report, you qualify for an extended fraud alert lasting seven years.10Consumer Advice. Credit Freezes and Fraud Alerts

Credit Freezes

A freeze is stronger. It blocks creditors from pulling your report at all, which prevents new accounts from being opened. Federal law makes placing and lifting freezes free. When you request one online or by phone, the bureau must place it within one business day, and lifting it can take as little as one hour.11Federal Trade Commission. New Federal Law Allows Consumers to Place Free Credit Freezes and Yearlong Fraud Alerts You must contact all three bureaus separately to freeze at each one. Parents can also freeze credit files for children under 16.

Get an IP PIN Before Next Filing Season

An Identity Protection PIN is a six-digit number the IRS uses to confirm a return actually came from you. With an IP PIN on file, no return under your Social Security number will process without it. It’s the single most effective way to prevent a repeat.12Internal Revenue Service. Get an Identity Protection PIN

The PIN changes each year and applies to every federal return you file during that year, including prior-year returns. A missing or incorrect PIN causes e-filed returns to be rejected and paper returns to be delayed. You enter it when prompted by your tax software or give it to your preparer.

You don’t have to be a victim to get one. Anyone with a Social Security number or ITIN can opt in through their IRS Online Account. The program has two enrollment options: continuous, which keeps you in indefinitely, or one-time for the current calendar year.13Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)

If you can’t verify your identity online, you have two alternatives. Taxpayers with adjusted gross income under $84,000 (or $168,000 for married filing jointly) can submit Form 15227 by mail.14Internal Revenue Service. Form 15227 – Application for an Identity Protection Personal Identification Number Everyone else can book an in-person appointment at a Taxpayer Assistance Center with identity documents. Given how long an active case takes to resolve, opting in before you ever need it is worth the few minutes of setup.