Tax-Related Identity Theft: Form 14039 and IP PIN Recovery

If someone has filed a fraudulent return using your Social Security number, or you suspect your SSN is being misused with the IRS, tax-related identity theft has a defined response path: report it to the IRS on Form 14039, file your legitimate return on paper, notify other agencies, and lock down future filings with an Identity Protection PIN. The process works, but it is slow. The IRS’s stated target is 120 days; the actual average has stretched to roughly two years.¹ Moving quickly on the steps below is what shortens your wait and limits the damage.

How You Know It Happened

The most common tip-off is a rejected e-file. You submit your return and the system bounces it back saying a return with your Social Security number has already been accepted for that tax year.² Someone filed before you.

Sometimes the IRS spots the suspicious return first and writes to you. Letters in the 5071C, 5747C, and 4883C family come from the Taxpayer Protection Program and each explains how it wants you to verify your identity, whether online, by phone, or at an in-person appointment.³ Follow the instructions in the letter you received.

Quieter signs matter too. A W-2 from an employer you never worked for, a notice that you owe tax on income you never earned, or a letter about unemployment benefits you never claimed all suggest your SSN is out in the wild. Any of these deserves the same response as a rejected e-file.

Reporting to the IRS With Form 14039

Form 14039, the Identity Theft Affidavit, is the primary reporting tool. You sign it under penalty of perjury, confirming that you did not authorize the return filed in your name. It asks for your Social Security number, the affected tax year, how you found out, and how the IRS can reach you.

Submit it online through the IRS website, which is now the preferred method.⁴ Mail and fax remain options, and the addresses appear in the form’s instructions. The online path does not accept attachments, so if you need to send supporting documents, mail the packet instead.

Include legible copies of a government-issued photo ID, such as a driver’s license or passport. A Social Security card or birth certificate can back that up when photo ID isn’t available. Signatures and dates need to match your official records exactly; illegible copies and mismatches slow the case down.

One trap catches a lot of people. Do not file Form 14039 if the IRS has already sent you a Taxpayer Protection Program letter asking you to verify your identity. Those letters have their own response process. Form 14039 is for the situations where you discover the theft yourself and the IRS hasn’t already flagged it.⁵

File Your Real Return Anyway

A rejected e-file does not excuse you from filing. When a fraudulent return has already been accepted under your SSN, the IRS instructs you to file a paper return and attach Form 14039 to the back.⁵ Mail both to the IRS filing address for your state. You can also submit them separately.

Do not file an amended return to correct the fraudulent one. You didn’t file the original, so there is nothing on your part to amend. The IRS will remove the fake return from your records once the investigation confirms the theft.⁶

If you owe tax for that year, keep paying while the case is open. Interest and penalties on a balance due don’t pause for an identity theft investigation.

What Happens After You Report

Cases go to the IRS Identity Theft Victim Assistance unit, which works to strip the fraudulent return from the system, verify your real filing, and correct your account.⁵

Set expectations accordingly. The 120-day target is aspirational; the current reality is closer to two years, and interim letters asking for more time are routine.¹ When the case finally closes, you get a letter confirming the fraudulent return is gone, your account is corrected, and any refund you were owed is released. The IRS also places an identity theft indicator on your account and enrolls you in the IP PIN program going forward.⁵

When to Escalate to the Taxpayer Advocate Service

If your case has stalled well past normal processing, or the IRS keeps asking for patience without resolving anything, the Taxpayer Advocate Service can push it forward. TAS is an independent organization inside the IRS that steps in when the standard process breaks down.⁷

Ask for help by filing Form 911. You can email it to TAS.Form.911.Request.for.Assistance@irs.gov, fax it to (855) 828-2723, or mail it to a TAS office. If you don’t hear back within 30 days, contact the office where you sent it.⁷ Financial hardship cases get priority; if the delayed refund is making it hard to pay bills, say so explicitly.

When the Fraud Is Employment, Not a Fake Refund

Not every tax identity theft case involves a bogus return. Sometimes a thief uses your SSN to get hired, and the employer reports those wages to the IRS under your number. You then get notices saying you underreported income you never earned.

If a CP2000 notice lists wages you didn’t earn, don’t include the phantom income on your return and don’t file an amended return; call the number on the notice. A CP01E notice is informational and doesn’t change your account, but you can call with questions. A W-2 or 1099 from an employer you don’t recognize should not be reported as income; instead, contact the Social Security Administration to review your earnings record.⁶

Phantom wages can distort your Social Security benefits later, since benefit amounts are built from your earnings history. Create a “my Social Security” account at ssa.gov, review your record, and flag anything that isn’t yours.⁸

Report to Other Agencies

The IRS handles the tax piece, but your SSN is out. Report the theft to the Federal Trade Commission at IdentityTheft.gov or by calling 1-877-438-4338. The FTC generates an Identity Theft Report and a recovery plan that covers the non-tax fallout.⁹ Create an account on the site so it tracks your progress and pre-fills forms; if you don’t, print everything before leaving the page, because you won’t be able to get back in.

Then call one of the three major credit bureaus, Equifax at 800-525-6285, Experian at 888-397-3742, or TransUnion at 800-680-7289, and place a free one-year fraud alert. Whichever bureau you contact must notify the other two.⁶

For stronger protection, place a security freeze on each of your credit reports. Federal law requires the bureaus to place a freeze for free within one business day of an online or phone request and lift it within one hour when you ask.¹⁰ A freeze blocks lenders from pulling your report at all, which is stronger than a fraud alert. You’ll need to lift it temporarily any time you apply for credit yourself.

Lock Down Future Returns With an IP PIN

Once the IRS resolves your case, it enrolls you automatically in the Identity Protection PIN program. The IP PIN is a six-digit code you enter on every federal return going forward. Without it, the return is rejected, whether e-filed or on paper.¹¹ That effectively locks your SSN against unauthorized filings.

Confirmed victims receive a new IP PIN each year through a CP01A notice mailed in December or January. Store it somewhere secure. If you lose it, retrieve it through your IRS online account.¹²

You Don’t Have to Be a Victim to Enroll

Anyone with a Social Security number or ITIN can request an IP PIN voluntarily, and it is one of the most effective preventive steps available. Parents and guardians can request one for a dependent as well.¹³

The fastest route is your IRS online account: sign in, request the IP PIN from your profile, and retrieve the new number online each year instead of by mail. If you can’t create an online account and your last adjusted gross income was below $84,000 ($168,000 for joint filers), you can submit Form 15227; the IRS will call you to verify identity and mail the IP PIN in four to six weeks.¹⁴ If neither works, schedule an appointment at a Taxpayer Assistance Center with a government photo ID and one additional form of identification; the IP PIN arrives by mail in about three weeks.¹³

If a dependent has an IP PIN, include it whenever you claim them. Forgetting a dependent’s IP PIN triggers the same rejection as forgetting your own.¹² Enrolling a child in person requires two forms of ID for the child (such as a birth certificate and Social Security card) in addition to your own.¹³

1
Taxpayer Advocate Service. Objective 3 2026
2
Internal Revenue Service. Age, Name or SSN Rejects, Errors, Correction Procedures
3
Internal Revenue Service. Understanding Your CP5071C Notice
4
Internal Revenue Service. Form 14039 Identity Theft Affidavit
5
Internal Revenue Service. How IRS ID Theft Victim Assistance Works
6
Internal Revenue Service. Employment-Related Identity Theft
7
Taxpayer Advocate Service. Submit a Request for Assistance
8
Social Security Administration. Identity Theft and Your Social Security Number
9
IdentityTheft.gov. Steps to Take
10
Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
11
Internal Revenue Service. Understanding Your CP01A Notice
12
Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
13
Internal Revenue Service. Get an Identity Protection PIN
14
Internal Revenue Service. Form 15227 Application for an Identity Protection Personal Identification Number