Tax identity theft happens when someone files a fraudulent federal tax return using your Social Security number, usually to grab a refund before you file your own. Most people find out one of two ways: the IRS rejects their e-filed return because a return with their SSN was already processed, or a letter shows up asking them to verify a return they never sent. Once you confirm it, the response has two tracks that run at the same time — clean up the IRS side by filing Form 14039, and lock down everything else a thief with your SSN could touch.
Signs Someone Filed a Return in Your Name
The clearest signal is an e-file rejection citing a duplicate Social Security number. Check first for a typo or a transposed digit on your return. If your SSN is entered correctly and the rejection stands, someone likely filed ahead of you.1Internal Revenue Service. When to File an Identity Theft Affidavit
The other early warning comes by mail. The IRS sends identity verification letters when a return filed under your SSN triggers its fraud filters. The three you’re likely to see are Letter 5071C (verify online), Letter 4883C (verify by phone), and Letter 5747C (verify in person at a local IRS office).2Taxpayer Advocate Service. Identity Theft – Most Serious Problem If a letter arrives about a return you didn’t file, follow the letter’s instructions to tell the IRS. In most cases that response is enough on its own, and you won’t need to file a separate identity theft affidavit.3Internal Revenue Service. Understanding Your CP5071 Series Notice
Quieter signs to take seriously: a tax transcript listing an employer you’ve never worked for, a notice saying you owe tax on income you didn’t earn, or word that your refund was applied to a debt you don’t recognize.4Internal Revenue Service. What Taxpayers Should Do if They Get an Identity Theft Letter From the IRS
How Thieves Get Your Tax Information
A large share of tax identity theft starts with phishing. Scammers send emails, texts, and social media messages posing as the IRS, often with a link to claim a fake refund or “verify” your account. The IRS does not initiate contact through email, text, or social media. Its first contact is always a mailed letter or notice.5Internal Revenue Service. Ways to Tell if the IRS Is Reaching Out or if Its a Scammer
Phone scams work the same way. Callers claim to be IRS agents, leave threats about arrest warrants, and demand payment through gift cards or prepaid debit cards. Real IRS agents call only after mailing written notice first, and neither the IRS nor its authorized private collection agencies will ever ask for payment by gift card.5Internal Revenue Service. Ways to Tell if the IRS Is Reaching Out or if Its a Scammer Hang up on those calls. You can report them through the IRS’s Identity Theft Central page.6Internal Revenue Service. Identity Theft Central
When the Thief Uses Your SSN for a Job
Not every case involves a fake refund. Sometimes a thief uses your Social Security number to get hired, and the employer reports those wages to the IRS under your SSN. When you file, the IRS sees a gap between what you reported and what the employer reported, and it may bill you for tax, interest, and penalties on income you never earned.
You’ll need to file Form 14039 and may also have to dispute the wages directly with the IRS. There’s a second layer people miss: those fraudulent wages inflate your Social Security earnings record and can distort future benefits if left uncorrected. Call the Social Security Administration at 1-800-772-1213 to review your record and start a correction. The SSA will work with you, though how long it takes depends on the documentation you can provide.7Social Security Administration. How to Correct Your Social Security Earnings Record
When Your Child’s SSN Is Used
Children are appealing targets because a minor’s SSN rarely gets checked against credit or tax filings, so the theft can go unnoticed for years. Parents usually discover it when their own e-file is rejected because the child’s SSN was already claimed as a dependent, or when IRS Notice CP87A arrives saying someone else claimed the child.8Internal Revenue Service. Identity Theft Dependents
A parent or legal guardian can file Form 14039 on the child’s behalf. On the form, check Box 3 in Section A and Box 5 in Section F to indicate you’re filing as parent or legal guardian, and enter the child’s SSN in the taxpayer identification field. No court order or power of attorney is required for a parent filing for a dependent child.9Internal Revenue Service. Form 14039 Identity Theft Affidavit
Filing Form 14039 With the IRS
Form 14039 is the IRS’s identity theft affidavit. File it if your e-filed return was rejected because of a duplicate SSN, if you got a notice about income you didn’t earn, or if you otherwise have concrete evidence your tax identity was misused. Do not file it just because you received a 5071C, 4883C, or 5747C verification letter — respond to that letter first using its own instructions.1Internal Revenue Service. When to File an Identity Theft Affidavit
The form asks for your full legal name, current mailing address, and the Social Security number that was misused. You’ll pick a reason for filing, mark which tax years are affected, and describe how you discovered the theft. The IRS cross-references every detail against its records to separate your legitimate filings from the fraudulent ones, so accuracy matters. Attach a clear copy of a government-issued photo ID. The online version allows up to five attachments, each no larger than 5 MB.10Internal Revenue Service. Form 14039 Identity Theft Affidavit
There are three ways to submit. Fastest is the IRS online portal, which accepts the form and supporting documents electronically. You can also download the PDF and fax it to 855-807-5720 or mail it to: Department of the Treasury, Internal Revenue Service, Fresno, CA 93888-0025.9Internal Revenue Service. Form 14039 Identity Theft Affidavit
If your e-filed return was rejected, you’ll need to submit a paper return. Attach Form 14039 to the back of that paper return and mail both to the IRS address where you normally file. If you’re responding to a specific IRS letter or notice, send the form to the fax number or address on that correspondence rather than the general Fresno address.9Internal Revenue Service. Form 14039 Identity Theft Affidavit
How Long Resolution Actually Takes
This is the part most guides gloss over. The IRS’s stated goal is to resolve identity theft cases within 120 days. It hasn’t come close to that target since 2020. The most recent data puts average resolution for Identity Theft Victim Assistance cases at roughly 675 days, or about 22 months, and the IRS currently tells victims to expect around 640 days.11Taxpayer Advocate Service. Identity Theft Victims Are Waiting Nearly Two Years to Receive Their Tax Refunds
During that stretch the IRS works to remove the fraudulent return from your account and reconcile your actual earnings, but communication may be sparse. Its procedures don’t require an acknowledgment letter until a caseworker has reviewed the claim and confirmed you as a victim, so weeks or months can pass with no word.2Taxpayer Advocate Service. Identity Theft – Most Serious Problem
If the wait creates real financial hardship, say you’re counting on the refund to pay rent, or the IRS is trying to collect on the fraudulent income, contact the Taxpayer Advocate Service. TAS is an independent office inside the IRS that takes cases involving financial difficulty, systemic failures, or prolonged unresponsiveness. File Form 911 (Request for Taxpayer Advocate Service Assistance) by mail, fax, or email.12Taxpayer Advocate Service. Submit a Request for Assistance
Getting an Identity Protection PIN
Once your case is resolved, the IRS issues you an Identity Protection Personal Identification Number, a six-digit code you include on every future return. Without the IP PIN, a return filed under your SSN won’t process. Confirmed victims get a new IP PIN automatically each year by CP01A notice.13Internal Revenue Service. Get an Identity Protection PIN
You don’t have to be a victim to use one. Anyone with a Social Security number or ITIN can enroll voluntarily by verifying identity through the IRS online account tool, and parents and legal guardians can request IP PINs for dependents. If you can’t create an online account, you can apply on Form 15227, but that route is limited to taxpayers with adjusted gross income at or below $84,000 ($168,000 for married filing jointly).13Internal Revenue Service. Get an Identity Protection PIN
Steps to Take Outside the IRS
Whoever has your Social Security number probably isn’t limiting themselves to a fake tax return. Run these steps in parallel with your IRS filing.
File an identity theft report with the FTC at IdentityTheft.gov or by calling 1-877-438-4338. The FTC generates an official Identity Theft Report and a personalized recovery plan, and that report serves as legal proof of the theft when you deal with creditors and financial institutions.14Federal Trade Commission. Identity Theft Recovery Steps
Place a credit freeze with all three bureaus. A freeze blocks lenders from accessing your credit report, which stops new accounts from being opened in your name. It’s free, stays in place until you lift it, and is more protective than a fraud alert, which only asks lenders to verify your identity. An initial fraud alert lasts one year; with an FTC Identity Theft Report or police report you can place an extended fraud alert that lasts seven years.15Federal Trade Commission. Credit Freezes and Fraud Alerts
Report the stolen SSN to the Social Security Administration. The SSA will point you to the FTC for the formal identity theft report and can help you check your earnings record for wages you didn’t earn.16Social Security Administration. Report Stolen Social Security Number