Identity Theft

Business ID theft is defined as creating, using, or attempting to use a business’s identifying information to obtain a tax benefit without authority.

For information on business ID theft, see Identity Theft Information for Businesses.

Phishing is a scam typically carried out through unsolicited email and/or websites that pose as legitimate sites intended to lure unsuspecting victims to provide personal and financial information.

For information about phishing scams, see Report Phishing and Online Scams.

Tax Professionals Identity Theft is when cybercriminals target tax professionals to steal their clients’ personal financial information to file fraudulent tax returns to claim fake refunds.

There are several steps you may need to take. The right ones for you are based on what’s happening with your tax account.

You tried to file electronically, but the IRS said someone already filed using the SSN or ITIN of you or your dependent(s).

If you can’t file your tax return electronically because someone has already used the SSN or ITIN of you or your dependent(s) to file a tax return, you must file a paper tax return, within 10 calendar days (not 10 business days) from the date it was rejected along with an affidavit or police report (see below) explaining that you are a victim of ID theft. You will need to:

• Print and sign a paper copy of your tax return. The paper tax return should include the following:
  • An explanation of why the paper return is being filed after the due date, if applicable;
  • A copy of the e-file reject notification; and
  • Write “REJECTED ELECTRONIC RETURN – (MM-DD-YYYY)” in red at the top of the first page.

• Fill out a Form 14039, Identity Theft Affidavit; and

• Submit your signed tax return and signed Form 14039 to the IRS at the appropriate address for your state. If you prefer, you have the option to submit the Form 14039 online and mail your paper return separately.

Note: If you’ve filed a police report, you can submit that to the IRS instead of Form 14039.

If you electronically file your tax return and get a message telling you that a dependent on your return has been claimed on another tax return or their own or if you receive an IRS Notice CP87A, you’ll need to find out why someone else claimed your dependent. You can learn more on this topic by visiting IRS.gov and searching: What to Do When Someone Fraudulently Claims Your Dependent.

You received an IRS letter saying you didn’t report all your income on your tax return

If you get a letter that says you didn’t report all your income (or unemployment compensation) and you don’t recognize the names of the companies where the income was earned, it’s possible someone used your SSN for employment purposes. You should:

• Respond to the letter as soon as possible, following the instructions in the letter;
• Fill out a Form 14039, Identity Theft Affidavit; and
• Submit your response and documents to the address indicated on the IRS letter.

Note: If you’ve filed a police report, you can submit that to the IRS instead of Form 14039.

You received an IRS letter saying they received a tax return with your name and SSN or ITIN 

If you get an IRS letter that requests you to verify your ID, it’s possible someone used your SSN or ITIN to file a tax return. The IRS Taxpayer Protection Program identifies potential ID theft returns as a precautionary measure to protect you. If you receive a  Letter 4883C, 5071C, or 5747C, respond  as soon as possible, following the instructions in the letter.  Not all letters have the same options for verifying your identity.

If you didn’t file the tax return or don’t have a filing requirement:

Someone may have attempted to use your personal information to obtain a tax refund. Call the IRS immediately. If you are inside the U.S., contact the toll-free Identity Verification line on the letter. If you are outside the U.S., call the phone number listed in the letter for international callers, which is not toll-free.

You don’t need to visit an IRS Taxpayer Assistance Center (TAC) if you didn’t file the tax return but you must contact the IRS to confirm that you may be a victim of tax-related ID theft. Please review “Other actions you can take to protect yourself if your identity may have been stolen” below.

If you filed a tax return:

Be prepared to verify your identity and tax return. Contact the IRS immediately following the instructions in your letter.

If your letter includes an option to verify online using the IRS’ online Identity and Tax Return Verification Service website, this is the fastest option. After verifying your identity, you must also answer IRS questions about your tax return. If you don’t see these questions after you verify your identity, return to the website contained in the letter.

If your letter includes an option to verify your identity and tax return by phone, contact the toll-free Identity Verification line on the letter, if you are inside the U.S. If you are outside the U.S., call the phone number for international callers listed in the Letter 5447C, which is not toll-free.

If you can use either the online or phone option, have the following information accessible:

• The IRS letter, and
• A copy of your current and prior year returns, including all schedules (if applicable).

NOTE: If the IRS can’t verify your identity using either of these options, they may ask you to schedule an appointment at an IRS TAC to verify in person.

If your letter requires you to go into an IRS TAC, you will need an appointment. Call the appointment line at 844-545-5640 within 30 days of the date of the letter to schedule an appointment for in-person authentication. Bring the information and identity documents listed on your letter to your appointment.

If you received a Letter 5447C, you have the option of mailing in the documentation to the address in the letter.

An authorized third party can represent you, but the IRS must have a completed Form 2848, Power of Attorney and Declaration of Representative on file for the representative. Otherwise, you must also be present on the telephone or at the appointment. If you’re acting as a fiduciary for an individual, a descendant’s estate, or a trust, complete and send Notice 56, Notice Concerning Fiduciary Relationship.     

Once the IRS verifies your identity and confirms you submitted the tax return, they’ll continue processing your return. It may take up to nine weeks to receive your refund. You can visit  Where’s My Refund? on irs.gov or on the IRS2Go mobile app after two – three weeks of verifying your identity, to check your refund status.

You received a tax transcript in the mail that you did not request

Determine if your spouse or someone who is authorized (tax professional, power of attorney, or financial institution, etc.) could have requested the transcript. Someone may have had enough of your tax information to request a transcript through the IRS system, but did not receive the transcript, instead it was mailed to you. To protect your accounts if you have no tax-related ID theft, please review “For Future Returns” below for information about opting in for an Identity Protection Personal Identification Number (IP PIN).

You received a balance due notice, refund offset notice, or have collection actions taken against you for a tax year when you didn’t file a return

You should submit either a Form 14039, Identity Theft Affidavit, or a police report alleging the identity theft, and include a copy of the IRS letter or notice if the IRS sends you a balance due notice, a refund offset notice, or a notice advising you of collection actions they have taken against you for a tax year that you didn’t file a return. Include any additional supporting documentation that the notice/letter may request.

You receive a notice from the SSA stating benefits will be reduced or stopped based on IRS records indicating you received wages or other income from an employer for whom you did not work

If someone is using your SSN to work or file a fraudulent tax return in your name, it can affect any Social Security benefits you receive now or in the future. You may get a notice from the SSA that your benefits have been reduced or stopped because a federal tax return was filed showing you earned wages or self-employment income.

If this happens to you, contact the SSA to find out how to correct your Social Security account. You should also file Form 14039, Identity Theft Affidavit, with the IRS. If you’re not required to file a federal tax return, and someone has filed using your identifying information, the IRS will need to correct your account. Filing the affidavit will also notify the IRS to add additional security measures to your account.

Your information has been stolen, and you want to protect your tax account 

If you know your information has been compromised due to a data breach or phishing scam or for some other reason, you should alert the IRS. This allows the IRS to take steps to secure your account.

• Fill out and submit Form 14039, Identity Theft Affidavit.
• The Federal Trade Commission (FTC) has a fillable Form 14039 on www.identitytheft.gov.

The IRS has a specialized unit dealing with ID theft – you can also contact them.

Identity Protection Specialized Unit
Toll-free phone number: 800 908-4490
Hours: Monday through Friday 7:00 a.m. to 7:00 p.m. local time (Alaska and Hawaii use Pacific Time)

Other actions you can take to protect yourself if your identity may have been stolen

• Contact the Social Security Administration (SSA) to verify and correct any wage discrepancies on your SSA account;
• Contact your financial institution;
• File a report with your local police department;
• Check your credit report every 12 months by:
  • visiting annualcreditreport.com, or
  • Calling 877-322-8228
• Place a fraud alert on your credit reports;
• File a complaint with the Federal Trade Commission;
• Contact your state Attorney General’s office; and
• Contact your state tax agency to see if there are additional steps you should take at the state level.

Please review “For Future Returns” below for information about opting in for an IP PIN.

Your refund is delayed due to ID theft and it’s causing a financial hardship

If you’re facing a financial hardship, you should contact the Taxpayer Advocate Service. Examples of financial hardship are an upcoming eviction, your utilities are about to be shut off, or you’re unable to pay for medical care.

For this tax return

If someone else filed a tax return using the SSN or ITIN of you or your dependent(s):

• You can’t file electronically and will need to submit a paper return. See “You tried to file electronically, but the IRS said someone already filed using your SSN or ITIN” above.
• An IRS employee will review both tax returns to determine which is from you and which is from the ID thief.
• The IRS will then adjust your account to reflect only the correct information.
• The IRS review can take 120 days or more, so if you’re expecting a refund, it will be delayed. However, due to extenuating circumstances caused by the pandemic, the ID theft inventories have increased dramatically and on average it is taking the IRS 640 days to resolve ID theft cases.

For future tax returns

When the IRS determines you’re the rightful owner of the SSN or ITIN and has processed your return, they should assign you an IP PIN, a six-digit number you must use on all your future federal tax returns. This is an extra layer of security; without a valid IP PIN, no tax return will be processed to your account. A new IP PIN will be generated each year.

Opt-in IP PIN

Anyone who has a Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN) and verifies their identity, is eligible to enroll into the IP PIN program. Participating in the IP PIN Program is voluntary for taxpayers who are not victims of tax-related identity theft. Any individual who enrolled in the IP PIN Program through the Get an IP PIN application will need to access their online account every year, prior to filing, to get their new IP PIN for that processing year. If you voluntarily joined the IP PIN program and “are NOT” a victim of a tax-related ID theft and not interested in continuing to participate in the program, then you may opt-out of the IP PIN program. To find out if you are eligible to opt-out, you can log into your online account.

How to get an IP PIN 

The fastest way to receive an IP PIN is by using the online ‘Get an IP PIN’ tool. If you wish to get an IP PIN and you don’t already have an account on IRS.gov, you must register to validate your identity. IP PIN requests for dependents should be completed using the alternatives below and not through the online option, as most dependents will not be able to utilize Get an IP PIN application. The IP PIN tool is generally available starting in mid-January through mid-November.

Alternatives to the online tool 

If you want an IP PIN but can’t successfully validate your identity through the ‘Get an IP PIN’ tool, there are alternatives.

1. You may submit Form 15227, Application for an Identity Protection Personal Identification Number (IP PIN) (English-Spanish Version), to apply for an IP PIN, if you (1) have a Social Security number (SSN) or individual taxpayer identification number (ITIN), (2) have an annual adjusted gross income of equal to or less than $79,000 ($158,000 if filing status is Married Filing Joint) and (3) have access to a telephone. Note: The adjusted gross income requirement does not apply to an application filed for a dependent.
2. If you’re unable to verify your identity online or with the Form 15227 process or you are ineligible to file Form 15227, you may make an appointment for an in-person meeting at a local Taxpayer Assistance Center. Please bring one current government-issued picture identification document and another identification document to prove your identity. Once the IRS verifies your identity, you will receive your IP PIN via the U.S. Postal Service usually within three weeks. You will then receive your IP PIN annually through the mail.

If you are interested in requesting an IP PIN, please read Publication 5367, Identity Protection PIN Opt-In Program for Taxpayers, to understand the required steps. You can also find additional information on the FAQs about IP PINs or by accessing the get an IP PIN tool.

The Taxpayer Advocate Service is an independent organization within the IRS that helps taxpayers and protects taxpayers’ rights. We can offer you help if your tax problem is causing a financial difficulty, you’ve tried and been unable to resolve your issue with the IRS, or you believe an IRS system, process, or procedure just isn’t working as it should. If you qualify for our assistance, which is always free, we will do everything possible to help you.

Visit www.taxpayeradvocate.irs.gov or call 1-877-777-4778.

Low Income Taxpayer Clinics (LITCs) are independent from the IRS and TAS. LITCs represent individuals whose income is below a certain level and who need to resolve tax problems with the IRS. LITCs can represent taxpayers in audits, appeals, and tax collection disputes before the IRS and in court. In addition, LITCs can provide information about taxpayer rights and responsibilities in different languages for individuals who speak English as a second language. Services are offered for free or a small fee. For more information or to find an LITC near you, see the LITC page on the TAS website or Publication 4134, Low Income Taxpayer Clinic List.

• Tips
• Copy of Fraudulent Return
• ID Theft Assistance
• Data Breach?
• ID Theft and your Social Security Number
• Federal Trade Commission Information on ID Theft
• Identity Protection Scams
• Phishing and Online
• ID Theft Central
• IRM 25.23.2.2.3, IDT Case Processing Time Frames