IRS Identity Theft: What to Do When Someone Files a Tax Return in Your Name

Tax identity thieves obtain Social Security numbers through data breaches, phishing scams, stolen mail, or purchased data. They file a fraudulent return early in the tax season (before you do) to claim your refund. When you file your legitimate return, the IRS rejects it as a duplicate. The IRS Identity Protection Specialized Unit (IPSU) handles these cases.

If your e-filed return is rejected because a return was already filed with your SSN: file a paper return with Form 14039 (Identity Theft Affidavit); attach a copy of your government-issued ID; include a police report if available; and submit your legitimate return with the affidavit. The IRS will investigate and process your return, though it takes significantly longer — up to 18 months in complex cases.

After a confirmed identity theft, the IRS issues an Identity Protection PIN (IP PIN) — a 6-digit number required to file your future tax returns. Even if you have not been a victim, you can proactively request an IP PIN through the IRS website. An IP PIN prevents anyone else from filing a return with your SSN.

A more complex form of tax identity theft occurs when someone uses your SSN for employment. Their employer reports wages to the IRS in your name, creating income records the IRS sees on your account. You may receive a CP2000 notice or an IRS notice that your income does not match your return. Resolving employment identity theft requires working directly with the IRS's identity theft unit.

After resolving a tax identity theft incident: get an IP PIN and use it every year; monitor your credit reports; request your IRS Account Transcript annually to verify no unauthorized returns; and be cautious with who has access to your Social Security number.