Got an IRS Identity Theft Letter? Here Is What to Do
A letter from the IRS about identity theft can be your first sign of it. Follow what it says, and start here.
An envelope from the IRS is scary on a good day. One that mentions identity theft is worse. Take a breath. The IRS says to stay calm and act fast, and the letter itself is your instruction manual. Read it, follow it, and work from there.
What the letter is and why the IRS sends one
The IRS sends a letter or notice when it suspects identity theft on a return.
This kind of tax identity theft is when someone steals your information to commit tax fraud.
Why IRS mail may be your first sign
Sometimes getting IRS mail is your first sign you could be affected by identity theft.
Other warning signs show up on their own. The IRS says to watch for a few signs. One warning sign is an e-filed return that comes back rejected. Another is a Form 1099-G for unemployment benefits you never applied for. An unreported income alert, like a CP2000 series notice, is one more. None of these always means identity theft. They all mean you should look closer.
Common letters and notices tied to identity theft
The IRS sends different mail for different problems. Some letters ask you to verify your identity. Some tell you the IRS found duplicate claims. Those come with instructions to follow right away. The IRS says it sends a fax to verify income, withholding or employment.
First steps when the letter arrives
The single most important step is in the envelope. The IRS says to follow its instructions right away if you got a letter, notice or fax. Do that before anything else.
Then keep the paper. The IRS says to keep records of letters, phone calls and emails. Does the letter tell you to use the Identity and Tax Return Verification Service? Then use that service.
After that, the IRS says to follow the recovery steps on IdentityTheft.gov. Also check with your state tax agency for other steps.
Verifying the letter is really from the IRS
The IRS identity theft central page has a way to find out if it is really the IRS contacting you. Use it before you act on anything the letter asks.
You can also call the IRS to check. The IRS says you can call to confirm a notice or letter is real, or look it up on the IRS website. The IRS says to be cautious about anyone who wants to help with your Online Account. For more on fake IRS mail, see IRS scam mail.
Getting a copy of a fraudulent return
You may want to see the return a thief filed with your name on it. The IRS says to get a copy of your return if needed by checking your Online Account. For a fraudulent return, the IRS says to send Form 4506-F.
Protecting your tax account going forward
Once the immediate problem is handled, lock the door. The IRS says to get an identity protection PIN to protect your tax account. An IRS identity theft protection PIN stops another person from filing with your taxpayer ID.
Also secure your IRS Online Account with a complex, unique password. The IRS says to monitor your accounts and reports for taxes, Social Security, credit and finances. Did a data breach leak your information? The IRS says to consider filing Form 14039, the Identity Theft Affidavit. You can learn more about the wider process on the page about IRS identity theft.
When the letter involves a dependent
Thieves do not only target adults. The IRS says identity theft can hit you, your children, other dependents and nonfilers.
When the IRS finds two returns claiming the same dependent, it writes to you about the duplicate claims. Follow their instructions right away. The IRS says to check if you should file Form 14039 if your dependent's identity was stolen. When e-filing will not go through, the IRS says to complete a paper return instead. Include supporting documents, and mail the return package.
One hard part: privacy laws mean the IRS cannot tell you who claimed your dependent. Privacy rules let the IRS give out details only for the primary and secondary taxpayers on a return. If the IRS audits your claim, you will need proof you can claim the dependent.
The dependent does not need an IP PIN unless one was previously issued to them. If you already have an IP PIN, use that to e-file your return.
The IRS identity theft central page also lists identity theft involving deceased persons. Employment and unemployment are on the list too. For a deceased person, the IRS says to send credit bureaus a copy of the death certificate. File the person's final tax returns when due. Did you get a Form W-2 or Form 1099 from an employer you do not know? The IRS says to contact the Social Security Administration. Same if your Social Security income is more than you earned or expected. Thieves can use your information to apply for a job.
Where the IRS identity theft resources live
The IRS keeps its identity theft material in one place. The IRS identity theft central page helps if someone steals your information to commit tax fraud. It has guides for individuals, businesses and tax professionals. It lists common forms of identity theft. The page also explains how to report identity theft, tax scams and fraud. The page also covers how to get an Identity Protection PIN.
If you need to talk to someone, the IRS says to call to verify your identity and tax return status. The IRS also has an Identity Theft Victim Assistance Program. You can learn about it on the IRS site.
The letter in your hand feels like bad news. Follow its instructions, keep your records, and protect your account.