Tax Identity Theft: What It Is and What to Do

Someone used your information to commit tax fraud. Here are the IRS warning signs and the IRS recovery path.

Your e-filed return bounces back as rejected. Or a letter from the IRS arrives about a return you never filed. Take a breath. The IRS has a set path for tax identity theft. This page walks that path in order.

What is tax identity theft?

Tax identity theft happens when someone uses your information to commit tax fraud. The IRS identity theft central page helps if someone steals your information to commit tax fraud.

The IRS keeps an identity theft central page for exactly this. The page has guides on identity theft for individuals, businesses and tax professionals. It also lists common forms of identity theft, including deceased persons, dependents, employment and unemployment. It tells you how to get an Identity Protection PIN and how to report identity theft, tax scams and fraud.

Warning signs you might be a victim

The IRS flags several signs to watch for.

Your e-filed tax return is rejected.
You get an IRS letter or notice about a return you never filed. Sometimes IRS mail is your first sign of identity theft.
A Form 1099-G arrives for unemployment benefits you did not get or apply for.
You get an unreported income notice, like a CP2000 series notice.
Your Social Security account shows wages you did not earn or expect.
Accounts were created or accessed that you did not create or access.
You get alerts about password resets or log-in verifications you did not trigger.
An employer identification number you did not apply for.

The IRS says these signs do not always mean you have been affected by identity theft. Stay cautious anyway. And the targets are wider than you might think: you, your children, other dependents and nonfilers.

If you got a W-2 or 1099 from an unknown employer, the IRS says to contact the Social Security Administration. The same goes if your Social Security income is more than you earned or expected.

First steps the IRS tells you to take

The IRS guide is direct here: stay calm and act fast. Then do these things.

First, follow the instructions in any IRS letter, notice or fax you received. If a representative contacts you, follow their instructions too. The IRS sends a letter or notice when it suspects identity theft on a return, and that mail tells you what to do next. If you got one, act on it immediately.

Second, keep records of letters, phone calls and emails. You will want the paper trail.

Third, if the IRS tells you in a letter or notice to use the Identity and Tax Return Verification Service, use it.

The IRS guide also says to follow the recovery steps on IdentityTheft.gov. For a wider look at the problem and the agencies involved, see our identity theft page. If a notice in the mail is what tipped you off, our IRS identity theft letter page explains what that mail is telling you.

File Form 14039 when it applies

Form 14039 is the Identity Theft Affidavit.

When does it apply? The IRS says to consider filing it if a data breach leaked your information. You should also check whether you should file it if your dependent's identity was stolen.

USAGov says completing the Identity Theft Affidavit will invalidate a fraudulent return filed using your information.

Get an Identity Protection PIN

An Identity Protection PIN, or IP PIN, is a number that keeps someone else from filing a return with your taxpayer identification number.

You can request one through an IRS online account. You must register and validate your identity first. If you cannot access or create an online account, you can request an IP PIN by filing Form 15227 online.

Already holding an IP PIN? Enter it when you e-file your return. The IRS identity theft protection PIN page covers this in greater depth.

If your dependent's information was stolen

A dependent is a qualifying child or relative who relies on you for financial support. Their information can be used to claim a tax credit, so dependents are targets too.

Before you file, determine who can claim the dependent. Make sure the dependent's information is correct on the return. Check whether you should file Form 14039.

The dependent does not need an IP PIN unless one was previously issued to them.

Two things to expect if someone else claimed your dependent. The IRS notifies you by mail if they find duplicate claims, and you should immediately follow their instructions. If the IRS audits your claim, you will need to provide proof you can claim the dependent.

One limit, and it is a hard one. Privacy laws mean the IRS cannot tell you who claimed your dependent. You will not get that name, no matter how much you want it.

Get a copy of the fraudulent return

The IRS guide says how to get a copy of a return filed with your information. To get a copy of your own return, check your IRS Online Account. To get a copy of a fraudulent return filed in your name, send Form 4506-F.

Who to call at the IRS

The IRS guide gives two numbers to call.

Call the IRS to verify your identity and your tax return status.
For questions about your tax account, or to confirm what a notice or letter says, call the IRS. Searching the notice online is another option.

The IRS also runs an Identity Theft Victim Assistance Program, and it is worth learning how it works. For the full picture of how the IRS handles these cases, see our page on IRS identity theft.

Protect yourself going forward

The IRS guide says to protect yourself going forward. The IRS guide says to:

Secure your Online Account with a complex, unique password.
Protect personal and financial information, including Social Security numbers, account usernames, passwords, and data for dependents and deceased persons.
Keep an eye on your tax, Social Security, credit and financial accounts and reports.

The IRS guide says to be cautious about someone wanting to help with your Online Account.

Check with your state tax agency

The IRS guide says to check with your state tax agency for other steps.

The short version

Follow the letter's instructions. Keep records. File Form 14039 if it applies. Get an IP PIN. Then check with your state tax agency for other steps.