Tax identity theft is when someone uses your Social Security number or ITIN to file a tax return and collect a refund, or to work under your number so that wages you never earned are reported in your name. You usually find out in one of three ways: your e-filed return is rejected because a return with your number is already on file, an IRS letter asks you to verify a return you didn’t file, or a notice says you left out income from an employer you don’t know.
What to do depends on which one happened. If the IRS sent a letter, follow it: a letter asking you to verify your identity calls for verification, not the identity theft affidavit, Form 14039, which the IRS now says most people don’t need. If your e-file was rejected and nobody you know filed, file on paper with Form 14039 attached. Then get an Identity Protection PIN (IP PIN) so no one can file with your number next year.
For cards, bank accounts and loans, see what to do if your identity is stolen; for a wider self-audit, see how to check for identity theft.
Refund fraud and employment fraud: the two kinds
Refund fraud. A thief files a return with your number and claims a refund. When you e-file, the IRS rejects your return as a duplicate; if you file on paper, it mails you a letter saying it received more than one return in your name, the FTC explains. A dependent’s number can be misused the same way.
Employment-related identity theft. Someone works under your number, so IRS records show their pay as income you didn’t report and your Social Security record shows work you never did. It can surface as a notice proposing more tax, or as benefits adjusted or denied.
By February 26, 2026, IRS identity theft filters had flagged about 1.3 million returns, nearly twice as many as at the same point in 2025, and 19,000 had been confirmed as identity theft by then, the Treasury Inspector General for Tax Administration reported in June 2026, citing IRS figures. The FTC logged 87,470 reports of employment- or tax-related identity theft in 2024, the latest year in its Consumer Sentinel data book.
Warning signs of tax identity theft
The IRS identity theft guide lists these signs, noting that none of them always means identity theft:
- A rejected tax return, for example because a return with your number was already filed.
- A W-2 or 1099 from an employer or payer you don’t know, or an unreported-income notice such as a CP2000.
- A 1099-G for unemployment you never claimed. Report it to the state agency that issued it, ask for a corrected form and leave the income off your return, the IRS says.
- An employer identification number (EIN) you never applied for.
- An IRS online account, sign-in alerts or password resets you didn’t start, or someone offering to “help” with your account.
- Wages on your Social Security record that you didn’t earn.
- A data breach that exposed your information. Here the IRS suggests considering Form 14039.
IRS identity theft letters and notices, decoded
The IRS normally contacts you the first time by mail, and its letter is sometimes the first sign of identity theft. Find the number printed on yours:
| Letter or notice | What it means | What to do | Deadline or timing |
|---|---|---|---|
| CP5071 series (CP5071, 5071C, CP5071F) or CP5447 series (CP5447, 5447C, CP5447F) | A return filed under your SSN or ITIN is on hold until you confirm who filed it | Verify online with the Identity and Tax Return Verification Service if the notice offers it, or as the notice directs, and say whether you filed. No Form 14039 unless the IRS asks | Nothing is processed until you respond; after you verify, processing can take up to 9 weeks |
| Letter 4883C | The same, verified by phone | Call the Taxpayer Protection Program hotline on the letter, with the letter, the return, a prior-year return and your W-2s or 1099s at hand. Don’t file Form 14039 | Up to 9 weeks for a refund after you verify |
| Letter 5747C | The same, verified in person | Book a Taxpayer Assistance Center visit at the number on the letter; bring it, the return and its supporting documents, a government photo ID and one more document. Didn’t file? Call the hotline on the letter. Don’t file Form 14039 | Nothing is processed until you verify |
| CP01S | The IRS received your identity theft claim | Nothing. Don’t send another Form 14039 or call about status | Any refund follows once the claim is processed; see how long it takes |
| CP01 | The IRS verified your claim and flagged your account | Use the new IP PIN the IRS sends you each year on future returns | The flag stays until you ask the IRS to remove it |
| CP01A | Your IP PIN for the year | Enter it on every federal return you file that year; share it only with your tax preparer | Mailed each December or January |
| CP01E | Your SSN may have been used to get a job, and the IRS has flagged your account | No Form 14039. Review your earnings with Social Security | No known impact on your tax account, the IRS says |
| CP2000 | Income reported by employers or banks doesn’t match your return; it proposes changes and isn’t a bill | If the income isn’t yours, contact the IRS right away at the number on the notice and reply with a completed Form 14039. Don’t add the income or amend | Reply by the date on the notice, or ask for more time |
To check a letter, search its number on irs.gov or call 800-829-1040, never a number from an unexpected call, text or email.
Got a letter asking you to verify? Verify; don’t file Form 14039
A verification letter means a return filed under your number is on hold until the IRS hears from you. It isn’t proof that you’re a victim: verifying either releases your own return or tells the IRS that someone else filed it.
The IRS’s instructions are direct. If a letter tells you to use the Identity and Tax Return Verification Service, use it and don’t file Form 14039; if you can’t sign in, call the number on your letter. Its pages for Letters 4883C and 5747C also say not to file the form. As the IRS puts it, “Most people don’t need to file this form.” File it only if:
- the IRS tells you to;
- you can’t use the Identity and Tax Return Verification Service;
- you want to report possible tax-related identity theft the IRS doesn’t have on file, such as after a data breach.
Skip it if you already filed one, directly or through IdentityTheft.gov, or if the IRS already sent you a letter or notice, unless the notice asks for it, as a CP2000 does when the income isn’t yours. Don’t call about your claim’s status either: the IRS says duplicate forms and status calls cause delays.
When you do need it, the February 2026 revision of Form 14039 can go online at irs.gov, without attachments; by fax to 855-807-5720 (or the fax number on a notice you’re answering); or by mail to the IRS in Fresno, CA 93725, or to the address on your notice. IdentityTheft.gov can also submit it for you when you report the theft to the FTC.
If your e-file was rejected because your SSN was already used
A duplicate-filing rejection is the classic sign of refund fraud, but rule out a simpler cause first:
- Check for an honest duplicate: a return you, your spouse or a preparer already filed, or a mistyped Social Security number.
- If a dependent is the problem, confirm you’re the one entitled to claim them; the IRS can’t tell you who else did. Starting with 2024 returns, the IRS accepts an e-filed return with an already-claimed dependent if the primary taxpayer enters a valid IP PIN. No IP PIN? The IRS says your online account is the fastest way to get one. If you can’t e-file, file on paper: processing takes 6 to 8 weeks before the IRS looks into the claim.
- If nobody you know filed, complete your return on paper, attach Form 14039 to the back and mail it to the IRS address for your state, as the IRS page on ID theft victim assistance describes.
- Pay any tax due on time. The IRS tells victims to file returns and pay tax as usual.
- Report it at IdentityTheft.gov for an FTC recovery plan. Send Form 14039 only once, either with your paper return or through the site.
- Ask your state tax agency whether it needs anything from you.
- Watch for a CP01S notice confirming your claim. To see what the thief filed, mail or fax Form 4506-F for a partly masked transcript of the fraudulent return.
Wages you didn’t earn: employment-related identity theft
When the thief wants a paycheck rather than your refund, the clues differ. The IRS page on employment-related identity theft points to signs such as a CP01E or CP2000 notice, a W-2 or 1099 from an unknown employer, and a Social Security notice that benefits were adjusted or denied because of wages you didn’t earn.
Leave the income off your return. For a W-2 or 1099 from an employer you never worked for, the IRS says not to include the income or amend a return you already filed. Contact Social Security instead, and allow several weeks for its records to update.
Answer a CP2000 by its date. If you or your spouse didn’t earn the extra income it lists, contact the IRS right away at the phone or fax number on the notice, and reply with Form 14039.
Have Social Security review your earnings. Compare the wages posted in my Social Security with what you earned. If someone is working under your number, Social Security asks you to report it and will review your earnings with you; call 1-800-772-1213.
How long the IRS takes to resolve tax identity theft
There are two very different clocks.
Verification cases. After you verify a return that was yours, processing can take up to nine weeks, the IRS says. Reaching the IRS can take time too: through April 18 of the 2026 filing season, the Taxpayer Protection Program phone line received about 2.4 million calls and answered 19%, with an average wait of 20 minutes, the National Taxpayer Advocate reported in June 2026.
Identity theft claims. Form 14039 cases go to the IRS’s Identity Theft Victim Assistance unit. The IRS’s victim assistance page says they’re generally resolved within 120 days but, citing the pandemic, are taking 580 days on average; it doesn’t date that figure. The Advocate’s June 2026 report described waits of about 20 months, with more than 500,000 cases open when the 2026 filing season ended; its January 2026 annual report found an average of more than 21 months during 2025. In October 2026, the IRS’s processing status page showed it working on Forms 14039 received in August 2025.
While you wait, answer IRS requests promptly, keep filing and keep copies of what you send. If the delay is causing financial difficulty, or you can’t resolve it with the IRS, ask the Taxpayer Advocate Service for help with Form 911.
Protect next year’s return: get an IP PIN
An Identity Protection PIN is a six-digit number that prevents anyone else from filing a federal return with your Social Security number or ITIN. Anyone with an SSN or ITIN who can verify their identity can get one, and parents and legal guardians can request them for dependents. The IRS’s IP PIN page lists three ways to get one:
- Online. Request it from your profile in your IRS online account; new users need a photo ID to sign up. The IRS calls this the fastest way, and the PIN is generally available to view online from mid-January through mid-November.
- Form 15227. If you can’t set up an online account, your adjusted gross income on your last return was below $84,000, or $168,000 for joint filers, and you have a phone, submit Form 15227 online, or mail or fax the paper form. The IRS calls to confirm your identity and mails the PIN, usually within four to six weeks. Children under 18 must use this form or an in-person visit.
- In person. Book a Taxpayer Assistance Center appointment and bring a federal or state photo ID plus one more form of identification; for a child, also bring two documents such as a birth certificate. The PIN arrives by mail, usually within three weeks.
Using the PIN. A new IP PIN is issued every year, valid for one calendar year. Enter it on every federal return you file that year, prior-year returns included. An e-filed return needs the PIN of everyone on it who has one, dependents included, or it’s rejected; a paper return doesn’t need a dependent’s, the IP PIN FAQs say. It doesn’t cover state returns. If you joined online, you retrieve each new PIN online. Lost it? Retrieve it online or call 800-908-4490; an IRS assistor verifies your identity and mails it within 21 days.
Before next filing season:
- Get IP PINs for yourself, your spouse and your dependents.
- Give your IRS online account a complex, unique password and turn on its email notifications.
- Before you file, look over the W-2s and 1099s in your online account for any you don’t recognize.
- Check the earnings on your Social Security record once a year.
- Use two-factor authentication in your tax software, as the FTC advises.
- Store tax records and your Social Security card safely, and shred old records.
- If your Social Security number was exposed, consider a credit freeze too, which prevents access to your credit records, the IRS notes. For your tax account, the IRS points to the IP PIN.
- Check what’s publicly visible under your name with Recordwell’s free self-check. It shows what a stranger would see by searching your name there, not tax, IRS or credit files.
IRS impersonation scams vs. real IRS contact
Scammers posing as the IRS want your personal information or your money, the FTC warns. Real IRS contact follows a pattern:
- Mail comes first. The IRS normally contacts you the first time by mail, emails or texts only if you opted in, and never sends social media direct messages.
- Nobody at the IRS asks for your IP PIN. Calls, emails or texts that do are scams.
- No gift cards. The IRS never asks for or accepts them as payment.
- Bank details for a held refund go only through your online account. The IRS began phasing out paper refund checks on September 30, 2025. When a refund’s direct deposit details are missing, invalid or rejected, it may send a CP53E notice: you have 30 days to add an account in your online account, or a paper check follows after six weeks. IRS employees can’t update bank information for you, so a caller who offers to is a red flag.
Be wary of any contact that is unexpected, rushes or threatens you, asks for personal or financial information, or demands payment now, the IRS advises. Forward fake IRS emails to phishing@irs.gov, email the details of scam texts to phishing@irs.gov (subject “Text”) and forward them to 7726, and report impostor calls to the Treasury Inspector General for Tax Administration at 800-366-4484. Our guides to text message scams and how to identify a scammer cover more warning signs.
Common questions about tax identity theft
What is tax identity theft?
It’s someone using your Social Security number or ITIN to file a tax return, usually to steal a refund, or to work under your number so their wages are reported in your name.
Should I file Form 14039 if the IRS sent me a letter?
Usually not. If the letter asks you to verify your identity, do it the way the letter says: online, by phone, by mail or in person. The IRS says not to file Form 14039 if you received Letter 4883C or 5747C, or if you verify through its online service, unless it asks you to.
How long does the IRS take to resolve tax identity theft?
Up to nine weeks after you verify a return that was yours. Claims filed with Form 14039 take far longer: about 20 months, the National Taxpayer Advocate reported in June 2026, while the IRS’s victim assistance page cites an average of 580 days.
Will I still get my tax refund after identity theft?
Yes, if you’re owed one and nothing else is wrong with your return. The IRS removes the fraudulent return and processes yours once the case is resolved, so the refund can take as long as the case.
Does an IP PIN protect my state tax return?
No. The IRS uses the IP PIN only on federal returns, such as Forms 1040 and 1040-X. Ask your state tax agency what protection it offers.
Does the IRS call, text or email about identity theft?
It can call about account matters, but the IRS normally makes first contact by mail. It emails or texts only people who opted in, never sends social media direct messages and never asks for your IP PIN. If a call worries you, hang up and call the number on your IRS letter or 800-829-1040.