Tax-related identity theft happens when someone files a return using another person's Social Security number to claim a refund. The victim usually discovers it when their own e-filed return is rejected as a duplicate. The IRS Identity Protection PIN — a six-digit code that changes each year — blocks that scenario, and it is open to any taxpayer who wants one.
How does tax identity theft actually work?
A return filed early in the season, using a stolen Social Security number and fabricated wage figures, requests a refund routed to an account the thief controls. The mechanics are simple, which is why the fraud persists. Because the IRS processes returns faster than it receives all the third-party data that would contradict them, the refund can be issued before anything looks wrong. When the real taxpayer files months later, the system sees a second return for the same number and rejects it.
Common signals that a Social Security number has been used without permission:
- An e-filed return is rejected because a return with that number is already on file.
- An IRS notice arrives about a return, an employer, or wages the taxpayer does not recognise.
- IRS records show income from a company the taxpayer never worked for.
- A notice references an online account the taxpayer never created.
- A refund arrives that was never requested, or is a different amount than expected.
What is an Identity Protection PIN, and who can get one?
An IP PIN is a six-digit number known only to the taxpayer and the IRS. Once assigned, an electronically filed return without the correct IP PIN is rejected, and a paper return without it faces additional scrutiny and delay. That single check defeats the fraud above, because a stolen Social Security number alone is no longer enough to file.
The programme began as a remedy issued only to confirmed victims. It is now opt-in for anyone with a Social Security number or ITIN who can verify their identity — no prior theft required. The number is regenerated annually, and enrolment carries a real obligation: once a taxpayer is in the programme, every return needs the current year's PIN.
| Point | Detail |
|---|---|
| Length | Six digits |
| Validity | One calendar year; a new PIN each year |
| Eligibility | Any taxpayer who can verify identity |
| Fastest route | The IRS Get an IP PIN online tool |
| Where it goes | On the return; also on Forms 1040-NR, 1040-PR, 1040-SS |
| Cost | None |
The IRS never asks for an IP PIN by phone, email or text. Any message doing so is a phishing attempt, and that holds without exception — a genuine IRS contact about an identity issue begins with a letter.
What happens after a fraudulent return is already filed?
The rejected e-file is the start of a process, not the end of one. The taxpayer generally files Form 14039, the Identity Theft Affidavit, to report the duplicate filing, and submits their own legitimate return on paper, since the electronic channel is closed for that number that year. The IRS then works the case: verifying which return is genuine, removing the fraudulent one from the account, and releasing any refund properly owed.
The timeline is the hard part. Case resolution has historically run to many months, and the refund is held throughout. Taxpayers whose case is resolved are generally issued an IP PIN automatically for subsequent years, which is why the programme is worth joining before there is a problem rather than after.
Does an IP PIN protect against everything?
No, and the limits are worth being clear about. An IP PIN protects the filing of a federal return under that Social Security number. It does not stop someone opening credit in the taxpayer's name, does not cover state returns (several states run their own separate PIN programmes), and does not undo a breach that exposed the number in the first place. It is one control addressing one specific fraud, and it addresses that one well.
Dependants can be enrolled too, which closes a frequently exploited gap: a child's Social Security number claimed as a dependant on someone else's return, often noticed only when the parent's own return is rejected.
Where to get help
Taxpayers working through an active identity-theft case — a rejected return, an unfamiliar notice, wages reported from an unknown employer — can compare credentialed practitioners through the recognized professional bodies for the United States. A CPA or enrolled agent holding a valid authorisation can correspond with the IRS on a taxpayer's behalf while a case is open; how to verify a tax preparer covers checking that credential first.
Sources
- Internal Revenue Service (IRS) — the federal tax authority. Operates the Identity Protection PIN programme and the Get an IP PIN tool, publishes Form 14039 (Identity Theft Affidavit), and maintains the Identity Theft Central resource for affected taxpayers.
- Federal Trade Commission (FTC) — operates IdentityTheft.gov, the federal reporting and recovery-plan service for identity theft generally, including its non-tax consequences.