Tax identity theft happens when someone uses your Social Security number (SSN) or individual taxpayer identification number (ITIN) to file a fake return and claim a refund, or to work under your name. It is stressful, but it is fixable, and the steps are well defined. The key is to use the right IRS process for your situation. Filing the wrong form, or filing twice, can slow your case down.
Warning signs
The IRS lists these signs that your identity may have been used for tax purposes:
- Your e-filed return is rejected because a return was already filed with your SSN.
- A W-2 or 1099 arrives from an employer or payer you don't know.
- A Form 1099-G shows unemployment benefits you never applied for or received.
- An IRS notice about income you didn't report, such as a CP2000, when the income isn't yours.
- An employer identification number (EIN) you never applied for appears in your name.
- Accounts you didn't open, including an IRS Online Account, or someone offering to "help" you with your Online Account.
- Social Security records show wages you didn't earn.
The IRS notes that these signs don't always mean identity theft. A typo, a late W-2 or a family member's mistake can cause some of them. But each one is worth checking.
First, figure out which situation you're in
| Your situation | What to do |
|---|---|
| The IRS sent you a Letter 5071C, 4883C or 5747C asking you to verify your identity | Follow the letter. Verify online, by phone or in person as it says. Do not file Form 14039. |
| Your e-filed return was rejected because your SSN was already used | File your return on paper and attach Form 14039 |
| You got an IRS notice about income or a balance you don't recognize | Respond to that notice using its instructions; call the number on it |
| Your SSN was exposed in a data breach, but nothing has happened with your taxes | Get an IP PIN. File Form 14039 only if the IRS hasn't already been told and you believe tax-related theft is likely |
| Your identity was stolen, but not for tax purposes | Report it at IdentityTheft.gov; Form 14039 isn't needed |
When to file Form 14039 (and when not to)
Form 14039, Identity Theft Affidavit, tells the IRS your identity was used for tax purposes. The IRS says most people do not need to file it. File it only if:
- The IRS tells you to.
- You can't use the IRS Identity and Tax Return Verification Service.
- You want to report possible tax-related identity theft that the IRS doesn't already have on file, such as after a data breach.
Do not file Form 14039 if you already submitted one (including through IdentityTheft.gov), if the IRS already sent you a letter or notice about the issue, if the identity theft isn't tax-related, or if you used or were told to use the verification service. Businesses use Form 14039-B instead.
What to do if your e-filed return is rejected
- Check for a simple mistake first. Make sure you typed your SSN correctly and that no one else in your household (such as a dependent) already filed using your number.
- Get an IP PIN if you can. If you already have an Identity Protection PIN, use it; the IRS says it lets the true taxpayer e-file.
- File your complete return on paper. Attach a completed Form 14039 and mail the package to the IRS location for your state, the same place you would mail a paper return. Keep copies.
- Keep filing and paying. The IRS says to keep filing your returns and paying any tax, even if you must file on paper.
- Report the theft beyond the IRS. Follow the Federal Trade Commission's steps at IdentityTheft.gov, which include placing a fraud alert with a credit bureau and closing accounts opened in your name. Check with your state tax agency too.
- Protect yourself going forward. Get an IP PIN for future years and set up your IRS Online Account so you can watch for activity.
Dependent already claimed? For tax year 2024 and later, the IRS says primary taxpayers can e-file even if a dependent was already claimed on another return, as long as they enter a valid IP PIN. Without an IP PIN, you file on paper. A duplicate dependent claim is usually a dispute between people, not identity theft, and Form 14039 isn't the tool for it.
What the IRS does after you file Form 14039
Your case goes to the IRS Identity Theft Victim Assistance (IDTVA) organization, where a specially trained employee handles it. According to the IRS, the employee will:
- Find which tax years were affected and look for other victims
- Process your real return and release any refund you are owed
- Remove the fraudulent return from your account
- Add an identity theft marker to your account
The IRS asks you not to send duplicate forms and not to call about status, because both slow things down. Respond quickly to any IRS request for information. If you get a balance due notice caused by the theft, call the number on that notice.
How long it takes
The IRS says you will get a letter when your case is resolved, "generally within 120 days." But the same page says that because of backlogs, it is taking an average of 580 days to resolve identity theft cases. The Taxpayer Advocate Service, in its Fiscal Year 2026 Objectives Report, said rising inventories had pushed the average to about 611 days.
That is a long wait, especially if you are counting on a refund. If the delay is causing a financial hardship, such as risk of eviction or losing a car you need for work, contact the Taxpayer Advocate Service. If you have already worked with the IRS and the issue still isn't resolved, the IRS says you can call its specialized identity theft line at 800-908-4490.
The Identity Protection PIN (IP PIN)
An IP PIN is a six-digit number that prevents anyone else from filing a return with your SSN or ITIN. Returns without the right IP PIN are rejected if e-filed, or delayed if filed on paper. The IRS says anyone with an SSN or ITIN who can verify their identity can enroll, and parents or guardians can get one for dependents.
How to get one:
- Online (fastest). Use the IP PIN section of your profile in your IRS Online Account. You must be 18 or older and verify your identity. See IRS transcripts and your Online Account.
- Form 15227. If you can't use an online account, you can apply with Form 15227 if the adjusted gross income on your last return was below $84,000 (individuals) or $168,000 (married filing jointly), according to the IRS page last updated Aug. 4, 2026. The IRS calls you to verify, and the PIN arrives by mail, usually in four to six weeks.
- In person. Make an appointment at a Taxpayer Assistance Center and bring a photo ID plus one more ID. The PIN usually arrives by mail within three weeks.
Key rules:
- A new IP PIN is issued every year and is valid for one calendar year.
- If the IRS enrolled you because you were a confirmed victim, it mails a CP01A with your new PIN each year. If you signed up online yourself, you get the new PIN online each year.
- Use the IP PIN on any return you file during that year, including prior-year returns.
- The IRS never asks for your IP PIN by phone, email or text. Anyone who does is a scammer.
If you were scammed into giving out your information
If you gave your SSN, bank details or IRS login to a scammer, stop all contact and tell your bank. Follow the steps at IdentityTheft.gov, get an IP PIN, and set up an IRS Online Account with multifactor authentication. See our guide to IRS scams to learn how to report the contact.
An optional identity theft recovery kit is available on this site. The steps above cover everything you need to do on your own.
Frequently asked questions
How do I know if someone filed a tax return in my name?
The most common sign is an e-filed return rejected because your SSN was already used. You may also get an IRS letter asking you to verify a return you didn't file, or notices about income from jobs you never had. Your IRS Online Account and your account transcript can show returns and income posted to your SSN.
Should I file Form 14039 if I got Letter 5071C?
No. The IRS says not to file Form 14039 when it has already sent you an identity verification letter. Follow the letter's instructions to verify. If you didn't file the return in question, say so during verification and it will be removed.
Will I still get my refund?
Usually, yes, once the IRS confirms your identity and processes your real return. The wait can be long. The IRS reports an average of 580 days to resolve cases that go to its Identity Theft Victim Assistance unit.
Do I need an IP PIN every year?
Yes. Each IP PIN is good for one calendar year. If the IRS enrolled you after identity theft, it mails a new one each year. If you signed up online, you retrieve the new PIN online.
Does someone using my SSN to work mean I owe more tax?
You may get a notice showing wages that aren't yours. Answer that notice and explain that the income isn't yours, with any proof you have. Also check your Social Security earnings record so your benefits are based on your real earnings.
Should I hire a company to fix my tax identity theft?
You don't need to. The IRS process is free. If you need help, the Taxpayer Advocate Service and Low Income Taxpayer Clinics are free or low-cost options, and a CPA or enrolled agent can help with complex cases.
Sources
- Internal Revenue Service (IRS), "Identity theft guide for individuals". irs.gov
- IRS, "How IRS ID theft victim assistance works". irs.gov
- IRS, "Get an identity protection PIN". irs.gov
- IRS, Publication 5027, "Identity Theft Information for Taxpayers". irs.gov
- IRS, "If you were scammed". irs.gov
- Taxpayer Advocate Service, "Objective 3 2026" (FY 2026 Objectives Report). taxpayeradvocate.irs.gov
IRSV.com is an independent guide and is not affiliated with the IRS. This page is general information, not tax or legal advice. Rules change; confirm details on IRS.gov or with a tax professional. Found an error? Tell us.
