Tax Identity Theft: How to Prevent and Respond to Tax Fraud

It is February. You sit down to file your tax return, click submit, and get an error message: "A return has already been filed using this Social Security number." Someone beat you to your own taxes — and walked away with your refund.

Tax identity theft is one of the most financially damaging forms of identity theft because the payoff is immediate and substantial. The average fraudulent federal refund is around 5,800 dollars, and criminals who operate at scale can file hundreds of fraudulent returns during a single tax season. The IRS caught over 1.1 million fraudulent returns in 2025, but an unknown number slip through.

Here is how tax identity theft works, how to prevent it before it happens, and exactly what to do if it happens to you.

How Tax Identity Theft Works

Tax fraud follows a predictable pattern that exploits the gap between when tax season opens and when most people actually file:

The Attack Sequence

1. Acquire SSNs and personal data: Criminals obtain Social Security numbers paired with names and dates of birth from data breaches, dark web markets, phishing campaigns, or W-2 theft. A complete tax identity (SSN + name + DOB + prior-year income estimate) sells for 10 to 50 dollars on dark web markets
2. File early: As soon as the IRS begins accepting returns (typically late January), criminals file fraudulent returns claiming inflated deductions and credits — particularly the Earned Income Tax Credit and the Additional Child Tax Credit, which generate the largest refunds
3. Route the refund: The refund is directed to a prepaid debit card, a bank account controlled by the criminal, or increasingly, converted to cryptocurrency through third-party payment platforms
4. Disappear: By the time the real taxpayer files their return weeks or months later and discovers the fraud, the criminal has already cashed out and moved on

The timing vulnerability is critical. The IRS begins accepting returns in late January, but most Americans do not file until March or April. That 8 to 12 week window is when the majority of tax identity theft occurs.

Who Gets Targeted

While anyone can be a victim, certain groups face higher risk:

• Late filers: The longer you wait to file, the wider the window for someone to file first. Taxpayers who file in April or file extensions are at the highest risk
• People who do not file: Low-income individuals, elderly non-filers, and dependents who are not required to file often do not realize someone is filing in their name year after year
• Data breach victims: If your SSN was exposed in any major breach (and statistically, it probably was), your tax identity data is likely available for purchase
• Workers in high-turnover industries: Restaurants, retail, and gig economy workers whose W-2 data passes through many hands
• Military personnel: Particularly those deployed overseas who may not file on the standard timeline

Preventing Tax Identity Theft

Get an IRS Identity Protection PIN

The IP PIN is the single most effective defense against tax identity theft. It is a six-digit number assigned by the IRS that must be included on your federal tax return. Without the correct IP PIN, even someone with your SSN, name, DOB, and complete W-2 data cannot successfully file a return in your name.

How to enroll:

1. Go to irs.gov/get-an-ip-pin
2. Create or sign in to your ID.me account (requires government photo ID and facial recognition verification)
3. Complete the identity verification process
4. Receive your six-digit IP PIN immediately

Important details:

• The IP PIN changes every year — you will receive a new one each January via mail and can also retrieve it online
• The program is available to all taxpayers nationwide, not just identity theft victims
• If you cannot verify online, file Form 15227 to verify by phone, or visit an IRS Taxpayer Assistance Center in person with two forms of ID
• Never share your IP PIN with anyone except the tax professional preparing your return
• Your IP PIN is separate from your IRS online account PIN or password

File as Early as Possible

The most practical defense besides the IP PIN: file your return as soon as you have all your tax documents. If your return is already on file, a criminal's fraudulent filing will be the one that gets rejected — not yours.

• Most W-2s and 1099s are available by early February
• File electronically for the fastest processing
• If you use a tax preparer, schedule your appointment for early February
• For self-employed individuals with complex returns, consider filing for an extension but pay estimated taxes early

Secure Your Tax Documents

• Opt for electronic W-2 delivery if your employer offers it — paper W-2s mailed through USPS are intercepted in mail theft operations
• Use your tax preparer's secure upload portal instead of emailing tax documents (email is not encrypted)
• Shred all physical tax documents after the recommended retention period (typically 3 to 7 years depending on the document type)
• Store digital copies in an encrypted folder or a password-protected cloud vault, not in plaintext on your desktop
• Be alert for phishing emails impersonating the IRS — the IRS never initiates contact via email, text, or social media

Protect Your Tax Software Accounts

• Use a strong, unique password for TurboTax, H&R Block, FreeTaxUSA, or whatever service you use
• Enable two-factor authentication (mandatory for most major tax platforms since 2024)
• Review your account at the start of each tax season — attackers who compromised your account last year may have set up auto-filing or changed your bank account information for refund routing

Warning Signs of Tax Identity Theft

You may have already been targeted if:

• Your electronically filed return is rejected as a duplicate
• You receive an IRS notice about a return you did not file
• You receive a refund you did not request (do not spend it — it may be part of a fraud scheme)
• Your IRS online account shows a return filed that you did not submit
• You receive a notice from the IRS about income from an employer you do not recognize
• You receive an IRS notice that an online account was created in your name when you did not create one
• You receive a notice that your IP PIN was used on a return you did not file (this indicates the IP PIN itself was compromised)

What to Do If You Are a Victim

Immediate Actions

1. Do NOT re-attempt electronic filing. Your electronic return will continue to be rejected because a duplicate is already on file. You must switch to paper filing
2. Complete IRS Form 14039 (Identity Theft Affidavit). Download it from irs.gov or request it by calling 800-908-4490
3. File a paper return by mail. Attach Form 14039 to the front of your paper tax return. Mail to the IRS address specified in the form instructions (this varies by state)
4. Contact the IRS Identity Protection Specialized Unit at 800-908-4490 (hours: Monday-Friday, 7am-7pm local time). Request a case number and ask about your specific timeline
5. File a report at IdentityTheft.gov. The FTC report creates a legal record and generates template letters for other steps in your recovery

Follow-Up Actions

• Request a filing extension if needed: If the investigation will take past the standard deadline, file Form 4868 by April 15 to get an automatic six-month extension. You still owe any estimated taxes by the original deadline, but the extension prevents late-filing penalties
• Monitor your IRS account: Create an account at irs.gov to track the status of your return and investigation. You can also see any returns filed under your SSN
• Apply for an IP PIN: If you did not already have one, apply immediately. The IRS may also automatically enroll you after confirming the identity theft
• Check state returns: Contact your state tax agency to verify whether a fraudulent state return was also filed. State and federal tax fraud often occur together
• Review your credit reports: Tax identity theft frequently accompanies broader identity theft. Pull reports from all three bureaus and check for unfamiliar accounts

State Tax Identity Theft

State-level tax identity theft is growing faster than federal tax fraud because state tax agencies generally have weaker identity verification systems than the IRS.

Why States Are More Vulnerable

• Many states do not have an IP PIN equivalent
• State e-filing systems often require less identity verification
• State tax agencies have smaller fraud detection budgets and teams
• Some states have higher-value credits and deductions that are easy to exploit

Protecting Your State Return

• Check your state tax agency website for identity verification or PIN programs — a growing number of states now offer them
• File your state return as early as your federal return
• Set up an online account with your state tax agency if one is available — this lets you monitor for unauthorized filings
• If your state return is rejected as a duplicate, contact your state tax agency directly. Do not assume the IRS investigation covers your state

Employer-Related Tax Identity Theft

A separate but related threat: someone uses your SSN for employment. This results in income being reported to the IRS under your SSN that you did not earn, which can:

• Trigger IRS notices about unreported income
• Increase your tax liability if the phantom income pushes you into a higher bracket
• Affect eligibility for income-based programs (Medicaid, ACA subsidies, student financial aid)
• Corrupt your Social Security earnings record, potentially affecting future benefits

How to Detect Employment Fraud

• Review your IRS Wage and Income Transcript at irs.gov — this shows all W-2s and 1099s filed under your SSN. If you see income from an employer you have never worked for, someone is using your SSN for employment
• Check your Social Security Statement at ssa.gov/myaccount for unfamiliar employer earnings
• Pay attention to IRS notices about discrepancies between your reported income and what employers reported under your SSN

How to Resolve It

1. File Form 14039 with the IRS noting the specific employer and income that is not yours
2. Contact the SSA at 800-772-1213 to report the earnings fraud and request correction of your earnings record
3. If the fraudulent income caused a tax discrepancy, respond to any IRS notice with documentation showing the income is not yours
4. Consider filing an FTC report at IdentityTheft.gov if the employment fraud is part of broader identity theft

The Bottom Line

Tax identity theft is preventable. The IRS IP PIN program is free, available to everyone, and eliminates the primary attack vector entirely. Combine it with early filing, and you have closed the two biggest vulnerabilities criminals rely on. If you do nothing else after reading this article, get your IP PIN today at irs.gov/get-an-ip-pin. It takes 15 minutes and protects you every tax season going forward.