Tax-related identity theft occurs when someone uses your Social Security number to file a fraudulent tax return and claim a refund before you file your legitimate return. It is one of the more disruptive forms of identity theft because it creates a direct conflict with the IRS that can take months to resolve — and it may surface at the worst possible time, when you are trying to file your own return and the IRS shows a return has already been filed under your number.
This guide explains how tax identity theft happens, the steps to take if it affects you, and what to look for when choosing a tax preparer who handles your sensitive information with appropriate care.
How Tax Identity Theft Works
The basic mechanism is straightforward: a fraudster obtains your name and Social Security number (SSN) — through a data breach, a phishing scheme, the dark web sale of previously stolen credentials, or other means — and uses that information to file a tax return claiming a refund. The return is typically filed early in the season, before you have a chance to file your own, and the refund is directed to a prepaid debit card or a bank account the fraudster controls.
When you later file your legitimate return, the IRS rejects it because a return has already been accepted for your SSN and tax year. That rejection is often the first sign that something has gone wrong.
Signs That Tax Identity Theft May Have Occurred
- Your electronically filed return is rejected with an error message stating that a return for your SSN has already been submitted for the year
- You receive an IRS notice about a return you did not file, income you did not earn, or an employer you have no relationship with
- The IRS or FTB sends you a notice about an outstanding tax debt for a year in which you filed a return and paid what you owed
- IRS records show wages from an employer you never worked for
- You receive a tax transcript that shows a filing or refund you did not initiate
What to Do If Tax Identity Theft Affects You
Step 1: Respond to the IRS
If your e-filed return is rejected because a return has already been filed for your SSN, complete IRS Form 14039 (Identity Theft Affidavit) and submit it with a paper copy of your legitimate return. The IRS Identity Protection Specialized Unit handles these cases. You will likely need to provide proof of identity — a copy of your driver’s license or passport and your most recent tax return.
Step 2: File a Police Report
Some creditors and credit bureaus require a police report number when you notify them of identity theft. File a report with your local law enforcement agency and keep a copy. You can also file a report with the Federal Trade Commission at IdentityTheft.gov, which provides a personalized recovery plan.
Step 3: Place a Credit Freeze or Fraud Alert
Tax identity theft often accompanies broader identity theft. Contact each of the three major credit bureaus (Equifax, Experian, TransUnion) to place either a fraud alert (which stays on your file for a year and requires lenders to take extra verification steps) or a credit freeze (which blocks new credit from being opened in your name until you lift it). A credit freeze is free and is generally considered more protective.
Step 4: Request an Identity Protection PIN
The IRS offers an Identity Protection PIN (IP PIN) — a six-digit number that must be included on any federal tax return filed under your SSN. If a fraudster tries to file a return using your SSN without the IP PIN, the IRS will reject it. Any taxpayer can now request an IP PIN through the IRS online account system; you do not need to have been a victim of identity theft to use the program.
California does not currently offer an equivalent state-level IP PIN, though the FTB has its own identity verification procedures when it detects suspicious filing activity.
Step 5: Notify Your Tax Preparer
If you used a tax preparer and believe their systems may have contributed to the theft — through a data breach, inadequate document security, or improper handling of your personal information — notify them immediately. Qualified preparers are required by IRS regulations (specifically the Gramm-Leach-Bliley Act Safeguards Rule, as it applies to tax preparers) to maintain written information security plans. A preparer who cannot describe their data security practices should not be handling your documents.
How Long Resolution Takes
The IRS has acknowledged in public reporting that identity theft cases can take significantly longer to resolve than standard return processing. In many cases, resolution takes several months. During this period, you may need to file a paper return and wait for your legitimate refund. Keeping records of every communication with the IRS — including dates, times, representative names, and confirmation numbers — is essential to tracking the case.
What to Look for in a Tax Preparer’s Data Security Practices
Your tax return contains some of the most sensitive personal and financial information you possess. The preparer who handles it has an obligation to protect it. When evaluating a preparer, consider asking:
- How do you transmit documents? A secure, encrypted client portal is the appropriate method. Standard email, particularly for documents containing SSNs or financial account numbers, is not secure enough.
- Do you have a written data security plan? The IRS requires paid preparers to maintain one. A preparer who does not know what a data security plan is has not complied with IRS guidance.
- How long do you retain client records, and how are they stored? Records should be retained in a secure, access-controlled system — not in an unsecured filing cabinet or on an unprotected laptop.
- Do you use multi-factor authentication on your practice management software? This is a basic security step that reduces the risk of a third-party breach through credential theft.
A qualified preparer who takes data security seriously should be able to answer these questions without hesitation. One who is evasive or dismissive about data security practices is a warning sign worth taking seriously.
Protecting Yourself Year-Round
Tax identity theft is not exclusively a filing-season problem. Fraudulent returns can be filed as soon as the IRS begins accepting them — often in January — using SSNs obtained at any point during the prior year. Steps worth taking regardless of the time of year:
- Enroll in the IRS Identity Protection PIN program before filing season begins
- Use strong, unique passwords for any financial, government (SSA, IRS), or healthcare accounts
- Be cautious about sharing your SSN — most businesses that ask for it (outside financial institutions, healthcare providers, and employers) do not actually need it
- Monitor your credit reports regularly through AnnualCreditReport.com or through your bank’s free monitoring service
- Be alert to phishing emails or calls claiming to be from the IRS — the IRS initiates contact by mail, not email, text message, or phone call
Frequently Asked Questions
How do I find out if someone has filed a tax return in my name?
The clearest sign is a rejected e-filed return. You can also check your IRS online account at IRS.gov, which shows the returns filed under your SSN, any outstanding balances, and your payment history. Reviewing this account periodically, even outside filing season, can surface unauthorized activity early.
Can I still get my refund if someone filed a fraudulent return first?
Yes, but it takes longer. After submitting Form 14039 and your legitimate paper return, the IRS will investigate and, once your identity is confirmed, process your legitimate return and issue your refund. The timeline varies and can take several months.
Is the IRS IP PIN effective at preventing fraudulent returns?
Yes. When an IP PIN is assigned to your account, the IRS will reject any return filed with your SSN that does not include the correct IP PIN. This is one of the most practical protections available. The IP PIN changes each year and is provided to you each January by the IRS.
Can my tax preparer’s data breach expose me to identity theft?
Yes. Tax preparers hold extensive personal and financial information on their clients, making them attractive targets for cybercriminals. The IRS requires preparers to maintain data security plans, but compliance varies. Asking about a preparer’s data security practices before sharing your documents is a reasonable and appropriate step.
What should I do if I suspect an IRS notice I received is a scam?
Do not call any phone number printed in a suspicious notice. Instead, go directly to IRS.gov and look up the notice number to confirm whether it is a real IRS notice type. You can also call the IRS general helpline using the number on IRS.gov to verify whether a notice was actually sent from the IRS. The IRS does not demand immediate payment over the phone or via gift cards.