1. How the Scam Works
A thief gets your Social Security number. In January or February — before you file — they send the IRS a fake return using your number, with made-up wages and withholding that produces a big refund. The money goes to a prepaid card or account they control. Then you file your real return, and the IRS rejects it. A return already exists for your number. You did everything right, and now the government thinks *you* are the copy. That is tax identity theft. It is common, it is annoying, and it is fixable — but not fast. This guide covers the signs, the one tool that prevents it, and the recovery steps in order.
2. How You Will Find Out
Most victims learn in one of three ways: **Your e-filed return is rejected.** The rejection says a return was already filed with your Social Security number. If you had not filed yet, that is near-certain proof of theft. **An IRS notice arrives about things that are not yours.** Wages from an employer you never worked for. A balance due on a return you never filed. Letter 5071C or 5747C asking you to verify your identity. An online IRS account you never opened. **Your records show strangers.** Your IRS online account or wage transcripts list income or dependents that are not yours. One more thing worth knowing: the IRS does not start contact by email, text, or social media, and it does not demand gift cards or threaten arrest over the phone. If "the IRS" does any of that, the message itself is the scam.
3. The One Tool That Stops It: the IP PIN
The **Identity Protection PIN** is a six-digit number known only to you and the IRS. A return with your Social Security number cannot be e-filed without it. A thief can have your number, your W-2, and your address — and still cannot file, because they do not have the PIN. Any taxpayer can get one. Create an IRS online account at irs.gov, verify your identity, and retrieve your PIN. It changes every year, so you collect the new one each January. Two honest warnings before you enroll. Once you use an IP PIN, you must use one every year — there is no opting out. And if you hire a preparer, you have to share the PIN with them for that filing, so treat your preparer's security the way this article treats yours.
4. Before Anything Goes Wrong
- **File early.** The thief has to beat you to the IRS. Filing in January or February shrinks their window. - **Guard the documents.** W-2s and 1099s arrive in mailboxes that are easy to steal in January. Use a locked mailbox, take mail in promptly, and shred what you no longer need. - **Check your preparer.** A sloppy preparer is a leak. How to check that your preparer is legitimate takes five minutes — including the security questions. - **Watch your accounts.** Your IRS online account, your Social Security earnings statement, and your credit report all show early signs of trouble. Florida has no state income tax return to steal. If you moved from a taxed state, or worked one remotely, that state's return can still be targeted — report it to that state's revenue department if something looks wrong.
5. If It Happened: the Steps, in Order
**1. Confirm it.** A rejection can be a typo. If your return rejects twice with "a return already filed," treat it as theft and act. **2. File Form 14039.** This is the Identity Theft Affidavit — the form that tells the IRS "that was not me." Download it from irs.gov, check the box that matches your situation, and attach copies (never originals) of your ID, proof of your Social Security number, and proof of address. The current mailing address is in the form's instructions — use those, not a cached list. **3. File your real return on paper.** E-filing will keep rejecting. Mail your actual return with the Form 14039 on top. **4. Make the calls that protect everything else.** Report at IdentityTheft.gov (the FTC builds you a recovery plan). Place fraud alerts with the credit bureaus — one call to any of the three now covers all of them. File a police report if your bank or others ask for one. **5. If you have a preparer, tell them today.** Send the rejection or the notice immediately — we would rather see it the day it arrives than a week later. Deadlines inside IRS notices are short, and some notices are real even when they look fake. **6. Settle in.** A typical case takes six to twelve months. Your refund waits until the case closes. Collection activity on the fake balance is suspended while the IRS sorts it out. Keep filing on time every year in the meantime, and you will most likely be enrolled in the IP PIN program automatically — which, after all this, you may want anyway.
6. While You Wait
Keep a folder: every notice, every call (with dates and names), every mailing receipt. Answer IRS requests quickly — slow answers stretch the timeline. Check your refund status the normal way: where your refund is and what the codes mean.
7. Business Owners: EINs Get Stolen Too
The same trick works with an Employer Identification Number — fake 941s, refunds, even credit lines in your business's name. The warning signs are IRS notices about employees you never hired or filings you never made. The fix is Form 14039-B, the business version of the affidavit, plus the same calls. Guard the EIN the way you guard your own number.
8. Who to Call
- **IRS identity theft hotline:** 1-800-908-4490 - **FTC recovery plan:** IdentityTheft.gov - **Taxpayer Advocate Service** (if the case stalls): 1-877-777-4778 - **SSN misuse:** 1-800-269-0271 If a notice has you unsure whether it is real — send it to us. Reading the real ones apart from the fake ones is part of the job.