How Can Tax Identity Theft Occur? Warning Signs and Prevention

The IRS defines tax identity theft as the use of your SSN or Individual Taxpayer Identification Number (ITIN) to file a tax return fraudulently, claim a refund you did not authorize, or obtain employment while misrepresenting identity. The most common scenario involves a thief obtaining your SSN, filing a fake return early in the tax season before you file your own, and collecting a refund in your name. When you later file your legitimate return, the IRS flags it as a duplicate and sends you a notice — often your first indication that something is wrong.

Tax identity theft is distinct from data breaches or financial account fraud, though those events may enable it. The FTC and the IRS Criminal Investigation division both work to prosecute tax fraud, but resolution can take considerable time even after the crime is reported. Protecting your W-2 and tax documents is one of the most direct ways to reduce your risk.

Data breaches are among the most frequent sources of stolen SSNs used in tax fraud. When companies, hospitals, insurers, or government agencies are hacked, vast amounts of personal identifying information — including SSNs, dates of birth, and addresses — may be exposed. Thieves then sell this data on dark-web marketplaces, where it can be purchased and used by fraudsters to file fake returns.

Phishing attacks are another common method. Criminals send emails or text messages impersonating the IRS, a bank, or a tax preparer, asking you to provide or confirm your SSN, login credentials, or financial details. The IRS does not initiate contact with taxpayers by email, text message, or social media to request personal or financial information — any such contact should be treated as suspicious.

Physical theft — such as stealing mail containing W-2s, 1099s, or Social Security cards — also remains a route for tax identity thieves. Unscrupulous tax preparers who misuse client information represent another, though less common, risk. Being careful about who you share your SSN with and how you dispose of sensitive documents can reduce your exposure. If your personal data was exposed, you may also want to review your IRS transcript to check for unauthorized filings.

The most direct warning sign is receiving an IRS notice stating that more than one return was filed using your SSN for the same tax year, or that wages were reported from an employer you did not work for. You may also receive a notice that you owe additional tax, have a refund offset, or have had collection actions taken for a year you did not file. Any IRS correspondence about a year you did not file — or for which you already filed — warrants immediate attention.

Other indirect signs include being unable to e-file because a return with your SSN was already accepted, or receiving a tax transcript that shows income you do not recognize. You can request an IRS transcript at any time to review your official tax records. The IRS recommends that taxpayers who receive unexpected notices call the number on the notice or contact the IRS Identity Protection Specialized Unit at 1-800-908-4490. Monitoring your credit score regularly can also alert you to new accounts you did not open, which may signal broader identity theft.

If you believe you are a victim of tax identity theft, the IRS recommends filing Form 14039, Identity Theft Affidavit, along with your paper tax return or as a standalone document. This form alerts the IRS to the issue and initiates their identity theft resolution process. You should also report the theft to the FTC at IdentityTheft.gov, which provides a personalized recovery plan.

Resolution of tax identity theft cases may take a year or more in complex situations, though the IRS has worked to reduce this timeline. During the resolution period, your legitimate refund may be delayed. The IRS will eventually issue any refund you are owed, but you may need to file paper returns for subsequent years while the case remains open. While your case is being resolved, continue monitoring your financial accounts and consider whether any credit report corrections may also be needed.

One of the most effective tools to prevent tax identity theft is the IRS Identity Protection PIN (IP PIN), a six-digit number known only to you and the IRS. When you file your tax return with your IP PIN, the IRS can verify that the return was submitted by you and will reject any attempt to file without it. As of 2026, any taxpayer — not just victims of identity theft — may opt into the IP PIN program through the IRS website.

You can obtain an IP PIN by creating an online account at IRS.gov and navigating to the IP PIN tool, or by filing Form 15227 if you do not have internet access. Your IP PIN changes each year and must be used on every federal tax return you file during that calendar year. Keep your IP PIN secure and do not share it — sharing it would negate its protective value. Filing your W-4 accurately also helps ensure your withholding is correct and reduces the chances of a large refund that could attract fraud attempts.