Identity Theft and the IRS

Tax-related identity theft happens when someone uses your Social Security number or other taxpayer ID to file a tax return, claim a refund, or collect wages, usually without your knowledge. Often the first sign is an e-filed return that is rejected because a return was already filed under your number, or a letter from the IRS asking you to confirm your identity. This page explains the usual steps, the role of Form 14039, and how an Identity Protection PIN helps.

Signs of tax identity theft

The IRS lists several warning signs, none of which proves identity theft by itself:

• Your e-filed return is rejected, or you receive a notice about a return you did not file.
• You receive a Form W-2 or 1099 from an employer you never worked for, or a Form 1099-G for unemployment benefits you did not request.
• A notice about an EIN you did not apply for, or a CP2000 notice about income you did not earn.
• Unexpected changes or password alerts on your IRS online account.

Step one: respond to IRS letters

If the IRS suspects a fraudulent return, its Taxpayer Protection Program may send a letter such as Letter 5071C, 4883C or 5747C (more on these letters). The IRS will not process the return or issue a refund until you respond. You can verify your identity and the return using the online tool or the toll-free number printed on the letter. If you did file the return, have the letter and a prior-year return ready. If you did not, the IRS removes the return from your records. Do not file Form 14039 in response to these letters.

Check that the letter really comes from the IRS before using any link or number; see whether an IRS letter is real.

Form 14039: when it is needed

Form 14039 is the Identity Theft Affidavit. The IRS says most people do not need it. It is generally used when:

• the IRS tells you to file it;
• you cannot use the verification service; or
• you want to report possible tax-related identity theft that the IRS does not know about, such as after a data breach.

Do not file it if you already sent one, if the IRS already sent you a letter, if the theft is not tax-related, or if you are using the verification service. Duplicate forms and repeated status calls slow processing. Businesses use Form 14039-B. If you discover the problem because your e-filed return was rejected, the IRS directs you to file a paper return and attach Form 14039.

What the IRS does after Form 14039

Your case goes to the IRS Identity Theft Victim Assistance organization. A specially trained employee determines which tax years are affected, addresses the fraudulent return and checks for additional victims, processes your legitimate return and releases any refund you are owed, removes the fraudulent return from your records, and places an identity theft indicator on your account.

The IRS says it aims to resolve cases within about 120 days, and it has acknowledged that real-world times have been much longer. Keep copies of every letter and record the dates of your calls.

Other steps to take

1. Report the theft to the Federal Trade Commission at IdentityTheft.gov and follow its recovery plan.
2. Secure your accounts, including your IRS online account, with strong, unique passwords.
3. Consider fraud alerts or a credit freeze with the credit bureaus, and close accounts opened in your name.
4. Contact your state tax agency. State returns can be affected too.
5. Do not report income from an employer you never worked for. Contact the Social Security Administration instead.
6. File and pay as usual. If you cannot e-file, file on paper.

The Identity Protection PIN

An IP PIN is a six-digit number that prevents someone else from filing a return using your SSN or ITIN. Only you and the IRS know it. Anyone who can verify their identity can request one. The IRS says the PIN is valid for one calendar year and a new one is generated each year.

• Online (fastest). Request it in the IP PIN section of your IRS online account profile.
• Form 15227. If you cannot set up an online account and meet the income limits on the form, the IRS verifies you by phone and mails the PIN.
• In person. Schedule an appointment at a Taxpayer Assistance Center and bring the required identification.

Once you have an IP PIN, you must use it on any federal return you file that year, including prior-year returns, or an e-filed return will be rejected and a paper return delayed. Confirmed identity theft victims are enrolled automatically. Give the PIN to your preparer when requested, but never share it with anyone who contacts you unexpectedly.

Dependents claimed by someone else

If a dependent was claimed on another return, the IRS notifies you but cannot tell you who claimed the dependent. If the IRS audits the claim, you must prove you are entitled to claim that person. A paper return with a duplicate dependent claim can take 6 to 8 weeks to process.

How we can help

We can help you read the IRS letter, prepare and file a paper return with Form 14039 when it is required, request IRS transcripts to see what was filed in your name, and communicate with the IRS if you sign a power of attorney. We cannot speed the IRS's internal processing, but we can keep your documentation organized.

Read about our individual tax preparation services or contact us.

Frequently asked questions

General information only, not tax, legal or accounting advice for your situation. Rules, limits and deadlines change; confirm the current rules with the official source or a qualified professional before you act. Reading this page does not create a professional relationship with CPA Tax Payroll and Accounting Corp.