What to Do If Your Tax Return Is Filed Fraudulently

You sit down to file your tax return, click submit, and get a rejection notice: a return has already been filed using your Social Security number. Or perhaps a letter arrives from the IRS about a return you never filed or income you never earned. Either way, the realization hits -- someone has committed tax identity theft in your name. It is a growing problem, with the IRS flagging roughly 2.1 million returns as potential identity theft in a single year. The good news is that the IRS has established a clear process for victims, and acting quickly can help you recover your refund and protect yourself going forward.

How Tax Identity Theft Works

Tax identity theft occurs when a criminal uses your Social Security number to file a fraudulent tax return and claim a refund in your name. The thief typically files early in the tax season -- before you do -- and reports fake income and withholding information designed to generate a large refund. By the time you try to file your legitimate return, the IRS has already accepted the fraudulent one.

The stolen SSN often comes from data breaches, dark web marketplaces, or data broker sites that collect and sell personal information. In one recent incident, a data broker left 676 million Americans' Social Security numbers, names, addresses, and dates of birth exposed on a misconfigured server. When that kind of data is available, criminals have everything they need to impersonate you at tax time.

Step 1: Do Not Panic -- but Act Immediately

Tax identity theft is serious, but it is recoverable. The IRS has a dedicated Identity Theft Victim Assistance unit staffed with specialists trained to resolve these cases. What matters most right now is that you move quickly through the reporting steps so the IRS can flag your account and begin investigating.

Step 2: File IRS Form 14039 (Identity Theft Affidavit)

Form 14039 is the official document that tells the IRS you are a victim of identity theft and that a fraudulent return was filed using your SSN. Here is how to submit it:

1. File online through IdentityTheft.gov -- this is the fastest method. The FTC's site will walk you through questions, auto-populate Form 14039 with your answers, and submit it electronically to the IRS
2. Or download the paper form from irs.gov, complete it, and mail or fax it using the address or number printed on the form
3. Attach supporting documentation such as IRS notices you received, a copy of your government-issued ID, and any evidence of the fraudulent activity

Once submitted, your case is assigned to a specialist in the IRS Identity Theft Victim Assistance organization. Do not file a second Form 14039 for the same incident, as duplicates will cause delays.

Step 3: File Your Legitimate Tax Return

Even though your e-filed return was rejected, you still need to file. Print and mail a paper copy of your tax return along with Form 14039 to the IRS. Attach documentation proving your identity, including a copy of your Social Security card, driver's license, or passport. The IRS will process your legitimate return once the investigation confirms the fraud.

Be prepared for delays. During fiscal year 2025, the average resolution time for identity theft cases through the Taxpayer Advocate Service was approximately 21 months. While this is frustrating, the IRS will eventually issue any refund you are owed, plus interest.

Step 4: Report to the FTC

File an identity theft report at IdentityTheft.gov. The FTC will create a personalized recovery plan and generate an official Identity Theft Report, which serves as documentation you can use with creditors, credit bureaus, and law enforcement. The FTC also pre-fills letters and forms you may need and tracks your progress through each recovery step.

You can also report by phone at 1-877-IDTHEFT (1-877-438-4338).

Step 5: Request an IRS Identity Protection PIN

An Identity Protection PIN (IP PIN) is a six-digit number known only to you and the IRS. Once you have an IP PIN, it must be included on your federal tax return each year. If a criminal tries to file a return with your SSN but without the correct IP PIN, the return will be rejected automatically.

Any taxpayer with a Social Security number or Individual Taxpayer Identification Number can request an IP PIN. The fastest way is through your IRS Online Account at irs.gov/get-an-ip-pin. You will need to verify your identity through ID.me. If you cannot verify online, you can submit Form 15227 (if your adjusted gross income is below $84,000 for individuals or $168,000 for married filing jointly) or visit a Taxpayer Assistance Center in person.

Your IP PIN is updated annually and typically becomes available in your online account in mid-January each year.

Step 6: Freeze Your Credit and Place Fraud Alerts

If someone had access to your SSN to file a fraudulent tax return, they may also try to open credit accounts in your name. Take these protective steps immediately:

• Freeze your credit at all three major bureaus -- Equifax, Experian, and TransUnion. A freeze blocks creditors from accessing your report, which prevents new accounts from being opened. It is free and does not affect your credit score
• Place a fraud alert with one bureau (it will notify the other two), which requires creditors to take extra verification steps before approving new credit
• Review your credit reports at AnnualCreditReport.com for any accounts or inquiries you do not recognize

Step 7: Monitor and Follow Up

Tax identity theft recovery requires patience and vigilance. Stay on top of your case:

• Check your IRS account online regularly for updates on your case status
• Respond promptly to any IRS correspondence -- delayed responses can add months to your timeline
• Review your IRS tax transcript at irs.gov to confirm no additional fraudulent returns have been filed
• File your tax return as early as possible in future years to beat potential fraudsters
• Continue monitoring your credit reports monthly for at least a year

How Data Brokers Fuel Tax Identity Theft

Tax identity theft does not start with the IRS -- it starts with your personal data being available to criminals. Data brokers and people search websites aggregate your name, address, date of birth, phone number, family members, and in some cases your Social Security number from public records, commercial databases, and other brokers. This information is often sold to anyone willing to pay, and data breaches at these companies have repeatedly exposed millions of SSNs at once.

When a criminal can purchase or scrape your SSN alongside your full name and date of birth, filing a fraudulent tax return becomes disturbingly simple. Removing your information from these sources reduces the raw material available to identity thieves.

How PrivacyOn Helps Protect You

PrivacyOn automates the removal of your personal information from 100+ data broker sites, cutting off a primary source of the data criminals use for tax fraud and other forms of identity theft. The service continuously monitors for re-listings -- because data brokers routinely re-collect and republish your data -- and includes dark web monitoring to alert you if your SSN or other sensitive information appears in underground marketplaces. A credit freeze protects you from new accounts being opened, but it does nothing to stop your personal data from being collected and sold. Combining a credit freeze with PrivacyOn's data removal gives you a more complete defense against tax identity theft and the many other threats that follow a compromised SSN.

Key Contacts and Resources

• IRS Identity Theft Central: 1-800-908-4490
• FTC Identity Theft Report: IdentityTheft.gov or 1-877-438-4338
• IRS IP PIN Request: irs.gov/get-an-ip-pin
• IRS Form 14039: irs.gov/pub/irs-pdf/f14039.pdf
• Credit Report Review: AnnualCreditReport.com
• Social Security Administration: ssa.gov or 1-800-772-1213