Tax Identity Theft and the IP PIN

By Tom, CPA · Updated October 27, 2026

Part of: Tax Planning

TL;DR: An IRS Identity Protection PIN is a free six-digit code that blocks anyone else from e-filing with your SSN. Anyone who can verify their identity can get one online; it changes every year. Victims should respond to IRS letters, file Form 14039 if directed, and freeze credit.

Educational only, not tax, legal, or investment advice. Examples are illustrations, not predictions. Rules and limits change; verify current figures and talk to a qualified professional about your situation.

The tax code is 4 million words long, and identity thieves have read the parts about refunds very carefully. Tax identity theft usually works like this: someone files a fake return using your Social Security number early in the season, claims a refund, and disappears. You find out when your real return is rejected because "a return has already been filed." Sorting it out can take months.

The best defense costs nothing: an Identity Protection PIN (IP PIN) from the IRS. This guide explains how it works, how to get one, what to do if you are already a victim, and the scams that target taxpayers. As of Oct 2026.

CPA Warning Label: Never give your IP PIN or SSN to anyone who contacts you unsolicited. Verify any IRS letter through your online account or IRS.gov before acting.

What an IP PIN is

An IP PIN is a six-digit number the IRS assigns to you. Once you have one, any e-filed Form 1040 using your SSN or ITIN must include the correct IP PIN, or the IRS rejects it. Paper returns without it are delayed for extra review. A thief with your SSN but not your PIN cannot file successfully.

Key facts from the IRS:

• Anyone with an SSN or ITIN who can verify their identity can get one. You do not need to be a theft victim.
• It is valid for one calendar year. A new PIN is generated each year.
• It is used on Forms 1040, 1040-NR, 1040-PR, 1040-SR and 1040-SS, including prior-year returns filed late.
• Each person on a return with an IP PIN enters their own: you, your spouse and dependents.
• Never share it with anyone except your tax preparer or software. The IRS will never call, text or email asking for it.

How to get one

• Online (fastest): sign in to your IRS online account, verify your identity, and retrieve your IP PIN immediately. The online tool is available roughly mid-January through mid-November each year.
• Form 15227: if your AGI is below $84,000 ($168,000 married filing jointly) and you cannot verify online, you can file Form 15227 and verify by phone. Your PIN then arrives by mail in 4-6 weeks, and in later years it is mailed automatically.
• In person: if you cannot use either option, make an appointment at a Taxpayer Assistance Center with identity documents. The PIN arrives by mail in about 3 weeks.
• Children: dependents under 18 cannot create their own online account and must use the alternative methods, such as Form 15227 or an in-person visit. A child's SSN is attractive to thieves because it may go unused for years.

Confirmed identity theft victims are enrolled automatically and receive a CP01A notice with their PIN each year.

Using it every year

Your IP PIN changes every year. Retrieve the current one from your online account before filing, or watch for the mailed notice. Software will ask for it; entering last year's PIN causes a rejection.

If you lose your PIN, retrieve it online. If you cannot, the IRS may verify you by phone, though a paper return may be needed and will take longer.

If you opted in voluntarily, the IRS describes ways to leave the program in its IP PIN FAQs, but confirmed identity theft victims generally stay enrolled, and one-time enrollees are dropped automatically at year end. Most people should stay enrolled; it costs nothing beyond a minute a year.

Signs you may be a victim

• Your e-filed return is rejected because a return with your SSN was already filed.
• An IRS letter asks you to verify your identity (such as a 5071C or similar), or reports a return you did not file.
• You receive a 1099-G for unemployment you never claimed, or a W-2 from an employer you never worked for. See unemployment taxes.
• Your IRS transcript shows wages or a refund you do not recognize.
• Your online account was created when you did not create it.

What to do if it happens

1. Respond to any IRS letter right away, following its instructions, using the phone number or website on the letter after confirming it on IRS.gov.
2. File Form 14039, Identity Theft Affidavit, if your e-file was rejected because of a duplicate filing, or as the IRS instructs. Many people file it online.
3. File your real return on paper if e-file is blocked, attaching Form 14039 if required. Pay any balance due on time to avoid penalties.
4. Report the theft to the Federal Trade Commission at IdentityTheft.gov, place a fraud alert or credit freeze with the credit bureaus, and check your Social Security earnings record.
5. Get an IP PIN. Victims are typically enrolled automatically once the case is resolved.

Resolution can take many months. Keep copies of everything and a log of each call.

Prevention beyond the IP PIN

• Create your IRS online account before a thief does. Claiming it yourself makes it harder for someone else to open one in your name, and lets you see transcripts, notices and payments.
• Freeze your credit at all three bureaus. It is free and blocks new accounts opened in your name, which often go hand in hand with tax fraud.
• Protect tax documents. W-2s, 1099s and prior returns contain everything a thief needs. Shred paper copies you no longer need and store digital copies in encrypted storage.
• Use strong, unique passwords and multi-factor authentication on tax software accounts, email and your IRS account.
• File early. A thief cannot file first if your legitimate return is already in. This is no substitute for an IP PIN, but it helps.
• Vet your preparer. Legitimate paid preparers have a PTIN and sign the return. Ask how they secure client data.
• Watch your mail in January and February for unexpected tax forms, and check your transcript once a year.

Business owners face a related risk: thieves file fake business returns or W-2s using an employer identification number. Watch for IRS notices about returns you did not file and respond quickly.

Illustration: the cost of skipping a six-digit number

Illustration: a family expects a $4,000 refund for 2026, including the refundable portion of the child tax credit.

• Without an IP PIN: a thief files on January 20 with fake W-2 data and collects a refund. The family's February return is rejected. They file Form 14039 and a paper return. Their real refund arrives many months later after the case is resolved, and they spend hours on letters and calls.
• With IP PINs for both parents and the kids: the thief's return is rejected for a missing or wrong PIN. The family files normally and gets their refund on the usual schedule.

Ten minutes of setup in January, compared with months of delay. And for the family's two children, the PINs also protect SSNs that might otherwise be used for years before anyone noticed.

Assumptions: illustrative timeline; actual processing times vary.

Scams to recognize

• Phone calls threatening arrest or demanding payment by gift card or wire. The IRS usually contacts you first by mail.
• Texts and emails with links promising refunds or asking for account details. The IRS does not initiate contact by email or text about your tax account.
• Fake letters that look official but direct you to unfamiliar websites or phone numbers. Confirm any letter against your online account. Crypto owners should know the real reporting rules; see the crypto tax guide.
• Ghost preparers who will not sign your return and send refunds to their own accounts. See tax software vs a CPA.
• Social media tax hacks encouraging false credits or fake W-2s. They lead to frozen refunds and penalties.

Verify any contact through your IRS online account or IRS.gov. More in the tax planning hub, and see the Form 1099 guide for spotting forms you should not have received.