Tax Identity Theft: IP PINs and What to Do If It Happens
An IP PIN blocks someone else filing under your SSN. Here's how to get one, why most victims should not file Form 14039, and the recovery steps in order.
Jump to section
TLDR
An IP PIN is a six-digit number that stops anyone else filing a return under your SSN or ITIN. It is the single most effective protection available, it is free, and since the program opened up, anyone who can verify their identity can get one, even if you have never been a victim and even if you are not required to file. Get it through your IRS online account. It is valid for one calendar year and regenerates annually. If theft has already happened, work the steps in order, and note the part most articles get wrong: most victims should NOT file Form 14039. If the IRS has already written to you, follow the letter instead.
Nobody discovers tax identity theft at a convenient moment. It is almost always the same scene: you file, and the return bounces back rejected because a return has already been filed under your Social Security number.
At that point you are not filing a tax return anymore. You are opening a case.
The good news is that the thing that prevents this entirely is free, takes about fifteen minutes, and most people still have not done it.
#The IP PIN, and why it is the whole ballgame
An Identity Protection PIN is a six-digit number known only to you and the IRS. Correct IP PINs must be entered on electronic and paper returns. A missing or wrong one gets an e-filed return rejected, and delays a paper return until it can be verified.
Read that from the thief’s side. Without your IP PIN, they cannot successfully file under your number. The mechanism that makes it annoying for you is exactly what makes it impossible for them.
#How to get one
The fast way: your IRS online account. Request it in the IP PIN section of your profile page. If you do not have an account on IRS.gov, register and validate your identity first. This is same-day.
If you cannot create an online account, there are two fallbacks, both slower:
- Form 15227, available if your AGI on your last filed return was below $84,000 (individuals) or $168,000 (married filing jointly), and you have access to a telephone. The IRS calls the number on the form to validate your identity, then mails the IP PIN, usually in four to six weeks, and annually thereafter.
- In person at a Taxpayer Assistance Center, if you cannot verify online or are ineligible for Form 15227. Bring one federal or state issued photo ID plus one additional form of identification. For a dependent, bring two forms of identification for them, such as a birth certificate and Social Security card. IP PIN arrives by mail, usually within three weeks.
Note: if you or your dependent are under age 18, you must use one of the alternative enrollment options rather than the online request.
#The four things people get wrong about IP PINs
It changes every year. An IP PIN is valid for one calendar year and a new one is generated annually. Last year’s number will not work.
How you get the new one depends on how you enrolled. If the IRS enrolled you because you were a confirmed victim, they mail a CP01A Notice with your new IP PIN each year. But if you opted in online, no CP01A is mailed. You have to retrieve it from your online account yourself, each year. This is where most self-inflicted problems come from: people wait for a letter that was never coming.
It is generally viewable in your online account from mid-January to mid-November. Plan around that window if you file an extension.
It applies to prior year returns too. An IP PIN must be used on any federal return you file during the year, including back-year filings. Relevant if you are catching up on unfiled years.
#If it has already happened
Work these in order. The order matters, because two of these steps cancel each other out.
- Stop interacting with the thief. Hang up. Send nothing. Do not click links or open attachments. If you already did, run antivirus software.
- Change your IRS online account password to something complex and unique.
- Follow the instructions in any IRS letter or notice you received. This takes precedence over everything below.
- Report it at IdentityTheft.gov and follow the recovery steps there.
- Get an IP PIN to protect the account going forward.
- Keep records of every letter, call and email.
- Keep filing and paying as usual. This is the step people skip while waiting for resolution, and it creates a second, entirely separate problem on top of the first.
- Check with your state tax agency, which runs its own process.
#The Form 14039 trap
This is where most advice goes wrong, so it is worth being precise.
| Do NOT file it if... | DO file it if... | |
|---|---|---|
| IRS contact | They already sent you a letter or notice | They tell you to file it |
| Verification service | You were told to use the Identity and Tax Return Verification Service | You cannot use that service |
| Already reported | You filed it already, or via IdentityTheft.gov | The IRS has no record of it yet |
| Type of theft | It is not tax-related | A data breach exposed your information |
| Entity | You are a business, trust or estate (use 14039-B) | You are an individual |
The IRS is direct about this: most people do not need to file this form. If they have already written to you, they already know, and filing an affidavit on top of an open case adds processing time rather than removing it.
The specific trap: if a notice directs you to the Identity and Tax Return Verification Service, use it and do not file Form 14039. Doing both is slower than doing the right one.
#Warning signs worth knowing
Most of these show up months before you would otherwise notice:
- A rejected e-filed return when you know you have not filed
- A W-2 or 1099 from an employer you never worked for
- A 1099-G for unemployment benefits you never applied for or received
- An EIN you did not apply for
- A CP2000 notice about income you do not recognize
- Account activity you did not initiate, or password reset alerts you did not request
- Your Social Security record showing wages you did not earn
If you want to check the last one directly, you can pull your IRS wage and income transcript and compare it against what you actually earned. That single document surfaces employment identity theft faster than almost anything else.
#What this costs you if you ignore it
A stolen refund is the visible loss and usually the smallest one. The real costs are time and delay: a fraudulent return in the system ahead of yours means your legitimate return is processed manually, refunds take months rather than weeks, and every subsequent year gets extra scrutiny until the account is cleaned up.
Set against that, fifteen minutes in your IRS online account to enroll in a free program is not a close call.
#What to actually do this week
- Create or log into your IRS online account if you have not.
- Request an IP PIN, and one for each dependent.
- Put a calendar reminder for mid-January to retrieve next year’s number, because if you opted in online, nobody is mailing it to you.
- Store it somewhere you will find it at filing time, and give it to your preparer only at signing.
If you are already dealing with a rejected return or an IRS notice you do not understand, that is worth a conversation rather than a search result. Bring the notice itself, since which letter it is determines which of the paths above you are on, and picking the wrong one adds months.